Exploitia is built and maintained by one person. Bug reports, ideas for monsters, and “this hunt made no sense” are all equally welcome.
Four things turn “it's broken” into a fix in minutes rather than an afternoon of guessing:
Your browser and your hunter are attached for you, so you can skip those.
If a lab teaches something subtly false, if a detection rule that works in your real job gets rejected here, or if the wording sent you down a blind alley — pick a hunt or rule feels wrong and tell me. The whole premise of Exploitia is that the mechanics are honest, so anywhere they are not is a defect in the thing that matters most.
Every target in Exploitia is a simulation running inside this application. There is no host on the other end of any command, nothing you type leaves the page, and no traffic is generated anywhere.
The techniques are real, though, and that is the point — Kerberoasting, delegation abuse and JNDI injection work the same way outside this browser as inside it. Running them against systems you do not own or have explicit written permission to test is a criminal offence in most countries, regardless of intent and regardless of whether anything breaks.
If you want somewhere legitimate to practise beyond here: your own lab, a deliberately vulnerable application you host yourself, or a platform that provides targets with permission attached. The defensive half of every pair you forge here transfers to real work immediately, with no such caveat.
Play without an account and the only thing stored is a cookie in your browser holding your hunter's name, archetype and progress. It is signed so it cannot be edited by hand, and it never leaves your device except to be read back by the game.
Link an email for cloud save and that address plus the same progress is stored so it can follow you between devices. No passwords are held, because there are none — sign-in is a link sent to your inbox. Deleting your hunter with New Game removes the stored copy too.
A ticket opened above stores what you wrote, the reply address if you gave one, and your hunter and browser for reproducing bugs. Tickets are readable only by the person maintaining Exploitia, and are never used for anything but answering you.