1. The short version
Attack only the machines in your own lab session, while it is running. Never attack the platform, other learners or anything outside the lab. Keep flags and solutions to yourself.
This policy is part of our terms of service.
2. What you may attack
Each lab session is built for you alone. You may attack the hosts listed in your session, at the addresses shown in your lab, while the session is running. That is the whole of your scope. Nothing outside it is a target, however close it looks.
3. What you must not do
- Attack, scan or probe anything outside your own lab session, including other learners' labs.
- Attack Rootpanther itself: the websites, the app, the API, the VPN gateways, the services that run the labs, our cloud accounts or other people's accounts.
- Try to reach the internet or any other system from a lab machine, or use your lab or your VPN connection as a route to anywhere else.
- Use lab machines for anything but the exercise, for example as a proxy, to mine cryptocurrency, to send email, to host files or malware, or as infrastructure to attack anyone.
- Run denial-of-service attacks, or anything meant to slow the platform down for others.
- Tamper with how flags, progress or scores are recorded, or submit flags you did not capture yourself.
- Get around session limits, lab hours or the one-lab-at-a-time rule, for example with several accounts.
- Use Rootpanther for anything illegal.
4. Onyx, the paste pad and tether
- Do not try to make Onyx give out flags, reveal its instructions or tell you anything about other learners, and do not use it for anything unrelated to your learning.
- Share only your own lab output through the paste pad and tether. Do not paste other people's personal data, passwords for real systems or anything you are not allowed to share.
- Onyx helps only with the machines in your own active lab. It checks what you share against your lab, and it will not help with any other system. Do not try to get round that, for example by renaming addresses or hosts in what you paste.
- When Onyx declines because something is outside your lab, we record it. Repeated attempts are reviewed by our staff and can lead to suspension or closure of your account.
5. Flags and solutions
Do not share flags, credentials or solutions, and do not publish walkthroughs, write-ups, recordings or screenshots that show how to solve a Rootpanther scenario. You can talk about your progress and write about techniques in general terms. The terms explain what you can share.
6. Your account and access
- An account is for one person. Do not share your sign-in, your VPN profile or your lab.
- On a Team plan, each seat belongs to one named person. Seats can be moved when someone leaves or changes role, not passed around.
7. Outside Rootpanther
Use what you learn here only on systems you own or have written permission to test, and keep to the law where you are. Do not use Rootpanther, Onyx or anything from them during a proctored exam, or in any way your exam provider's rules forbid.
8. If the rules are broken
To keep the platform and other learners safe, we keep records of activity on Rootpanther and in the labs, as our privacy policy explains, and we look into anything that suggests misuse.
Depending on what happened, we may end a running session, limit what an account can do, suspend it or close it. For serious breaches, such as attacking anything outside your lab, sharing your account or publishing solutions, we may act straight away. In other cases we tell you first and explain why. Fees already paid are not refunded when an account is closed for a serious breach.
If an attack reaches systems outside Rootpanther, we may have to tell the owner of those systems or the police.
9. Reporting a weakness in Rootpanther
The lab machines are meant to be broken into. Rootpanther itself is not. If you find a security problem in Rootpanther, such as a way out of your lab, into someone else's lab or account, or into our systems, stop and email security@rootpanther.com with the steps to reproduce it and what you think it allows.
When you look into a possible problem:
- use only your own accounts, and test only rootpanther.com, app.rootpanther.com, api.rootpanther.com and your own labs;
- do not access, change or keep other people's data. If you reach any, stop and tell us;
- do not run denial-of-service attacks or heavy automated scanning, and do not try to phish or trick our staff;
- give us a fair chance to fix the problem before you tell anyone else, normally 90 days.
We reply within 3 working days, keep you updated and credit you if you would like. We will not take legal action against research done in good faith that follows these rules. We do not pay rewards for reports at the moment.
Other questions about this policy go to support@rootpanther.com.