One platform. Same ELO. Same skill vector. Same nightly REACTOR pipeline. Offence, defence, full-spectrum, or critical-infrastructure.
Offensive tradecraft. No quizzes, no simulations.
Find the bug. Chain the primitives. Capture the flag. Every challenge is a live app, a live binary, a live chain — something you exploit end-to-end.
OWASP Top 10 at speed. SQLi, XSS, SSRF, IDOR, auth-bypass chains.
RSA, AES, hashes — padding oracles, nonce reuse, length extension. Never "just run a tool".
Buffer overflows, format strings, heap feng shui. Leak, overwrite, escape the container.
Reentrancy, integer overflow, broken access control. Hardhat sandboxes, real exploits.
Pivot from a handle to a hostname to a human. Web + social investigation puzzles.
Broken auth, mass assignment, IDOR at the REST layer. Chain primitives, bag the flag.
Prompt injection, jailbreaks, RAG poisoning. The attack surface nobody had in 2020.
SOC tradecraft, on live captures.
Triage the SIEM alert. Correlate the evidence. Name the threat. Real PCAPs, real memory images, real logs — timed against a real analyst par.
Live incidents. You get the ticket, the alerts, the box. Scope it, timeline it, hunt it.
Disk, memory, network. Recover the artifact, prove the story.
Static + behavioral. Unpack it, config-extract it, classify the family.
Python, C, Go binaries. Ghidra + patience. Understand what it does, not what it looks like.
Defender-side OSINT: attribute the actor, map the infra, verify the report.
OT/ICS defense, on simulated PLCs.
For ICS engineers, OT SOC analysts, and asset owners in energy, water, manufacturing, and transport. Modbus, DNP3, S7, OPC-UA, EtherNet/IP — anomaly hunts, IR triage, safety-violation detection, asset discovery, protocol forensics. Calibrated to your skill, fresh every week. Simulators only, never real PLC firmware.
Catch the deviation in the Modbus, DNP3, S7, OPC-UA, or EtherNet/IP packet stream before it becomes an incident.
Plant-floor incident lands on your desk. Scope it, contain it, separate the operational from the malicious.
Detect the command sequence that breaches a safety interlock. Process safety meets cyber forensics.
Map an OT segment without breaking it. Passive enumeration, protocol fingerprinting, vendor inventory.
Reconstruct the attack from a raw industrial-protocol capture. PCAP, vendor-specific frames, stateful decode.
The hardest tier. Full-spectrum.
ELO-matched across the full offensive/defensive skill space. You'll exploit the app and then defend the same app's sibling — sometimes in the same challenge.
Exploit the SaaS, then triage the alert your exploit would have generated.
Recover key material from a captured session, decrypt, reconstruct the intent.
Write the implant, then reverse your own implant's twin.
Exploit and defend in one scenario: reentrancy attack + the monitor that catches it.
Make the RAG assistant leak its system prompt. Then detect the attack.
Triage what your red colleagues just pulled off. Full-spectrum incident drill.
Disk, memory, pcap. Cross-discipline cases that need both offensive eyes and defensive rigour.
Write it, reverse it, detect it. Purple only.
Understand the binary well enough to attack AND defend it.
Chain IDOR + BOLA + mass assignment. Then write the abuse detection rule.
Attribution, recon, investigation — both sides of the table.
Encoding, stego, scripting — the tricks that don't fit a taxonomy.
Orbital, mission and threat-analysis decisions across synthetic space operations scenarios.
The ELO matchmaker will find your weak spot in minutes and start building your skill vector from there.