The Labs
Every lab is a fully realized fictional company. Multiple services, real defenses, real exploit chains. Pick your difficulty.
Remit
Remit runs accounts payable for a few dozen companies out of Columbus. Suppliers send invoices in, a finance team approves them in a separate review console, and payments go out. Last month an outsider rewrote a supplier's bank details on a live invoice and the payment went to the wrong account, and none of the staff with console logins can explain how anyone else got in. You have a plain supplier account. Find the path to the console.
Halcyon FM
Halcyon FM is a small listener-supported community station up in Asheville. Marlow and a rotating crew of volunteers run the whole thing off a couple of machines in the back of the studio. The public site carries the schedule and takes show pitches. The playout console the crew use to run automation lives on its own subdomain. Last week an unaired pledge-drive script and the station's underwriter contact list turned up, word for word, on a rival station's blog. Nobody on the crew can explain how anyone reached the console. Start on the public site as an anonymous listener and find the way through to whatever is running the back office.
NorthKorea
You are a foreign operative working a low-privilege scout account on the KPA Strategic Command portal (issued credentials: admin / admin). Every field report you file is reviewed in person by Marshal Kim, and his endorsement carries an AUTHORIZATION_CODE that never leaves his screen. You cannot read it directly. Recover that code.
JurryHurry
JurryHurry is a long-established firm that handles everything from real estate closings to commercial litigation. Enquiries come in through the contact form on the public site, and a clerk works the queue from a staff portal each morning. The managing partner wants a quiet look at that portal before a compliance review. Start at the front door and see how far in you get.
PhotoStore
Simon's PhotoStore is a small editorial and portrait studio that lets clients upload their originals through a web "Upload Studio." To help catalogue the archive, the studio bolted on a homegrown "MetaDSL" engine that reads the ImageDescription field baked into each photo's metadata and processes it as part of the intake pipeline. It works beautifully on a well-behaved holiday snap. The question is what the pipeline does when the metadata isn't a caption at all. Upload something of your own and see how much of the studio's back office you can reach.
BowBuy
BowBuy runs lean: a Blue Ridge pro shop that went online, a small crew, and a launch promo that drops a little store credit into every new member's account to get them started. The catalog, though, is all premium glass and carbon — every rig priced just out of reach of that welcome handout. The crew are sure no new member walks out with a bow on day one. Prove them wrong, and the thank-you gift is yours.
Spread
Spread was a weekend build that quietly kept going: one developer, one server, a few users who just wanted their spreadsheets to read like less of a wall of commas. Running everything yourself means nobody reviews your shortcuts. There's a corner of it the maker kept for themselves — a secret only ever meant for their eyes, behind a door they were sure the public side could never open. Prove them wrong.
Inked
Jill's Tatt Shop books fast and runs lean: a slick public site where clients request appointments, a staff dashboard where the artists triage those requests, and a CRM API tying it together. After a client's contact details turned up somewhere they shouldn't have, Jill brought you in to test the shop's systems end to end. You start on the public site as an anonymous visitor. The staff dashboard lives on its own subdomain and only shows a login. Your objective: get into the staff back office, find your way to whatever it's talking to, and read what the studio is hiding on the box.
Bomb Threat
An anonymous group calling itself NEXUS has placed a 15-kiloton device under Central London and is demanding $10,000,000 within 24 hours. The detonator is wired to a remote control panel called NEXUS Control — your task is to break in, climb out of the maintenance role you'll land with, and trigger the deactivate endpoint with the right clearance. Their portal is a single-page console with login, MFA, and a "deactivate" button gated behind a clearance level your stolen account doesn't have. Find a way.