Operation Glasshouse
Connect cache poisoning, SSRF, software provenance and network segmentation into an evidenced attack chain.
One chain. Four open boundaries.
09:17. A clean browser receives someone else's release notes. The deployment is green, yet a debug pod can reach the payment service. Four isolated findings, or one attack chain? Take the case from the first request to a defensible conclusion. Work with evidence: the simulation evaluates observed behavior and your regression checks.
How the case works · Model limits and progress
A multi-stage case inside a closed simulation. All hosts, keys, files and records are fictional. Anonymous progress resumes in the same browser for 14 days. There is no real shell or access to external systems.
All actions stay inside the simulation. No installation or credentials are required. Checks run on the server; solutions are not embedded in the browser code. An essential anonymous cookie links progress to this browser for 14 days; no name or email is required. Personal notes stay on this device. Failed experiments cost no points. Each newly requested hint costs 5 points. No leaderboard or professional certification.
Loading case progress…
0 stages completed.Technical foundations and further reading
The simulation models selected mechanisms. Real systems require additional platform, parser, network and trust checks.
Your work. Your completion record.
Solve it. Then prove it.
Once all stages are verified by the server, download your private PDF completion record. The name or alias printed on it is not stored.
Your place in the Hall of Fame
Only if you choose. Your PDF is independent of this. Alias, course, points and completion date are published for at most twelve months.
Optional publication becomes available after successful completion.
After the exercise: what did you learn?
Latest 50 approved commentsWhat helped, what is missing, where did you get stuck? Constructive criticism is welcome. No credentials, other people's personal data or links. New comments are reviewed before publication.
No comments yet. Share the first insight.