Terms of participation

Break In If You Can is a practice range: you attack deliberately vulnerable targets that it runs for you. By choosing a nickname or signing in with GitHub you agree to these terms.

You can play with a nickname, without email or password. Progress is tied to your browser cookie unless GitHub is linked. Link GitHub later to resume across devices; existing accounts are never merged. AWS WAF uses a silent JavaScript browser challenge on joining and lab starts. Each address may create three nickname accounts per hour and run one lab at a time.

What is in scope

• Only the challenge targets this platform provisions for you, reached through the target links it gives you.
• Everything else is out of scope: this site, its API and gateway, the hosts and cloud account behind them, other participants and their instances, and any third party.
• No denial-of-service, flooding, or resource exhaustion against anything, targets included. Requests are rate-limited and targets run with capped resources.

Your conduct

• Flags are personal. Do not share flags; sharing can be detected and may lead to score removal.
• Do not put real personal data or real secrets, yours or anyone else’s, into targets, terminals, or submissions.

Prize

The key to a real Ethereum wallet containing 0.5 ETH is hidden on the PHP box. The first person to find it may take the entire balance.

Funds are outside the operator’s control once moved. There is no site claim, manual payment, or operator eligibility, sanctions, or tax check before transfer. Participation eligibility and prohibited conduct still apply. Submitting a pivot-php flag records your progress; it does not award the wallet.

Public wallet: 0x11f316829363CCD477B9c5122ed86bEcB31E2c77 · View balance and transactions on Etherscan.

Not marked as taken by the operator. Check Etherscan for the balance. This status is updated manually and may be cached for up to 90 seconds; it is not a live balance.

• Participation eligibility: you must be 18 or older. Participation is void where prohibited by law. You may not participate if you, or the country or region where you live, are under United States sanctions (for example, on the lists of the U.S. Treasury’s Office of Foreign Assets Control, OFAC). The operator, the owners, and members of their households cannot win. Suspended or deleted accounts cannot participate.
• Prohibited conduct: breaking these terms, attacking the platform or anything else out of scope, sharing or receiving flags, using more than one account, or colluding with others remains prohibited.
• No claim or payout: possession of the key lets its finder move the wallet’s funds directly on Ethereum mainnet. The operator does not receive or approve a site claim, check a finder’s eligibility, sanctions status or tax information before transfer, or send a separate prize payment. Nobody will ever ask for your private key or recovery phrase; never send them.
• Taxes: any tax or legal obligations arising from taking the funds are the finder’s responsibility.
• Changes: the operator may pause the challenge or move funds to protect a suspected leaked key, or change the offer for legal reasons. Once a finder moves the funds, they are outside the operator’s control; there is no replacement payment.

Points and scores have no monetary value and cannot be exchanged.

Enforcement and changes

• The operator can pause the platform, stop targets, remove scores, or suspend accounts that break these terms. Report abuse to elenchist.dev+abuse@gmail.com.
• The service is provided as is, may change or stop at any time, and these terms may change; the date below shows the current version.

Reporting security issues

If you find a weakness in the platform itself rather than in a target, stop, do not use it, and report it by email to elenchist.dev+security@gmail.com.