Targets and no-shoots
Everything downrange is trying to get into your network, except the two things that are trying to keep it running. Seven kinds of target walk the lane. Five are worth shooting, one of those five is a jackpot, and two will cost you for pulling the trigger at all.
What comes down the lane
Red means shoot it. Green means it is safe to leave alone. Amber and black means you are about to destroy something of your own.
Malware bloom
Spiked pathogen blob, dark maroon with red glowing spike tips
Path: Darts across the lane
Phishing envelope
Threat-red envelope with a red exclamation seal
Path: Arcs in a slow hump
CVE badge
Slate shield plate with a glowing amber rim and CVE lettering
Path: Pops up, holds, retracts
Botnet drone
Gray quad-rotor with a red under-glow threat light
Path: Swarms toward the firewall wall
Zero-day jackpot
Faceted golden gem with an inner glow and a four-point sparkle
Path: Darts, fast (4.5 m/s)
Legitimate mail
Same envelope silhouette, green checkmark seal (different glyph shape, colour-blind safe); the only green thing on the lane; 30% larger
Path: Arcs like phishing
shooting it costs -500 (15% of all envelopes)
Production server
Near-black rack chassis, amber hazard bands and chevrons, PROD plate
Path: Drifts slowly
shooting it costs -500 and stamps SHOT PROD on the run
Fair at every distance
Every target holds a constant apparent size no matter how far downrange it spawns. A long shot on the lane is an aiming problem, never an eyesight test. Both no-shoots are held near twice a threat's angular size. Legitimate mail is also built 30% larger than a phishing envelope, so there is never an excuse for mistaking one for the other. Legitimate mail also carries a different glyph shape, a green checkmark seal instead of a red exclamation seal, not just a different colour, so the lane stays readable for colour-blind visitors. Fifteen percent of every envelope that arcs down the lane is legitimate mail. That rate is a fairness constant built into the spawner, not a difficulty knob that tightens as you improve.
Scoring rewards discipline, not just aim
A clean streak of hits builds a multiplier. One bad shot on a no-shoot takes it straight back to zero.
Streak multiplier
Every threat you hit adds +0.25 to your streak multiplier, capped at x8. Hit a single no-shoot and the streak shatters back to zero, no matter how long it was.
No-shoot penalties
Shoot legitimate mail and it costs -500 points. Shoot the production server and it also costs -500 points, plus a permanent SHOT PROD stamp on the run that never comes off. Let a botnet drone reach the firewall wall unshot and that breach costs -250.
Combo callouts
A run-announcer calls out combo milestones as they land: 3 hits is FOOTHOLD, 5 is PRIVILEGE ESCALATED, and 10 is DOMAIN ADMIN.
Accuracy bonus
At the end of a run, your accuracy is squared and multiplied by 2,000 and added to your score, so tightening up in the last few seconds of a run is always worth more than spraying the lane.
Request access to the private beta
TurboPentest VR is in private beta for current TurboPentest users.
Come introduce yourself on our Discord.