FIELD MANUAL

shellDojo is a blue team training range disguised as a terminal. Every scenario drops you into a simulated Linux or Windows machine that is already compromised. Your job: hunt the intruder, prove their tradecraft, and evict them — by typing real incident-response commands.

How the ghost works

The dim text ahead of your cursor is the next command the range expects. It is a guide, not a shortcut: you must type the full command yourself to advance. Muscle memory is the lesson. Tab consumes a single token if you're lost mid-command; hint reveals more of the command at a score penalty.

Switch the tasking panel from GUIDED to BLIND once a scenario feels familiar. Blind mode hides the ghost entirely, so recall — not tracing — is what gets measured. Run an operation guided to learn it, then blind to prove it.

How you're measured

Two numbers matter, and the range tracks both on every command:

• Accuracy — correct commands over commands entered, plus how many steps you cleared on the first try. Accuracy is what separates an operator from someone who reads a runbook aloud.
• Speed — elapsed time against the operation's par, per-step pacing, and raw typing rate. During a live incident the clock is an adversary too.

Finish an operation and you get an after-action report: grade, accuracy, first-try rate, hint spend, per-step pacing, and whether you beat par. Your record persists in this browser — rank and XP accumulate, and badges unlock for things worth being able to do (a flawless run, an S grade, a full sweep of every operation, a clear with the ghost switched off).

The operations

• Operation Ghost Signal — A web server is mining crypto for someone who isn't you. (linux, difficulty 1, 24 steps)
• Operation Midnight Run — PsExec-style lateral movement on a domain-joined Windows server. (windows, difficulty 2, 28 steps)
• Operation Iron Ledger — Post-breach persistence audit on a Debian build server. (linux, difficulty 1, 20 steps)
• Operation Glass Shield — Emergency network segmentation during a live ransomware spread. (linux, difficulty 3, 18 steps)
• Operation Broken Key — Locked out of your own database server. Boot it back into your hands. (linux, difficulty 2, 15 steps)
• Operation Dead Bolt — The domain controller locked every admin out. Recover it from the boot up. (windows, difficulty 3, 14 steps)
• Operation Salted Earth — A live ransomware run is locking you out as fast as you log in. Race it. (linux, difficulty 3, 13 steps)
• Operation Paper Oracle — Your support AI read a booby-trapped ticket and did what it was told. (linux, difficulty 2, 11 steps)
• Operation Hollow Index — One poisoned document taught your company assistant to lie. (linux, difficulty 2, 11 steps)
• Operation Tainted Weights — The model you deployed this morning isn't the one you reviewed. (linux, difficulty 3, 11 steps)
• Operation Ghost Prompt — Your chatbot handed a stranger its own system prompt — API key and all. (linux, difficulty 1, 10 steps)
• Operation Runaway Agent — An autonomous agent went off the rails and started renting GPUs on your card. (linux, difficulty 2, 11 steps)
• Operation Whisper Net — Someone is smuggling your data out disguised as ordinary AI chatter. (linux, difficulty 2, 12 steps)
• Operation False Copilot — A developer plugged an untrusted tool into their AI copilot. It read the repo secrets. (linux, difficulty 3, 12 steps)
• Operation Poison Well — Someone seeded your abuse-detection model to wave their own attacks through. (linux, difficulty 3, 11 steps)
• Operation Mirror Mask — A cloned voice talked your help desk into resetting an executive's MFA. (linux, difficulty 2, 10 steps)
• Operation Synthetic Siege — Every infected host has a different malware hash. Signatures are useless. Adapt. (linux, difficulty 3, 12 steps)
• Operation Cold Trail — One C2 address. Pivot it into the attacker's whole estate — and find where the trail ends. (linux, difficulty 3, 10 steps)
• Operation Paper Trail — You know what happened. Now preserve it, report it, and hand it over properly. (linux, difficulty 2, 10 steps)
• Operation Onion Skin — Every hop is Tor. Route attribution is dead — so establish why they came for you. (linux, difficulty 3, 13 steps)
• Operation Flash Point — A compromised agent is spawning workloads faster than you can delete them. Stop chasing. (linux, difficulty 3, 13 steps)
• Operation Hydra Protocol — It rebuilds itself every time you kill it. Take away what it rebuilds with. (linux, difficulty 3, 12 steps)
• Operation Dead Reckoning — Machine-generated credential stuffing from 9,000 addresses. Blocking by hand loses. (linux, difficulty 2, 12 steps)
• Operation Hollow Crown — A nation-state-grade domain compromise. Work it to first contact and find out who really opened the door. (windows, difficulty 5, 50 steps)
• Operation Still Water — A water plant, operators locked out of the HMI, and a dosing setpoint that is no longer theirs. (linux, difficulty 5, 27 steps)
• Operation Dry Powder — The autonomous defence appliance is dead. Drones, robots, machinery and radios are all yours now. (linux, difficulty 5, 40 steps)
• Operation Paper Walls — Twelve containers, one reverse proxy, and one bind mount that made all of it optional. (linux, difficulty 5, 20 steps)
• Operation Last Good Copy — Everything on the NAS is encrypted, including the backup. Something older than the damage still exists. (linux, difficulty 5, 18 steps)
• Operation Thin Partition — A doorbell camera reached the hypervisor's management interface. The VLAN was a label, not a wall. (linux, difficulty 5, 18 steps)
• Operation Rebound — A public name resolved to your living room. The browser did the rest. (linux, difficulty 5, 18 steps)
• Operation Dark Datastore — Every guest is stopped and the datastore is encrypted. The multi-terabyte disks were never touched. (linux, difficulty 5, 21 steps)
• Operation Choke Point — Your edge firewall answers to somebody else. Everything the site does passes through it. (linux, difficulty 5, 21 steps)
• Operation Blue Water — Contacts that are not there, a position that jumps, and a chart display that believes all of it. (linux, difficulty 5, 19 steps)
• Operation Broken Chain — Nothing was exploited. Every component did exactly what it was documented to do, and the data left anyway. (linux, difficulty 5, 29 steps)
• Operation Cold Key — No malware. A Group Policy Object turned on BitLocker across the estate with somebody else's recovery key. (windows, difficulty 5, 20 steps)
• Operation Borrowed Blade — The endpoint agent did not crash and did not alert. It was terminated from kernel space by a driver with a valid signature. (windows, difficulty 5, 19 steps)
• Operation Babel — You inherited the site, the servers and the logs. The logs are not in your language, and neither is the intruder. (linux, difficulty 5, 20 steps)
• Operation Undertow — Your users' video feeds are being steered. You cannot fix what they see. You can destroy the thing that put it there. (linux, difficulty 5, 22 steps)
• Operation Ash Layer — The logs were destroyed and the toolkit was shredded. The filesystem kept more than either of them intended. (linux, difficulty 5, 20 steps)
• Operation Residue — Sixteen gigabytes of RAM from a host that looked clean. Every process on it is a Windows process. One is lying. (linux, difficulty 5, 18 steps)
• Operation Second Hand — Every timestamp on the suspect file says March. The filesystem keeps a second set that nothing bothered to change. (windows, difficulty 5, 18 steps)

