CLASSIFICATION: TS/SCISYSTEM: BOXS-V2NODE: PRIMARY
BUILD: 20260826-ALPHA
// OPERATOR INTELLIGENCE PLATFORM
SEE HOW
YOU HACK.
GET BETTER.

Record your pentesting sessions. Replay every move, understand where your time goes, and race the hacker you used to be.

✓
RECORD
✓
REPLAY
✓
ANALYZE
✓
GHOST
✓
SHARE
SESSION CAPTURE
REC
root@boxs:~/targets/10.10.11.247● REC 00:04:32
$nmap -sC -sV -p- 10.10.11.247
Starting Nmap 7.94 at 2026-08-26 14:32
Host is up (0.045s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1
80/tcp open http nginx 1.18.0
443/tcp open ssl/http nginx 1.18.0
█RECORDING IN PROGRESS...
// THE PROBLEM
OPERATORS GET STUCK AT 95%.
TALENT ISN'T THE GAP. FEEDBACK IS.
REF-001THE FEEDBACK LOOP
DAN LUU · 2024
"95%-ile isn't that good"
danluu.com/p95-skill ↗
Dan Luu
"Deliberate practice requires feedback. Most people improve until they get 'good enough' and stop — not because they've hit their ceiling, but because no structured signal tells them what's still wrong."

The gap between 95th and 99th percentile isn't talent — it's the existence of a deliberate feedback loop. Star ratings on writeups are not feedback. Box completion time is not feedback. Structured diagnosis of where the decision broke down — that is feedback.

IMPLICATION
An operator who runs 200 boxes with zero structured debrief is running the same session 200 times.
REF-002THE JUDGMENT SYSTEM
HASARD LEE · 2025
"Succession Fails at the Point of Judgment"
hasardlee.com/succession-fails ↗
Hasard Lee
"Skills are teachable. Judgment — knowing which option to take under uncertainty — requires a system that surfaces errors, classifies them, and closes the loop with a specific training prescription."

Fighter pilots solve this with the ACE debrief: every divergence from the expected plan is classified as Assessment (environment misread), Choice (wrong option), or Execution (right call, failed implementation). Each type requires a different fix.

IMPLICATION
The debrief is not a performance review. It is a diagnostic — a map of where judgment broke down and a prescription for the next session.
BOXS IS THE FEEDBACK LOOP

Terminal recording is replay. Structured debrief is the diagnostic signal. Evidence capture is the divergence marker. Your judgment profile is the feedback loop closing over time.

// THE SYSTEM
ONE SESSION.
A COMPLETE FEEDBACK LOOP.
// DEBRIEF — 4 PHASES
01
RECONSTRUCT
Walk each captured moment — expected or unexpected?
02
DIVERGENCE
Select the earliest point where the plan first broke down
03
ACE
Classify: Assessment / Choice / Execution — which layer failed?
04
TRAINING FIX
Write the one change you apply in the next session
// ACE — ERROR CLASSIFICATION
A
ASSESSMENT
Environment misread
Wrong model of the target state. Signals were available but not integrated into the plan.
C
CHOICE
Wrong option selected
Correct read of the situation — but chose a suboptimal path, tool, or technique.
E
EXECUTION
Implementation failure
Right decision, right tool. The implementation itself broke down in the doing.
CAPTURE
01
SESSION
Terminal recording begins — every keystroke, every output captured live
CAPTURE
02
EVIDENCE
Press E mid-session to mark divergences, credentials, and findings
ANALYZE
03
DEBRIEF
Structured post-session diagnostic from Reconstruction to Training Fix
JUDGE
04
JUDGMENT
ACE error distribution and trajectory accumulate across all sessions
ITERATE
05
SESSION
Your training fix resurfaces at session start — deliberate practice
// SESSION REPORT
EVERY SESSION.
FULL AFTER ACTION REPORT.

Timeline, command intel, phase analysis, ghost comparison, and findings — all generated from one session. No manual writeup. No lost context.

boxs.sh/sessions/sauna-htb/aar
// OPERATIONS
RUN STRUCTURED
CAMPAIGNS.
03
OPS
02
ACTIVE
46
SESSIONS
28
TARGETS
07
COMPROMISED
boxs operations page
// ATTACK FLOW
EXPORT YOUR
ATTACK GRAPH.

boxs reconstructs your session into a structured MITRE ATT&CK flow — every action, technique, and lateral move mapped automatically from terminal recordings.

Export to the Center for Threat-Informed Defense's Attack Flow format. Replay the decision chain, annotate confidence, surface technique gaps.

Actions tagged with MITRE tactic + technique IDs
Conditions and branching captured from evidence markers
Timestamped execution chain from session replay
Export to Attack Flow JSON — open in any compatible viewer
Attack flow export — MITRE ATT&CK graph
// GHOST MODE
Ghost Mode — side-by-side session replay
COMPETE WITH
AN EXPERT.

Ghost Mode runs live during your session and in replay. An expert's terminal appears side-by-side in real time — watch their moves as you make yours on the same box.

Ghost against an expert, a teammate, or your own past run. Not a walkthrough — a live divergence map. See exactly when your path separated and why.

Live during your session — not just replay
Ghost any recorded session: expert, teammate, or yourself
Split-screen terminal output synced in real time
Path, comments, and delta tabs for structured comparison
// CAPTURE → UNDERSTAND → IMPROVE → SHARE
STOP LOSING YOUR WORK
WHEN THE SESSION ENDS.
CAPTURE
01
Full terminal recording — every keystroke, every output
INCLUDED
✓
02
Live-streamed to anyone you want watching
INCLUDED
✓
03
Replayable frame-by-frame, forever
INCLUDED
✓
UNDERSTAND
01
Attack phases: RECON → ENUM → FOOTHOLD → PWNED
INCLUDED
✓
02
Tools used, tempo, and command patterns
INCLUDED
✓
DEBRIEF
01
Guided diagnostic debrief — Reconstruction → Divergence → ACE classification → Training Fix
INCLUDED
✓
02
Evidence-anchored error origin — tie the failure to a specific captured moment
INCLUDED
✓
03
Peer diagnostic review — external divergence analysis, no performance scores
INCLUDED
✓
IMPROVE
01
Race your Ghost — your last run or an expert session
INCLUDED
✓
02
Judgment profile — ACE error distribution across sessions
INCLUDED
✓
03
Error trajectory by epoch — see your failure patterns change over time
INCLUDED
✓
04
Training fix resurfacing — your last prescription loads on next session start
INCLUDED
✓
SHARE
01
One-click shortlink via bxss.my
INCLUDED
✓
02
Exportable PDF report
INCLUDED
✓
03
Export attack flow as MITRE ATT&CK STIX 2.1 bundle (.af.json)
INCLUDED
✓
// THE INSIGHT
YOUR TERMINAL KNOWS
HOW YOU HACK.
UNTIL NOW, IT JUST FORGOT.

BOXS turns every pentesting session into a permanent record of your process — what you tried, where your time went, the tools you reached for, and how your approach changes as you improve.

Owning the box tells you that you made it.
BOXS shows you how you got there.
STOP
WINGING IT.
START
WINNING.

Run one session. See exactly how you hack — and what to improve next.

No credit card required · Free to start