New - Full Audit Contracts
(Full game only - not available in the demo.)
hexdump has started sending repeatable pen-test work. Once you're mid-campaign, a new contract type appears on the job board: Full Audit.
Each audit is a fresh procedurally-generated target - different server, different layout, different files. No two runs are the same. Difficulty escalates the more you complete: early jobs are lightweight, later ones have firewalls, IDS, and hardened accounts. Pay scales with it ($300 to $1200).
There's no endpoint. hexdump just keeps the work coming.
New - Daily and Weekly Challenges
(Full game only - not available in the demo.)
Two special audits appear alongside the base loop:
Daily Audit - a new target every day at midnight UTC. The same target for every player. Easier than the weekly, pays $450. Shows up with a pulsing [DAILY] tag in the job list.
Weekly Audit - a harder contract that resets Monday. Firewall, IDS, high-security accounts. $1000. [WEEKLY] tag. Requires mid-game tools to crack cleanly.
Because the seed is date-based, every player is hitting the same box on the same day. Good for comparing notes.
New - Workshop Integration
(Full game only - not available in the demo.)
Subscribed Workshop items now load into the game on boot.
Missions - Workshop missions appear in the job board. Missions that have been edited after publishing show an amber [MODIFIED] tag.
Scripts - delivered to /community/ on the drop box, organised into folders by author. SSH in, browse, and scp what you want to ~/scripts/.
New - publish command
(Full game only - not available in the demo.)
Publish any script from ~/scripts/ to the Steam Workshop without leaving the terminal. Type publish <scriptname>, enter a title and description at the prompts, and it goes up. Re-running the command on the same script submits an update to the existing item. Ctrl+C cancels.
New - SSH Key Auth
scp an id_rsa file from a target server into your ~/.ssh/ directory and subsequent SSH connections to that server authenticate automatically - no password prompt. The key hunt side mission now has a proper payoff.
New - Web Authentication
Some servers have protected directories. Previously these returned a hard 403. They now return a proper login prompt instead. This applies to any URL within the protected directory - browsing directly to a specific file prompts for credentials just the same.
Find credentials on the server - buried in config files, bash history, notes left by careless sysadmins - enter them at the prompt and the page loads. Previously authenticated accounts appear below the form as quick-login links.
brute_web() now specifically targets web sessions, separate from SSH access. Cracking a user via SSH does not grant web panel access, and vice versa. Two distinct attack paths. wget and curl also respect web sessions - authenticate via browse first and HTTP downloads to protected paths will work.
Authenticated pages show a logout link. Web sessions are not saved to disk - they clear on browser exit, server navigation, SSH disconnect, or game restart.
New - Per-Server Trace Persistence
Your trace history now persists per server. Connecting to a different box no longer clears it.
If you're at 150/300 seconds on a traced server and jump to another, the first server keeps recovering while you're away - 1 second per 3 seconds offline, same as the existing trace regen. Return quickly and you pick up close to where you left off.
Stay away long enough and the trace fully resets - the sysadmin gave up looking.
New - Audit Boards
boards.blackdoor.tools is now accessible in the demo. View community leaderboards, daily and weekly standings, and top players. The board syncs live when you visit. Submitting to the boards requires the full game.
New - Script Target (Network Panel)
Right-click any server in the Network panel to Set as script target. This pins the server for get_target() regardless of what you're connected to. Useful for scripts that run while moving between servers. The pinned host shows a [T] badge in the network list. Right-click again to unpin.
get_target() priority: pinned target -> current SSH connection -> active mission server. Also now stays valid mid-mission after disconnecting.
resolve_hostname(hostname) - new API function. Resolves a hostname to its IP via /etc/hosts. Returns the IP string or none.
Mission Updates
Ten retrieval side missions now require uploading the recovered file to the drop box (185.70.44.22:/drops/). Grabbing the file was the job; delivering it is how you get paid. Eight side missions that were missing hints now have them.
Bug Fixes
Home filesystem reverted on load - files deleted or edited between sessions were being restored to their original state on reload. Deleted files are now tracked and excluded from migration; the scripting API's home filesystem reference is now properly synced after a save load. Thanks marvelous
Encrypted files could be opened in the editor - cat and scp correctly blocked encrypted files but edit did not. The editor now refuses to open encrypted files. Thanks thePalindrome
shop buy gave no feedback from the terminal - using shop buy <id> directly in the terminal silently failed if you couldn't afford it, already owned it, or gave an unknown ID. It now prints the reason. Thanks ItsGime
Loose Thread softlock on abandon - nuking the mission server files then abandoning the mission left the save in a broken state if you quit before re-accepting. Abandoning now saves immediately so the server resets correctly on reload. Thanks marvelous
grep hint showed wrong argument order - the "file too large, use grep" tip in cat had the arguments backwards. Thanks marvelous
Trace cancelled by home box / drop server - connecting to a non-tracing server while being traced from another cleared the trace entirely. Fixed. Thanks VinceKully
Scan objective softlocked on out-of-order completion - downloading a mission file before running probe left the scan objective permanently unsatisfied. The check is now order-independent. Thanks marvelous
Trace countdown was one second ahead of the taskbar - the overlay and taskbar used different rounding. Both now consistent. Thanks VinceKully
Admin panel returned a hard 403 with no way in - protected directories now show a login prompt. Find or crack the credentials and browse to /admin.
Plain text files didn't render line breaks in the browser - log files, config files, and any non-HTML content viewed via browse now display with correct formatting.
Password field showed placeholder after entry - entering a password in a web login form now shows dots instead of leaving [Password] in place.
wget and curl didn't complete download objectives - downloading a file over HTTP didn't register as a mission objective. Fixed.
download() API didn't save the file - the scripting API download(conn, path) returned success and triggered the mission objective but never wrote the file to ~/downloads/. Fixed. Thanks LordLorte
upload() API didn't send the file - upload(conn, local, remote) returned true without writing anything to the remote server. Fixed.
Mission 1 softlock when completing via scripts - using cracker.bd to connect and crack without ever typing ssh in the terminal left the connect objective permanently unsatisfied. The connect objective now accepts any active connection, not just terminal SSH. Thanks LordLorte
get_target() returned none mid-mission after disconnecting - it now falls back to the active mission's server when not SSH-connected. Thanks Delta
list_files() help text missing {path} - the return value description omitted path even though it's included. Thanks marvelous
delete_file() left ghost entries in directory listings - deleting a file via the scripting API removed it from the filesystem but not from its parent directory's children list, so list_files() would still report it after deletion. The terminal rm command was unaffected. Thanks marvelous
scp now works like real scp - uses user@host:/path format and works from the local terminal without an active SSH session. Requires stored credentials for the host (SSH in once to establish them). upload remains the shorthand for when you're already connected.
- Static