Guided introduction
Start with a personal, seven-stage First Mission. Learn terminal context, files, help, discovery, SSH, log interpretation, and evidence submission. Pause, resume, or replay as needed.
MULTIPLAYER CYBERSECURITY LEARNING
RootBound
A persistent world for hands-on cybersecurity learning
RootBound is a browser-based, multiplayer cybersecurity learning environment that combines terminal exploration, incident investigation, networking labs, and Windows administration inside a persistent game world.
IN-GAME COMMAND EXAMPLE
$ worlds01Main GridLinux & SSH
02CrosscurrentNetworking
03NightjarInvestigation
04KeystoneWindows
Illustrative world directory · explore nine world groups
9world groups
167modeled machines in the authored baseline
7stages in the separate First Mission
Machines include objectives, gateways, transit infrastructure, and open-ended systems—not 167 separate assessed lessons.
A PATH INTO PRACTICE
Start with guidance.
Grow through experience.
Work through problems using commands, evidence, configuration changes, and verification. Build technical confidence while earning progress and recognition.
Technical practice
Inspect systems, diagnose faults, and work through supported Linux, networking, Windows, and domain-administration exercises.
Verified outcomes
Submit evidence, repair a configuration, or correlate findings across machines. Supported labs report PASS / NOT YET for individual requirements.
Open-ended play
Return to a persistent world to explore, collaborate, compete, and continue building your operator’s progress.
FIND YOUR NEXT CHALLENGE
Nine worlds.
Different ways to think.
Showing all 9 world groups
30 machines
Main Grid
Linux exploration, files, permissions, processes, logs, SSH, discovery, and evidence capture.
70 machines, including transit infrastructure
Cyber Null
Shared exploration, persistent changes, resource gathering, hideouts, crews, and competitive attack-and-defense mechanics.
10 machines · 4 correlated findings
Project Nightjar
Reconstruct initial access, lateral movement, collection and staging, and the final incident conclusion.
8 machines · 4 correlated findings
Operation Glasswire
Investigate inert samples, processes, services, persistence, containment, and related evidence.
7 machines · 3 correlated findings
Operation Tideglass
Analyze packets, reconstruct messages, follow exposed credentials, and investigate transfer evidence. Export supported captures for Wireshark analysis.
15 hosts · 12 guided exercises
Operation Crosscurrent
Diagnose and repair IPv4 addressing, routes, DNS, firewall policy, return paths, NAT, and forward, reverse, and nested SSH tunnels.
11 hosts · 9 guided exercises
Operation Threadline
Explore TCP and UDP, framing, partial reads and writes, retries, delayed delivery, compression, encoding, integrity, and tunnel teardown.
8 machines · 5 support cases and a tutorial
Operation Keystone
Practice Windows foundations, accounts, services, processes, networking, printing, and read-only SMB permissions.
8 machines · 6 cases and a tutorial
Operation Crown
Work through domain discovery, joining, trust repair, least-privilege accounts, shares, and scoped computer policy.
No worlds match this search. Try another skill or choose All worlds.
The in-game directory respects progression checkpoints and scenario entry requirements.
SKILLS THROUGH SCENARIOS
Practice the work.
Understand the result.
Linux and terminal fluency
Navigate and edit virtual files, search evidence, inspect processes and services, reason about permissions and ACLs, and connect through supported SSH workflows. A built-in Nano editor keeps permitted text editing in the terminal.
Networking and traffic analysis
Investigate routes, DNS, NAT, firewalls, and tunnels. Tideglass and supported multiplayer TCP workflows can export real PCAP files for Wireshark. Crosscurrent uses deterministic diagnostic traces with different capabilities.
Incident investigation
Follow clues across machines, preserve evidence, and submit structured case findings. Nightjar, Glasswire, and Tideglass reward supported conclusions built from correlated evidence.
Windows administration
Use a simulated RDP-style desktop with File Explorer, Notepad, Services, Event Viewer, accounts, networking, CMD, and PowerShell. Supported GUI actions and commands work on the same personal machine state.
Domain troubleshooting
Practice domain discovery, joining, trust repair, local versus domain credentials, and least-privilege access in Crown’s scoped directory model.
