BreachLab

My Certs

Operative Level37

3,480 XP to Level 38

220 / 3,700 XP this level6%

Points

66,820

Levels Solved

101

First Bloods

Security Score

305

Track Mastery

★

Ghost23/23

★

Phantom32/32

★

Mirage41/41

Specter0 / 140%

Specter II0 / 80%

Mirage II5 / 1242%

Inventory

View full inventory →

No items yet.

Achievements

Ghost Graduate

Phantom Operative

Mirage Exploiter

Mirage 2 Graduate

Specter Analyst

First Blood×25

Track Complete×3

Ghost Top 10

Phantom Top 10

Specter Top 10

Phantom Pioneer

Speedruns

Track	Time	Status
Ghost	01:43:39	—
Mirage	49:33:56	—
Phantom	60:10:03	—

Security Contributions(305 score · 14 credits · separate from track points)

L30 su -s /bin/bash phantom30 bypasses the ephemeral redirectHigh+25

architectural bypass / ephemeral-shell circumventionbreachlab-phantom#712026-04-26

L28 /tmp/heist.flag persists across players on shared mgmt hostHigh+25

shared-host residue / chain-integrity bypassbreachlab-phantom#712026-04-26

L21/L22/L23 oracle HMAC missing in container-escape emulatorsHigh+25

oracle HMAC drift / silent emulator regressionbreachlab-phantom#692026-04-26

L20 history-residue free-flag bypassHigh+25

shared-account history residue / free-flag bypassbreachlab-phantom#682026-04-25

L17 Internal Hunt canonical solve broken — StrictModes + pam_unix lstchgHigh+20

2026-04-24

SUID-verify priv-esc via /etc/ld.so.preload + BASH_ENVCritical+30

2026-04-24

phantom-deep oracle stale-token UX gapLow+5

2026-04-24

L19 ops shell exposes L31 graduation targetMedium+10

2026-04-24

canonical-flags.ts leaked all track flags in public repoCritical+30

2026-04-24

mgmt container /opt/*.py world-readable exposes flag pipelineMedium+10

2026-04-24

L15 clean_flag is literal submit flagHigh+20

2026-04-24

history-clear bypass defeats verify-shadow LOUD regexHigh+20

2026-04-24

LD_PRELOAD on curl intercepts oracle token — cross-level forgeCritical+30

2026-04-24

L12 NOPASSWD:ALL universal skip vectorCritical+30

Class 17phantom#502026-04-24