BreachLab

My Certs

Operative Level27

2,680 XP to Level 28

20 / 2,700 XP this level1%

Points

35,120

Levels Solved

First Bloods

Security Score

305

Track Mastery

Ghost23 / 23★ Ghost Operative

Phantom32 / 32★ Phantom Operative

Specter0 / 140%

Trophy Case

Ghost Graduate

Phantom Operative

Specter Analyst

Specter Sovereign

First Blood×23

Track Complete×2

Ghost Top 10

Phantom Top 10

Specter Top 10

Specter Mystery — Solved

Speedruns

Track	Time	Status
Ghost	01:43:39	—
Phantom	60:10:03	—

Security Contributions(305 score · 14 credits · separate from track points)

L30 su -s /bin/bash phantom30 bypasses the ephemeral redirectHigh+25

architectural bypass / ephemeral-shell circumventionbreachlab-phantom#712026-04-26

L28 /tmp/heist.flag persists across players on shared mgmt hostHigh+25

shared-host residue / chain-integrity bypassbreachlab-phantom#712026-04-26

L21/L22/L23 oracle HMAC missing in container-escape emulatorsHigh+25

oracle HMAC drift / silent emulator regressionbreachlab-phantom#692026-04-26

L20 history-residue free-flag bypassHigh+25

shared-account history residue / free-flag bypassbreachlab-phantom#682026-04-25

L17 Internal Hunt canonical solve broken — StrictModes + pam_unix lstchgHigh+20

2026-04-24

SUID-verify priv-esc via /etc/ld.so.preload + BASH_ENVCritical+30

2026-04-24

phantom-deep oracle stale-token UX gapLow+5

2026-04-24

L19 ops shell exposes L31 graduation targetMedium+10

2026-04-24

canonical-flags.ts leaked all track flags in public repoCritical+30

2026-04-24

mgmt container /opt/*.py world-readable exposes flag pipelineMedium+10

2026-04-24

L15 clean_flag is literal submit flagHigh+20

2026-04-24

history-clear bypass defeats verify-shadow LOUD regexHigh+20

2026-04-24

LD_PRELOAD on curl intercepts oracle token — cross-level forgeCritical+30

2026-04-24

L12 NOPASSWD:ALL universal skip vectorCritical+30

Class 17phantom#502026-04-24