Field manual · v15.0.0
How Ghostline works from first login to final closeout.
Ghostline is played as an operator loop: understand scope, study the relevant material, prepare a route-specific loadout, read Broker Notes, inspect the Target Site, use the console and Tool Bench, preserve evidence, submit the casefile and follow the active season story.
Create an operator, review the public legal pages, accept the current terms and land on the Dashboard.
Complete SBX-001. It is the guided platform tour and first operator route.
Accept contracts, split Broker Notes from Target Site clues, use tools and record proof.
Submit evidence, generate the report, receive the flag, submit it and claim rewards.
Master Academy courses, refine four-slot loadouts, follow seasons and advance your operator.
Core loop
Contracts are the job. Seasons are the story around the job.
Every contract is a self-contained operation. Broker Notes explain the assignment, allowed scope, route context and proof requirements. The Target Site is the public company surface where you discover clues. The console and Tool Bench let you work the route. Evidence and Casefiles prove the work and unlock the payout. The active season sits above this loop and tells you which operations matter right now.
Sandbox
SBX-001 teaches the whole platform interactively.
The Sandbox is not only a short tutorial. It walks new players through the full current platform: Dashboard, Broker Notes, Target Site, passive recon, Operator Development, Market, Tool Bench, Skills Ref, active recon, research bundle, packet analysis, web testing, GhostMail, GhostBank, Evidence, Casefiles, Seasons, World Feed, Intel Feed, Desktop Mode and final contract unlock.
After completing SBX-001, a player should understand what each page is for, how it affects gameplay and what to do next when a real contract opens.
Applied Skills Academy
Study, verify mastery and apply the knowledge
The Academy contains 18 practical courses across reconnaissance, network validation, packet analysis, web testing, vulnerability research, identity systems, credential auditing, evidence handling, reporting and tool selection. Courses include objectives, prerequisites, expected duration, official references, common mistakes, defender visibility and contained field exercises.
Use credits in Operator Development or Market to unlock the course. This does not increase the skill yet.
Each lesson explains the concept and requires a server-checked answer before completion.
Field exercises send you to Broker Notes, Target Sites, Tool Bench, Evidence or Casefiles.
Score at least 85% on the final assessment. A completed course awards its linked skill once.
Bring the method into Tool Bench, contracts, evidence review and casefile closeout.
Real-world value: the material teaches transferable cybersecurity reasoning and links to primary sources from NIST, OWASP, MITRE, Microsoft, CISA, Nmap and Wireshark. Exercises remain limited to authorized work and Ghostline-owned scenario systems.
Career tracks and portfolio credentials
Course mastery alone is not enough
Career tracks connect Academy learning to completed operations. Each track requires every listed course, a minimum number of closed operations and at least one completion at the required difficulty. This prevents a portfolio record from being issued through purchases or quizzes alone.
When eligible, the operator can issue a server-owned credential from Career Tracks. The record starts private. Publishing creates a verifiable portfolio view containing only the operator handle, track, competencies, course mastery scores, operation totals, issue release and integrity digest. Email addresses, account IDs, answers, internal evidence and target data are not included.
Operators can disable public verification at any time. Administrators can revoke a record with an audited reason if its integrity or eligibility is later invalidated. Ghostline credentials confirm in-platform achievement; they are not third-party accreditation or professional licensure.
Market and operational loadouts
Owned equipment is prepared in four exclusive slots: Field Kit, Reference Desk, Dataset Pack and Tool License. Relevant gear can alter preparation time, command noise, positive heat, evidence quality, effective skills and limited contract rewards. The server verifies ownership and calculates every effect.
Tool Bench and Skills Ref
Tool Bench is where active tools live. UI tools open their own interfaces; console-native tools keep the command-line feel. Skills Ref is the quick reference library. Academy courses are deeper and mastery-gated; Skills Ref remains available as an operational reminder.
Seasons
What the active season changes for players
The active season controls the episode chain, Season Ops board, daily/weekly objectives, rival chatter, featured contracts, reward progress and relevant World/Intel feed entries. Normal contracts remain the main work, but the season tells you why those jobs matter right now.
Foundation route: recon, CVE triage, Tool Bench, evidence and closeout.
Web/API route: target sites, DurpSuite, exposed panels, auth and application logic.
Identity route: AD, HoundDog, Respoonder, HashKat and GhostPack workflows.
Perimeter/cloud route: VPN, Exchange, cloud metadata and hybrid targets.
Expert route: multi-path operations, full-chain cases and high-tier rewards.
Season Ops
Season Ops are short daily and weekly tasks connected to the active season. They may ask you to run GhostMap, analyze a ShireWark capture, finish a course lesson, submit evidence, close a Beginner route or use a specific Tool Bench app. They reward credits, rep, XP, badges, field notes, gear, titles or season progress.
World Feed and Intel Feed
World Feed shows the moving story layer. Intel Feed gives operator-relevant hints, dispatches and chatter. When seasons, tools, courses or contracts change, these feeds should move with the platform so the world feels current.
True Realism Range
Contracts follow a penetration-testing progression: scope, passive context, service discovery, enumeration, public advisory correlation, research bundle staging, validation, evidence and reporting. Broker Notes and Target Sites are intentionally separate. Real CVE pages are used as references; all targets and actions remain inside the Ghostline range.
v15.0.0 interface coherence
Two interfaces, one workflow
Classic UI and Ghostline Desktop expose the same core workflow: master Academy material, launch each configured practical, prepare a loadout, accept a contract, read Broker Notes, inspect the Target Site, use Tool Bench, collect evidence, submit the casefile and progress through Season Ops.
Classic practical links open in a separate browser tab. Desktop practical links open as managed in-game windows. Both call the same server APIs and record the same course/tool state.
The two interfaces are maintained separately, but they do not own separate gameplay rules. Skills, equipment effects, contracts, operation receipts, heat, evidence, rewards and progression are calculated by the same server APIs.
Growth and support
How Ghostline earns without becoming pay-to-win
Ghostline keeps the core learning route, configured practicals and verified career credentials playable. Optional products focus on cosmetics, season presentation, team administration and credential presentation extras. When enabled, PayFast-hosted checkout uses server prices and verified entitlement fulfillment. Gameplay pages such as Console, Tool Bench, Contracts and Sandbox do not show ads by default.
Legal and consent controls
Public pages now explain the rules before players register
Terms, Privacy, Cookie Policy, Data Rights, Billing and Contact pages are linked from the footer. Necessary cookies keep login, CSRF, checkout integrity, consent storage and abuse prevention working. Optional public-page advertising is controlled by consent, and AdSense is not loaded by Ghostline until advertising consent exists.