# D3CYPH3R
A browser-based terminal CTF for DevOps engineers, SREs, and SysAdmins learning cybersecurity. You play a new hire at **Driftwood Systems**, a mid-sized tech consulting firm with roughly 600 consultants spread across ~80 client engagements at any given time. Each level drops you on a real-feeling box you've inherited — a rolled-off consultant's laptop, a stale client engagement environment, a forgotten audit artifact, an alibi photograph submitted to in-house counsel — and asks you to find what got left exposed.
The puzzles stay close to what actually happens at consulting firms with rotating engagements and shared client access. The post-mortem at the end of each level pulls the thread out to the controls (NIST 800-53, NIST 800-171, CIS Controls v8, CIS AWS Foundations Benchmark, CWE), the techniques (MITRE ATT&CK), the regs that bite (GLBA, PCI-DSS, HIPAA, FERPA, CMMC, SOC 2, NAIC, NYDFS), and the certs (Security+, CySA+, PenTest+, CISSP, OSCP, CHFI, GCFE / GCFA, AWS Security Specialty, CCSP, CCSK) that cover this territory in the real world.
Recurring characters, recurring clients, recurring technical debt across levels.
All seven tracks (Linux, Network, Crypto, Web, Forensics, OSINT, Cloud) ship level0 + level1 chains playable end-to-end, and now all seven ship through level2 as well (v1.23.0 + v1.25.0 + v1.26.0 + v1.27.0 + v1.28.0 + v1.29.0 + v1.30.0). 21 levels across all 7 tracks. Each level introduces one new concept and drops the player into a different client engagement with a different compliance regime in scope:
| Track | Levels shipped | Client | Compliance |
|---|---|---|---|
| Linux | `level0@linux` ("Daniel's Last Day"), `level1@linux` ("The Backup Daniel Forgot"), `level2@linux` ("Daniel's Forgotten Cron") | Halton Bank | GLBA |
| Network | `level0@network` ("Atlas Health Perimeter Check"), `level1@network` ("The Map Marcus Didn't Mean to Share"), `level2@network` ("What the Cert Knew") | Atlas Health | HIPAA |
| Crypto | `level0@crypto` ("Theo's Safer API Key"), `level1@crypto` ("Theo's Signature That Wasn't"), `level2@crypto` ("Theo's Quick Hash") | Vesta Retail | PCI-DSS |
| Web | `level0@web` ("Meridian's Forgotten Backup Folder"), `level1@web` ("Carlos's Login Wall"), `level2@web` ("The Search Bar That Talks") | Meridian State University | FERPA |
| Forensics | `level0@forensics` ("Reed's Soccer Alibi"), `level1@forensics` ("What the Logs Saw"), `level2@forensics` ("What Reed's Browser Saw") | Polaris Defense Systems | CMMC / NIST 800-171 |
| OSINT | `level0@osint` ("Veridian's Open Letter"), `level1@osint` ("Aaron's Weekend Project"), `level2@osint` ("The Internet Never Forgets") | Veridian Analytics | HIPAA / HITRUST CSF |
| Cloud | `level0@cloud` ("Coverline's Twelfth Bucket"), `level1@cloud` ("The Migration Table Nobody Dropped"), `level2@cloud` ("The Key Nobody Turned Off") | Coverline Insurance | SOC 2 / NAIC / NYDFS / GLBA |
## Running it locally
ES modules need an HTTP origin, so opening `index.html` via `file://` won't work. From the project root:
python3 -m http.server 8000
# then open http://localhost:8000
Or use any other static server (`npx serve`, `live-server`, etc.).
D3CYPH3R is **designed for desktop**. The puzzles assume a real keyboard — Tab autocomplete, Ctrl-shortcuts, long pipelines. Mobile devices see a warning gate by default; tapping **Continue anyway** boots the engine in mobile mode with a soft-key row above the on-screen keyboard for Tab / Esc / Ctrl-C / `|` / `&&` / `$` / `_` / etc. (v1.21.0). The site is also installable as a **Progressive Web App** — Chrome / Edge / Safari 16.4+ show an Install button after a few visits, after which the app gets its own dock icon, opens in a borderless window, and works offline.
## What you can do today
Pick a track from the lobby — all seven are entry-point reachable with no password:
guest@d3cyph3r:~$ ssh level0@linux # File reading / credential hunting
guest@d3cyph3r:~$ ssh level0@network # Port scanning / perimeter audit
guest@d3cyph3r:~$ ssh level0@crypto # Encoding ≠ encryption
guest@d3cyph3r:~$ ssh level0@web # HTTP directory enumeration
guest@d3cyph3r:~$ ssh level0@forensics # EXIF metadata / insider-threat
guest@d3cyph3r:~$ ssh level0@osint # Breach-corpus credential reuse
guest@d3cyph3r:~$ ssh level0@cloud # S3 misconfiguration / SOC 2 audit
Each track's `level0` is an entry point — no password, walks you through one new concept, and ends with a post-mortem citing the relevant CWE / framework / MITRE technique. The level1 in each track is gated by a credential the player recovers during level0 (Daniel's `creds.txt`, Marcus's unrotated default, the decoded base64 API key, Meridian's leaked DB password, Sgt. Chen's handoff archive password, Aaron's reused breach-corpus password, and Coverline's hardcoded RDS master). Every level1 in turn leaks a credential staged for the eventual level2 — the per-track credential chain is the through-line.
The lobby (`guest@d3cyph3r`) renders the engagement list as a collapsible tree (v1.10.0): each track is one line by default; `tracks
` expands a track to show its level lineup with titles, computed difficulty tier (Routine / Live / Escalated / Critical / Crisis — type `tiers` for definitions), and estimated time. Tracks with any visited level auto-expand on the next lobby render. First-time visitors see a guided FIRST STEPS block and can run `tutorial start` for a hand-held walk-through (v1.12.0); returning visitors see a welcome-back summary with a "Continue: ssh level@