From 4933f669f8338ca5e4c64cf0294818c5d15ed122 Mon Sep 17 00:00:00 2001 From: srdusr <99972264+srdusr@users.noreply.github.com> Date: Wed, 14 Jan 2026 22:23:00 +0200 Subject: Make every passage long enough to be worth timing, and credit all of them The dataset's median passage was 69 characters, about twelve words, which is over in twelve seconds at an ordinary speed. Some packs were worse: shell had a median of 46 and a shortest entry of 17. That is the reason packs felt small. It was not the number of entries, which was 15 to 37 per pack, but the length of each one. Multiplayer had already hit this and worked around it: load_race_texts filters to 120 characters or more. That filter left only 61 of 350 passages eligible, 38 of them from two packs, so races repeated constantly and four packs could never come up at all. Both halves are fixed. Content: 104 longer passages added across every pack. The command packs get whole pipelines rather than single flags, which is how the tools are actually used and what the explanations were always for. Prose packs get passages that run 150 to 320 characters. Selection: a floor of 120 characters. Prose packs draw from their long entries where a pack holds at least five, so no pack is reduced to the same few passages. The command packs chain consecutive entries into one drill, which is the natural shape for them, and the explanations are collected so each line is still described. Measured over 400 draws per pack, every category now runs a median of 146 to 218 characters with a shortest draw of 120. The race pool went from 61 of 350 to 130 of 454. Attribution: 24 passages had none and displayed nothing at all under the text. They now say Unknown, which is the honest answer for a fact written for the pack, and the pangram is credited as one. The results and typing screens both fall back to Unknown rather than rendering an empty line, and the pack name is shown beside the source. Multiplayer results, three fixes: - PB never appeared. A race has no mode of its own, so modeKey was undefined, so recordResult never ran. Races share one key, because the passage is whatever the server dealt and a per-passage best would never be beaten. - Play Again started a solo test. A race carries standings and a solo run does not, so the results screen can tell them apart and now queues for another race. The end screen's own cleanup leaves the old room first. - CONSISTENCY was the longest label on the screen and made the accuracy column wider than the WPM column opposite it. It reads CON. RaceText carries the pack name so the results can show it for a race the same way single player does. 24 Rust tests and 3 browser tests pass. --- data/packs/hacking.json | 58 ++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 57 insertions(+), 1 deletion(-) (limited to 'data/packs/hacking.json') diff --git a/data/packs/hacking.json b/data/packs/hacking.json index 9bc3b04..da02dc7 100644 --- a/data/packs/hacking.json +++ b/data/packs/hacking.json @@ -209,5 +209,61 @@ "attribution": "Defence", "explanation": "Parameterised queries send the values separately from the statement, so nothing the user types can become SQL.", "content": "cur.execute('SELECT * FROM users WHERE name = %s AND active = %s', (name, True))" + }, + { + "category": "hacking", + "content": "nmap -sV -sC -p- --min-rate 1000 -oA scan 10.0.0.0/24", + "attribution": "nmap", + "explanation": "-p- covers all 65535 ports rather than the usual thousand. -oA writes all three output formats at once, which matters because a scan is slow to repeat.", + "language": "shell" + }, + { + "category": "hacking", + "content": "gobuster dir -u https://target -w /usr/share/wordlists/dirb/common.txt -x php,txt -t 40", + "attribution": "gobuster", + "explanation": "-x appends extensions to every word, so one wordlist tests several file types. Authorised testing only: this is noisy and appears plainly in any access log.", + "language": "shell" + }, + { + "category": "hacking", + "content": "hashcat -m 1000 -a 0 hashes.txt rockyou.txt -r rules/best64.rule", + "attribution": "hashcat", + "explanation": "-m selects the hash type and -a 0 is a straight dictionary attack. A rule file mutates each candidate, which covers far more of the search space than the raw list.", + "language": "shell" + }, + { + "category": "hacking", + "content": "openssl s_client -connect example.com:443 -servername example.com /dev/null | openssl x509 -noout -text", + "attribution": "openssl", + "explanation": "-servername sends the SNI field, without which a shared host returns the wrong certificate. Redirecting standard input stops the client waiting for something to send.", + "language": "shell" + }, + { + "category": "hacking", + "content": "tcpdump -i eth0 -nn -s0 -w capture.pcap 'tcp port 80 and host 10.0.0.5'", + "attribution": "tcpdump", + "explanation": "-s0 captures whole packets rather than the first bytes. The quoted expression is a BPF filter, applied in the kernel, so unmatched traffic is never copied.", + "language": "shell" + }, + { + "category": "hacking", + "content": "ffuf -w params.txt -u 'https://target/api?FUZZ=1' -fs 1234 -mc all", + "attribution": "ffuf", + "explanation": "-fs hides responses of one exact size, which is how a uniform wall of not-found pages is removed. -mc all then keeps every remaining status code for inspection.", + "language": "shell" + }, + { + "category": "hacking", + "content": "john --wordlist=rockyou.txt --rules=Jumbo --format=sha512crypt shadow.txt", + "attribution": "john", + "explanation": "Rules generate variations of each word: capitalisation, appended digits, common substitutions. Naming the format skips John's guess, which is often wrong on mixed files.", + "language": "shell" + }, + { + "category": "hacking", + "content": "sqlmap -u 'https://target/item?id=1' --batch --level 3 --risk 2 --dbs", + "attribution": "sqlmap", + "explanation": "--batch answers prompts with the default so it runs unattended. Level and risk widen the payloads tried, at the cost of a much noisier and slower test.", + "language": "shell" } -] \ No newline at end of file +] -- cgit v1.2.3