Field manual · v9.5.1
How Ghostline works from first login to final closeout.
Ghostline is played as an operator loop: understand scope, read Broker Notes, inspect the Target Site, use the console and Tool Bench, build evidence, submit the casefile, earn the flag, grow your skills through courses and follow the active season story.
Create an operator, accept the rules and land on the Dashboard.
Complete SBX-001. It is the guided platform tour and first operator route.
Accept contracts, split Broker Notes from Target Site clues, use tools and record proof.
Submit evidence, generate the report, receive the flag, submit it and claim rewards.
Buy courses, complete lessons, equip gear, follow seasons and advance your operator.
Core loop
Contracts are the job. Seasons are the story around the job.
Every contract is a self-contained operation. Broker Notes explain the assignment, allowed scope, route context and proof requirements. The Target Site is the public company surface where you discover clues. The console and Tool Bench let you work the route. Evidence and Casefiles prove the work and unlock the payout. The active season sits above this loop and tells you which operations matter right now.
Sandbox
SBX-001 teaches the whole platform interactively.
The Sandbox is not only a short tutorial. It walks new players through the full current platform: Dashboard, Broker Notes, Target Site, passive recon, Operator Development, Market, Tool Bench, Skills Ref, active recon, research bundle, packet analysis, web testing, GhostMail, GhostBank, Evidence, Casefiles, Seasons, World Feed, Intel Feed, Desktop Mode and final contract unlock.
After completing SBX-001, a player should understand what each page is for, how it affects gameplay and what to do next when a real contract opens.
Operator Development
Skills, courses, field notes and equipped gear
Skills are no longer instant upgrades. Buying a skill topic grants access to a course. A course contains practical lessons, real-world examples, Ghostline use cases, checklists, field exercises and a final knowledge check. Your level only increases after all lessons are complete and the final check is passed.
Use credits in Operator Development or Market to unlock the course. This does not increase the skill yet.
Each lesson explains the real-world concept, examples and where it appears in Ghostline contracts.
Field exercises send you to Broker Notes, Target Sites, Tool Bench, Evidence or Casefiles.
Final checks use selectable answers and feedback. Passing increases the skill level.
Courses unlock field notes and support items. Gear and skills help tools, contracts and season ops feel connected.
Real-world value: courses cover recon, packet analysis, CVE triage, web testing, Active Directory, privilege escalation, credential access, evidence handling and reporting. These are useful in Ghostline and as cybersecurity fundamentals outside the game.
Market and gear
The Market contains usable items and course access. Some items help with evidence quality, packet captures, wordlists, research bundles, tool licenses, field notes or route support. Gear does not replace skill; it supports the workflow and gives your operator a reason to earn and spend credits.
Tool Bench and Skills Ref
Tool Bench is where the active tools live. UI tools open their own interfaces; console-native tools keep the command-line feel. Skills Ref is the quick reference library. Courses are deeper and progress-gated; Skills Ref is always there when you need a reminder.
Seasons
What the active season changes for players
The active season controls the episode chain, Season Ops board, daily/weekly objectives, rival chatter, featured contracts, reward progress and relevant World/Intel feed entries. Normal contracts remain the main work, but the season tells you why those jobs matter right now.
Foundation route: recon, CVE triage, Tool Bench, evidence and closeout.
Web/API route: target sites, DurpSuite, exposed panels, auth and application logic.
Identity route: AD, HoundDog, Respoonder, HashKat and GhostPack workflows.
Perimeter/cloud route: VPN, Exchange, cloud metadata and hybrid targets.
Expert route: multi-path operations, full-chain cases and high-tier rewards.
Season Ops
Season Ops are short daily and weekly tasks connected to the active season. They may ask you to run GhostMap, analyze a ShireWark capture, finish a course lesson, submit evidence, close a Beginner route or use a specific Tool Bench app. They reward credits, rep, XP, badges, field notes, gear, titles or season progress.
World Feed and Intel Feed
World Feed shows the moving story layer. Intel Feed gives operator-relevant hints, dispatches and chatter. When seasons, tools, courses or contracts change, these feeds should move with the platform so the world feels current.
True Realism Range
Contracts follow a penetration-testing progression: scope, passive context, service discovery, enumeration, public advisory correlation, research bundle staging, validation, evidence and reporting. Broker Notes and Target Sites are intentionally separate. Real CVE pages are used as references; all targets and actions remain inside the Ghostline range.
v9.5.1 interface coherence
Two interfaces, one workflow
Classic UI and Ghostline Desktop expose the same core workflow: accept a contract, read Broker Notes, inspect the Target Site, use Tool Bench, collect evidence, submit the casefile, then progress through Season Ops and Operator Development.
The Desktop keeps only essential shortcuts visible. Security tools live inside Tool Bench so the workspace stays clean. The Applications menu groups pages by category so players do not have to hunt through a long flat list.
Operator registration now requires passphrase confirmation and supports a brief reveal button so a new player can verify their entry without exposing credentials longer than necessary.
Growth and support
How Ghostline will earn without becoming pay-to-win
Ghostline keeps the core learning route playable. Monetization is staged around public-page sponsor slots, referrals, optional cosmetics, premium season reward tracks, deeper course bundles, team workspaces and certificates. Gameplay pages such as Console, Tool Bench, Contracts and Sandbox do not show ads by default.