Exploitia has one loop and it runs both ways: you break something, then you build the thing that would have stopped you. Neither half counts on its own.
Every monster is a real vulnerability class. You hunt it by actually exploiting it through a terminal — no multiple choice, no clicking through a scripted demo. A clean exploit drops material: the logs, tokens or traces your own attack just generated.
You then take that material to the Forge and write a detection rule against it. Your rule is scored against traffic you have never seen. Only when both halves are real does the pair light up on your talent tree.
That is the whole thesis. Plenty of people can run an exploit. Plenty of people can write a detection. The interesting skill is holding both at once, and it is very hard to fake here, because the game checks.
The terminal is a real command interface, not a text box that accepts one magic answer. Commands are parsed, arguments matter, and wrong ones fail the way real tools fail — with an error that usually tells you something.
Each hunt shows a hint above the terminal with a command worth trying. Following it exactly will get you moving; it will not always finish the job. Several hunts need three or four steps, where something you find in one step becomes the input to the next.
Nothing you type leaves the simulation. There is no network target behind any of this.
A detection rule here is a regular expression. It is run for real against two sets of traffic you cannot see: lines produced by the attack, and ordinary lines from the same system. Two numbers come back.
Of the attacks, how many did you catch? Miss too many and the attack walks past you.
Of the things you flagged, how many were real? Flag normal traffic and your team stops reading your alerts.
You need at least 80% recall and 75% precision to forge the rule. A rule that matches everything scores perfect recall and fails on precision, which is the lesson — noisy detections are not detections.
When a rule falls short the Forge shows you exactly which attack line it missed and which piece of ordinary traffic it wrongly flagged. Read those two lines; they usually contain the answer.
New to regular expressions? There is a Regex reference button on every Forge screen with everything you need. You do not need to know regex before you start.
The archetype you chose does not gate any content. Every hunter runs the same exploits, because the attack is the attack. What it decides is which evidence you are allowed to catch it with.
The same Kerberoast looks like RC4 tickets on the wire to a network defender, like tooling on a host to an endpoint analyst, and like a service account with a five-year-old password to a PKI owner. Three rules, one attack, nobody wrong. Where your discipline has an angle on a lab, the Forge expects you to use it.
Where it doesn't — and that happens, because not every attack has a cryptographic angle or an endpoint angle — the Forge says so and lets you detect it however you like. Read what each archetype sees →
Every region is free, in full. Within a region, hunts unlock in order — each one assumes what the last one taught. Across regions there is no gate at all: play them in whatever order you like, though the level ranges are a fair guide to difficulty.
A region's boss only opens once every hunt and its matching forge in that region is done. Bosses run in two phases: break it, then contain it.
Without an account your hunter lives in this browser alone, in a signed cookie. It survives closing the tab. It does not survive clearing your cookies, and it does not follow you to your phone.
Linking an email on the Account page fixes both. There is no password — you get a sign-in link by email. Progress then merges rather than overwrites, so playing on a laptop and a phone can never lose a hunt you cleared on the other one.
No. Every Forge screen has a reference button covering everything the game asks for, and the failure feedback names the exact line you missed. Most players learn it here.
No. Every target is a simulation running inside the app. The vulnerabilities behave genuinely — real signature checks, a real dictionary attack, a real SQL evaluator — but there is no host on the other end. Nothing you type leaves the page.
Some steps are reconnaissance rather than the exploit itself. Scanning a host or listing accounts gives you what you need for the next command but is not the attack. Material drops on the step that actually breaks something.
Check whether it said not your lens — that means the rule works but is not your discipline's rule. Otherwise look at precision and recall: catching every attack while flagging normal traffic fails, and so does a rule so specific it misses variants.
Yes, any time, from the region page. Replaying does not award material twice, and it never removes progress.
The New Game button in the nav bar wipes your hunter. If you are signed in it clears your cloud save too, on every device. There is no undo.
Tell me about it — what you typed, what happened, and which hunt you were on is usually enough to find it.