Transport and transfer reasoning
Use harmless synthetic content to examine framing, sequencing, short reads and writes, delays, compression, encoding, and SHA-256 verification in Threadline.
THE INVESTIGATION LOOP
Follow the evidence.
Verify the outcome.
Some objectives ask you to recover a token or hash. Others require a working configuration or a structured finding supported by evidence from several machines.
The same investigation habits carry from short practice sessions into longer cases.
Orient
Establish your host, identity, and working directory.
pwd · hostname · idInspect
Examine files, processes, services, permissions, and network configuration.
ls -la · ps aux · ss -lntpInvestigate
Find relevant evidence, follow clues, and preserve exact details in your notes.
find · grep · journalctlAct and verify
Make a scoped change or reconstruct the incident. Verify the result and submit supported evidence.
capture · case status
LEARNING AND CONTINUITY
Support that stays
with the learner.
Guidance when you need it
Use the Field Guide, complete in-game manual, searchable help, command references, scenario briefings, and supported free coaching. Some ordinary objectives offer hints that reduce the available award.
A workspace that stays with you
Open up to eight independent terminal tabs, with their own host, directory, history, and SSH return path. Pop terminals into separate windows, preserve private notes, and return to saved context.
Evidence of your practice
My Learning lets you filter your current-realm evidence by world, search NICE components, and inspect contributing objectives. Introduced, practiced, and assessed are exercise evidence levels—not certifications or proficiency ratings.
A WORLD TO RETURN TO
Collaborate.
Compete. Keep exploring.
See nearby operators, use permitted messages and shared spaces, form crews, and explore together. Cyber Null adds simulated resources, equipment, hideouts, upgrades, and staged attacker-and-defender activity. Points track lifetime progress; game currency and resources create strategic choices and have no real monetary value.
Sharing and social features follow the permissions and privacy settings for each operator.
FOR EDUCATORS AND FACILITATORS
Give your group
a focused starting point.
Realms for your group
Separate contexts for cohorts, conversations, progress, and shared-world activity provide a foundation for class sections, workshops, clubs, and pilots.
Progress and support tools
Inspect operator progress, activity, captures, hints, rejected attempts, and exercise friction. Use walkthroughs, support tickets, recovery, moderation, and announcements to support learners.
Scoped assistance
Administrators can request temporary, opt-in, read-only terminal observation. That view excludes PIN entry, unsent input, private notes, and chat.
Custom content
Supported tools can draft and publish Cyber Null event hosts and stage changes to objective text, hints, and prerequisites. Custom content needs separate review before receiving NICE alignment.
BEFORE YOU ENTER
A few useful details.
Do I need to know Linux before starting?
First Mission provides a personal introduction to terminal context, files, help, discovery, SSH, logs, and evidence. Choose full instruction, a quick orientation, or skip it. You can pause, resume, and replay later.
Is RootBound a virtual-machine cyber range?
RootBound is a browser-based training simulation with documented commands and modeled systems. It is not a complete Linux installation or VM cyber range. Its Windows and domain environments are scoped educational models rather than full Windows or Active Directory implementations.
What does the 167-machine baseline include?
The authored baseline contains 167 machines across nine world groups, including objectives, investigation hosts, gateways, transit infrastructure, and open-ended systems. That does not mean 167 separately assessed lessons. First Mission is a separate onboarding experience.
Does learning evidence provide certification?
No. NICE alignment describes RootBound exercises and their introduced, practiced, or assessed evidence levels. Historical completion, hints, resets, or administrator-granted progress do not establish independent mastery, NIST endorsement, or certification.
Can RootBound support a class or club?
Realms, personal exercises, facilitator tools, and persistent progress support bounded instructional pilots and group activities. Classroom concurrency, accessibility conformance, institutional security requirements, and learning outcomes need evaluation for the intended deployment. The admin tools are not a complete LMS or gradebook, and no institutional SSO or automated grade-passback integration is claimed.
What should younger learners know?
RootBound is for learners aged 13 and older. Teen training requires parent acknowledgment and starts with private training and social sharing disabled. Verified-parent permissions and operational support are separate requirements; confirm the parent workflow before a group deployment.
RootBound / BLACK ARK LABS
Bring technical practice into a world learners can return to.
Explore RootBound, or talk with Black Ark Labs about a focused instructional pilot.