Documentation

Every active team member downloads their own WireGuard config — there is no single shared team bundle to wait on, and no client-side key generation or upload. Sign in, open Team → Infrastructure, and select "Download my VPN config". The file is named after your account (e.g. your-username.conf) and is safe to re-download any time — it's not a one-time reveal.

Bring the tunnel up with your platform's WireGuard client (wg-quick up <file> on Linux, or the official app on macOS/Windows/mobile). Only run one game VPN tunnel per machine at a time — a second active VPN commonly wins the default route and silently breaks game-net access.

Vulnboxes are centrally hosted — you never download or run a VM/OVA image. Instead, your team has a single shared SSH key. Any approved, active team member can download the current key from Team → Secrets (filename your-team-name.key); captains also manage secret generation and rotation. Once your WireGuard tunnel is up, use that key to SSH directly into your assigned box — the exact address and a ready-to-copy SSH command are on Team → Infrastructure.

Any approved member of your team — not just the captain — can download your team's network captures from Team → PCAPs. Each capture is released a fixed number of ticks after its window closes, to prevent live traffic from leaking to other teams while a round is still active.

The scoreboard tracks three components per team: Offense (flags you steal), Defense (penalties for flags lost), and SLA (uptime and correctness). Each service also carries a status pill: UP (fully healthy), RECOVERING (back up, not yet stable), FAULTY (responding, but not correctly), FLAG NOT FOUND (stored data is missing), DOWN, TIMEOUT, and NOT CHECKED. See How to play for what each one means for your SLA.

Flags submit over a line-based TCP connection: one flag per line, one result line back per flag, in order. The service sends a short banner as soon as you connect, before you send anything. You're attributed by your source game-net IP (WireGuard tunnel up, nothing else to authenticate on that connection). Flags look like FLAG{...}.

Result codes: OK, DUPLICATE, OLD, OWN, INVALID, SPAM, INVALID_SENDER, ERROR. Ticks are 3 minutes and a flag is valid for submission for 5 rounds after it's planted. Your exact submission endpoint is shown after you sign in, on Team → Infrastructure.