Specter II — Infrastructure Warfare
Initial access through the wire and the air. Eight levels, L0–L7, against the layer-two primitives and the radios real networks actually run.
Briefing
Specter I hands you the intelligence package. Specter II is where you convert it into a foothold. The wire half runs the layer-two and Active Directory primitives that put you on a segment you were never meant to reach — passive recon, name-resolution poisoning, NAC bypass, and AD CS coercion-to-identity. The air half is wireless on its own terms: WPA2 keyspace economics, enterprise evil-twins graded on the noise they make, WPA3 client-isolation escape, and a cross-medium capstone that pivots from an enterprise relay over Bluetooth.
Points are weighted by how hard the level actually is, not by where it sits in the list. AD CS coercion outranks WPA2 cracking, and the capstone is priced like the showcase it is.
SSH Access
ssh [email protected] -p 2244Levels
| # | Level | Points | Operatives | First Blood | Status |
|---|---|---|---|---|---|
| Part 1 — Network & Wireless | |||||
| Act I — The Wire | |||||
| 0 | Recon the WireRead the Wire | 300 | 4 | — | |
| 1 | Poisoning & MITMBecome the Answer | 400 | 4 | — | |
| 2 | NAC BypassGhost on the Wire | 500 | 1 | — | |
| 3 | Coercion to IdentityBecome the Domain Controller | 750 | 1 | — | |
| Act II — The Air | |||||
| 4 | WPA2 EconomicsCrack the WiFi — and Know What It Costs | 600 | — | — | |
| 5 | Evil Twin & KarmaBecome the AP the Victim Trusts | 850 | — | — | |
| 6 | WPA3 FrontierBreak Client Isolation. Reach the Unreachable | 1100 | — | — | |
| 7 | Enterprise Relay & BLE CrossoverTwo Heads, One Gap | 1500 | — | — | |