What you actually learn

• Linux host triage: process trees (ps auxf), socket-to-process attribution (ss -tulnp), auth-log forensics, memory captures with avml, /proc sleuthing.
• Timeline forensics: bracketing journalctl windows, reconstructing installer trails in dpkg.log, last/faillog correlation.
• Malware triage: hashes before handling, strings, hex headers, UPX packing tells, YARA, safe static analysis.
• Windows threat hunting: Get-WinEvent XPath, the 4624/4625/4672/4698/7045 event constellation, LOLBins, WMIC process forensics, scheduled tasks, persistence keys.

Rules of the range

• Everything here is fictional — hosts, hashes, logs, IP addresses. Nothing you type is executed anywhere; the range is a pattern matcher over a scripted world. Practicing on systems you don't own is a crime. Don't.
• Grades run S (near-perfect accuracy, no hint spend, inside par) down to C. Every miss is answered in-world and then explained — read the blue ▶ lines, they are the actual lesson.
• Get stuck three times on one step and the range starts revealing the command for free. Being stuck is not a punishment; not learning why is.

Meta-commands

These are not part of the scenario — they talk to the range itself:

• missions — list operations and return to the lobby
• start <id> — deploy an operation
• objective — restate the current task · brief — re-read the briefing
• hint — reveal more of the command (costs score) · status — live accuracy, pace, score
• clear — wipe the screen · abort — abandon the operation

ENTER THE RANGE →