NEED HELP?
Getting stuck is part of the job. Work the problem in order — most walls fall by step two.
When you're stuck
- 1Re-read the level README.
The brief almost always names the technique and where the secret lives. Most walls come from skimming it.
- 2Learn the tool, not the answer.
Don't know a command?
man <command>or a search engine will get you further than a hint. The skill is the point. - 3Ask in the open — no spoilers.
Still stuck, post in
#help-forumon Discord. Follow the rules: never share flags, passwords, or solutions — the rooms are mirrored and spoiler tags don't survive.
How flags work
BreachLab uses the chain-password model. The flag you submit for level N is the same password you used to SSH into level N+1. Solve the level, recover the secret — almost always a file on the box — then paste it on /submit for points.
The final level of each track ends in a one-off graduation token instead of a chain password. It is the flag for that last level and has no next-level SSH login — you will know it when you reach it.
Flags are case-sensitive. Surrounding whitespace is trimmed — copy them verbatim.
First blood
The first operative to submit a correct flag for a level takes a bonus on top of the base points (usually +50). After that the slot is claimed for good — everyone else earns base points only.
Every level shows who holds first blood on its track page. A red FIRST BLOOD AVAILABLE marker means it is still up for grabs.
Connect & ports
Connect with the level's user and port. The password is the flag from the previous level.
ssh <user>@204.168.229.209 -p <port>GhostTrack 1 · foundation · one shared persistent box
| Level | Port | Notes |
|---|---|---|
| L0 – L21 | 2222 | single box, all foundation levels |
| L22 | — | graduation — gatekeeper, no SSH login |
PhantomTrack 2 · post-exploitation · main box + ephemeral side-rooms
| Level | Port | Notes |
|---|---|---|
| main | 2223 | L0–8, L10–12, L16–29, L31 graduation |
| L9 | 2228 | ephemeral — Stack Day (optional) |
| L13 | 2224 | ephemeral — Deep Roots |
| L14 | 2225 | ephemeral — Shadow Mode |
| L15 | 2226 | ephemeral — Clean Slate |
| L30 | 2227 | ephemeral — Clean Exit |
Specter ITrack 3 · OSINT · every level is its own ephemeral box
| Level | Port | Notes |
|---|---|---|
| L0 | 2230 | paper-trail |
| L1 | 2231 | search-operator |
| L2 | 2232 | code-hunter |
| L3 | 2233 | js-recon |
| L4 | 2234 | people-recon |
| L5 | 2235 | sock-puppet |
| L6 | 2236 | image-geo |
| L7 | 2237 | reverse-image |
| L8 | 2238 | travel-pattern |
| L9 | 2239 | corporate-intel |
| L10 | 2240 | dark-web |
| L11 | 2241 | telegram-intel |
| L12 | 2242 | adversarial-counter-intel |
| L13 | 2243 | berkeley-protocol — finale |
Specter IIInternal network & Active Directory · every level its own ephemeral box
| Level | Port | Notes |
|---|---|---|
| L0 | 2244 | Read the Wire · open entry (password specter0) |
| L1 | 2245 | Become the Answer |
| L2 | 2246 | Ghost on the Wire |
| L3 | 2247 | Become the Domain Controller |
| L4 | 2248 | Crack the WiFi |
| L5 | 2249 | Become the AP the Victim Trusts |
| L6 | 2250 | Break Client Isolation |
| L7 | 2251 | Two Heads, One Gap |
for p in 2222 2223 2224 2225 2226 2227 2228 2230 2231 2232 2233 2234 2235 2236 2237 2238 2239 2240 2241 2242 2243 2244 2245 2246 2247 2248 2249 2250 2251; do ssh-keygen -R "[204.168.229.209]:$p"; doneDiscord
The fastest way to get unstuck and meet other operatives: https://discord.gg/xqTbW6juXt