operator field guide
Rules & Scoring
You submit data, not code. Every obstacle is a real-world scraping problem — no trivia, no puzzles. Extract the data the way you would from a hostile production site. All data is synthetic; targets are authorized.
01
Register your team (simple)
POST /api/register with { teamName } → your team token. Send it as Authorization: Bearer <token> to the targets and the submit endpoint (download it as .txt on the register page). The register → verify-email → sign-in account wall is part of Site 01 (OmniCorp), not platform friction — solve the signup CAPTCHA, read the code in any burner inbox, then sign in.02
Breach each target
Seven targets, escalating. Each forces real techniques — session/cookie management, headless-stealth & fingerprint spoofing, proxy/VPN for geo, OCR, hidden/background APIs (
curl_cffi), audio STT, humanized behavior, and polite concurrency with backoff. Origins are throttled and some are deliberately slow.03
Submit your data
POST /api/submit/<challenge>
Authorization: Bearer <token>
Content-Type: application/json
{ "scrapeToken": "<per-team token from a detail page>",
"data": { "<records>": [ { ...scraped fields, incl. OCR'd & hidden-API fields } ] } }| # | target | submit / data key | obstacles |
|---|---|---|---|
| 01 | OmniCorp Careers | /megacorp · jobs[] | signup CAPTCHA (OCR) · register → verify-email (burner) → signin · headless nudge · OCR salary/email · hidden JSON API · geo-locked region · rate-limit/backoff |
| 02 | Abyssal Salvage | /salvage · wrecks[] | slow throttled origin (backoff) · muddy sonar-log OCR (coords) · hover-to-load XHR-only manifests |
| 03 | The Syndicate | /syndicate · members[] | behavioral mouse-gate · scanned dossier OCR · audio CAPTCHA (STT) for the inner circle |
| 04 | Eye in the Sky | /casino · bets[] | partner-hotel cookie chain · en-US + America/Los_Angeles fingerprint · behavioral floor gate · watermarked OCR · US-only geo |
| 05 | Specimen Registry | /specimen · specimens[] | multi-round vision-grid CAPTCHA (CLIP/SigLIP) sealing the dossier API · fingerprint gate · messy-chart OCR · deeply-nested hidden API · per-IP budget → rotate proxies |
| 06 | //NULLBAZAAR | /asic · lots[] | geo-block (proxy out) · audio CAPTCHA · curl_cffi background-JSON · per-record arithmetic captcha · multi-document OCR · per-IP budget → rotate proxies · don't hammer |
| 07 | Statehouse Registry | /statehouse · entities[] | US-only WAF (proxy in) · arithmetic OCR captcha (+ − × ÷) · ASP.NET __VIEWSTATE/__doPostBack pagination · registered-agent email OCR · honeypot field |
Submit as often as you like — only your best run counts.
04
How you're scored
- ■Completeness — primary
records & fields matched vs hidden ground truth; OCR/text fields use fuzzy matching so minor errors still earn partial credit. - ■Speed — tiebreak
time from first authenticated request to best submission. - ■Stealth — modifier
request-timing humanization. Hammering or perfectly-periodic traffic grades poorly, like a real bot would be caught.
⚠ fragile origins
Every target rate-limits per (token, IP). Too much concurrency from one identity trips an escalating circuit breaker (429 → 503). Distribute workers across proxies/VMs and back off — exactly what you'd do against a real target.