Rooted
Forge profile
Credential not issuedProfessional required
Credential not issued

Professional profile required

This card is only issued once the hacker switches to Professional and adds a public name. Hobby profiles stay anonymous on purpose.

Annex — how this was earned

44 entries. Nothing scores without one.

17,530 total
Credentials3,150

4 entries

Reports12,400

20 entries

Write-ups1,380

8 entries

Quizzes and labs600

12 entriescapped at 600

44 ledger entries back these totals. The full derivation is visible to the holder and to Rooted review.

Where your proof lands

Derived from what each verified ledger entry actually covers. You have nothing in active directory, tooling & code.

  • Web & appsec13,270
    Evidence
    Confirmed critical in the tenant switcher
    Confirmed high in the OAuth callback
    Second-order SQL injection in a reporting job
    Confirmed low in the OAuth callback
    Confirmed critical in the GraphQL introspection surface
    Confirmed medium in the GraphQL introspection surface
    Confirmed critical in the password reset flow
    Confirmed medium in the tenant switcher
    Confirmed high in the GraphQL introspection surface
    Getting SSRF out of a PDF renderer
    Confirmed high in the file upload handler
    Chaining an IDOR into a full account takeover
    Confirmed medium in the file upload handler
    Confirmed high in the invoice export
    Confirmed low in the invoice export
    Confirmed critical in the invoice export
    Confirmed high in the password reset flow
    Confirmed low in the file upload handler
    Confirmed medium in the invoice export
    Confirmed medium in the OAuth callback
  • Offensive ops600
    Evidence
    Daily questions
  • Foundations600
    Evidence
    Daily questions
  • Vuln research510
    Evidence
    Second-order SQL injection in a reporting job
  • Active Directoryno proof yet
  • Tooling & codeno proof yet

The road to Ghost

4,470 pts short

Everything below is priced. Pick the cheapest one and the gap closes.

  1. Connect Hack The Box

    Rank, owns and global standing pulled from your profile.

    +300
    points
    7% of the gap
  2. Claim a CVE

    Any published advisory with your name on the credit line.

    +260
    points
    6% of the gap
  3. Connect TryHackMe

    Points and completed rooms.

    +180
    points
    4% of the gap
  4. Connect GitHub

    Public tooling, exploits and the code you shipped.

    +160
    points
    4% of the gap
  5. Review another hacker's work

    Accepted peer review adds small points and proves you can judge other hackers' reasoning.

    +15
    points
    0% of the gap
  6. Land another confirmed report

    20 confirmed reports already. Reports have no ceiling; confirmed impact keeps moving the rank.

    +360
    points
    8% of the gap

Not one figure above was typed in by 0xkoi.

Read how points are earned
Get your credential
Rank requirements beyond points
  • Rank 4+ - One verified credential or one confirmed report
  • Rank 7+ - One confirmed report or one credited CVE
  • Rank 9+ - A credited CVE at CVSS 9.0+, or three critical confirmed reports