-
Notifications
You must be signed in to change notification settings - Fork 3
Assessment Mode
Assessment Mode lets you run time-boxed pentest exercises for recruitment, internal training, or client demonstrations — with your company's branding, isolated lab containers per candidate, flag tracking, and a markdown report submission workflow.
- Create an assessment — pick 3-4 labs, set a duration (default 48h), add candidate-facing instructions, optionally set a company name and logo
- Generate invite links — one per candidate email; links are single-use tokens
- Candidate registers — clicks the link, creates an account, lands in a branded workspace
- Start the clock — candidate clicks "Start Assessment"; their personal lab containers spin up and the countdown begins
- Candidate works — submits flags through the platform, writes a pentest report in the markdown editor
- Admin tracks progress — view per-candidate flag solves, report submission status, and time remaining from the Assessments admin panel
Assessment Mode requires the platform to be running.
Go to Admin → Settings → Branding and set a company name and logo URL. These appear on invite pages and candidate workspaces. You can also override branding per assessment.
Go to Admin → Assessments and click New Assessment.
| Field | Description |
|---|---|
| Name | Internal name for the assessment round |
| Duration | Hours each candidate has once they start (default: 48) |
| Labs | Select which world labs to deploy for candidates |
| Display names | Override lab names shown to candidates (e.g. "SubVerse" → "WebSec Universe") |
| Company name | Overrides platform-level branding for this assessment |
| Company logo URL | Overrides platform-level logo |
| Candidate instructions | Markdown shown on the invite page and workspace — explain goals, flag format, report expectations |
Open the assessment and use Add Candidate to generate invite links. Enter the candidate's email and optionally their name.
Copy the invite URL and send it. The link is valid until the assessment duration expires.
The Assessments detail page shows each candidate's:
- Status (pending / accepted / active / expired)
- Started and expires timestamps
- Number of lab containers deployed
- Flags solved (expandable per-candidate list)
- Report submitted (yes / no)
Revoke a candidate's invite at any time to cut off access.
Candidates see a branded page with the company logo, assessment name, and your instructions. They register a username and password (no existing account needed), then land in their personal workspace.
The workspace shows:
- Countdown timer
- Lab cards — display name, container status, and access credentials once running
- Pentest report editor — markdown, auto-saved on submit, updatable until expiry
Once the timer hits zero, labs are shut down and the report becomes read-only.
- Each candidate gets their own isolated Docker containers — they cannot reach other candidates' labs
- Lab containers respect the same Docker network isolation as regular OctoRig labs
- Candidate accounts are flagged
is_candidateand excluded from the main scoreboard - Lab names shown to candidates use the display name overrides you set — internal slugs are never exposed
- The assessment timer starts when the candidate clicks "Start Assessment", not when they accept the invite