Leaderboard

> cat leaderboard.log

puzzle #001solvers 128median 00:11:42preview data
Fastest solves for today's puzzle
#playertimehintsstreak
01null_byte00:04:12none14d
02rootkit_rae00:05:18none9d
03lopes_h4x00:06:46●3d
04your_handleyou00:07:51none5d
05sqlsam00:08:59●21d
06xss_marks_spot00:11:42●●1d
07packet_pal00:14:05●●●2d

Fastest time wins. Your clock starts when you open the puzzle and stops when you trigger the win. Boards reset at 12:00 AM Arizona time. Sign in with Google to get on the board and add friends.

How it works

  1. 01 // drop

    A new target drops at midnight

    Every night at 12:00 AM Arizona time, an AI builds a brand-new website (a bakery, a gym portal, a school login) and plants exactly one security flaw in it. Every puzzle is tested automatically and approved by our team before it goes live.

  2. 02 // recon

    Explore it in the sandbox

    Hit Play and the target opens right inside the page, walled off on its own domain. Click around, read the source, open dev tools, edit URLs and poke at forms. Nothing you do can reach real sites or other players.

  3. 03 // exploit

    Find the one bug

    Somewhere in the site is a single vulnerability: an exposed key, a login you can trick, a search box that leaks the database. Use it to reach the win condition, like breaking into the admin panel. Stuck? Grab a hint.

  4. 04 // flex

    Win, climb, come back tomorrow

    Trigger the win and the confetti flies. There’s no answer to type in. Your time counts from the moment you opened the puzzle and goes on today’s leaderboard and your friends’ board. Solve every day to grow your streak.

Safe and legal by design

Isolated

Targets run on a separate domain inside a sandbox, so they can’t touch your accounts or ours.

Legal

You only ever attack a throwaway site we built for you. Never use these tricks on sites you don’t own.

Zero setup

All you need is a browser. No installs, no virtual machines, no special tools.

Want the fine print? Read the rules of engagement.

Rules

> cat rules_of_engagement.txt

Hackle is a safe place to practice hacking, and it stays that way because everyone plays inside the lines. Hack the target in our sandbox. Never touch anything else.

in scope Go for it

  • Today’s target, inside the sandbox frame on the play page
  • Viewing source, dev tools, editing URLs, cookies and local storage on the target
  • Messing with the target’s forms, fake APIs and fake database
  • Breaking the target as hard as you like. Hit “reset target” for a fresh copy

out of scope Hands off

  • hackle.org itself: accounts, sign-in, the leaderboard, our database
  • Other players, their sessions or their scores
  • Any real website, server or network, ever
  • Denial-of-service, scanners that flood requests, or automated brute forcing
  1. 01

    One puzzle a day

    A new target goes live at 12:00 AM Arizona time. Everyone gets the same one, and it stays up until the next drop.

  2. 02

    Your clock is the server’s clock

    Your time starts when you first open the puzzle and stops the moment you trigger the win. Closing the tab doesn’t pause it.

  3. 03

    Win by doing, not typing

    There’s no answer box. Exploit the flaw to reach the win condition and the confetti tells you that you got it.

  4. 04

    Hints are on the record

    Each puzzle has hints if you’re stuck. Using one is fine, and it shows next to your time on the leaderboard.

  5. 05

    One account, no spoilers

    One Google account per person. Please don’t post solutions until the day is over. The write-up unlocks after midnight.

Found a real bug in hackle.org?

That’s outside the game, so please don’t poke further. Email us and we’ll fix it and say thanks. Reporting in good faith will never get you banned.

report a bug

FAQ

> man hackle

Is this actually legal?
Yes, as long as you stay in scope. Every target is a throwaway site we built for you to attack, running on its own domain inside a sandbox. Using the same tricks on a site you don’t own is illegal. See the rules of engagement.
Do I need to know how to hack already?
No. Hackle is built for students. If you can open your browser’s dev tools, you can start. Hints walk you toward the bug, and every puzzle comes with a write-up the next day so you learn the trick even if you don’t solve it.
What do I need to play?
A desktop or laptop browser (Chrome, Firefox, Edge or Safari) and a Google account to save your time. No installs, no virtual machines. Phones work for looking around, but dev tools make a computer much easier.
When does the new puzzle drop?
Every night at 12:00 AM Arizona time (MST, and Arizona doesn’t do daylight saving, so it never moves).
How do I know I won?
There’s no answer to type in. When you exploit the bug and reach the win condition, like getting into the admin panel, the target tells hackle.org and the confetti flies. Your time is locked in right then.
What kinds of bugs show up?
Classic web flaws: exposed API keys, hidden admin pages, logins that trust the browser, search boxes vulnerable to SQL injection, cross-site scripting and more. Each day has exactly one.
What happens if I miss a day?
Your streak resets to zero, but your best streak is saved. You can still read the write-up for any puzzle you missed.
Who made the puzzles?
An AI writes each target a few days ahead, our automated checks make sure the bug works, and a team member approves it before it goes live.
Who’s behind Hackle?
Four Grand Canyon University seniors building it as our ITT-490 capstone. Questions or ideas? Email hackleproject@gmail.com.