Raw Ops: scored vulnerability reports instead of flags
Raw Ops is a report-based pentest competition. Participants get a scope and a realistic target, not a list of puzzles. They hunt, chain weaknesses and write vulnerability reports. Every report is triaged and scored with CVSS 4.0, much the way real VAPT and bug bounty findings are judged.
What is a Raw Ops bug hunting competition?
Raw Ops is a flagless competition format. It works like a bug bounty simulation run as a time-boxed event. Instead of solving isolated challenges for a secret string, participants attack a realistic application or network within written rules of engagement. They submit structured vulnerability reports, and organizers triage each one. Valid findings are scored on severity using CVSS 4.0, and chains of weaknesses earn a bonus.
If you have only played flag-based events, our guide to CTF vs bug bounty explains how the two disciplines differ and why report-based scoring sits between them.
The result is a competition that rewards the skills clients and employers pay for: methodical recon, scope discipline, exploitation, clear evidence and a convincing impact statement. For the backstory, read what Raw Ops is and why we built it.
Raw Ops at a glance
- No flags: proof is a reproducible report
- Real scope: in-scope assets and rules of engagement
- Human triage: valid, invalid, duplicate or needs more info
- CVSS 4.0: severity drives the points
- Chains: low-severity bugs linked into real impact score higher
- Plans: self-serve on Standard and Premium events and on the Pro and Enterprise organization plans; not on Free or Organization Starter
A pentest competition in seven stages
Seven stages from the rules of engagement to the final leaderboard. It is the same lifecycle as a professional VAPT engagement, compressed into an event.
Publish scope and rules of engagement
List the in-scope hosts, applications and IP ranges, what is explicitly out of scope, the allowed techniques, test accounts, rate limits and the reporting deadline. Participants should acknowledge the rules before they get access.
Stand up the target environment
A realistic, intentionally vulnerable stack runs in isolated containers or a lab network: web app, APIs, admin panel, internal services. There is no hint board. Vulnerabilities live where they would in production, including business-logic flaws a scanner will not find. Use one of our targets or bring your own Docker images; hosting them is included in the plan.
Hunt
Participants map the attack surface, test authentication and authorization, probe APIs and pivot where the rules allow. They are encouraged to chain findings: an information leak plus an IDOR can become an account takeover.
Submit a structured report
Each finding goes in as a report with affected asset, weakness class, reproduction steps, evidence, impact, a proposed CVSS 4.0 vector and remediation advice.
Triage
Triagers reproduce the issue, check scope and duplicates, and move it through the workflow: needs more info, valid, invalid, duplicate, won't fix or rejected. Participants should see every status change and comment.
Score with CVSS 4.0
The triager finalizes the CVSS 4.0 vector. The base score sets the points, and the triager can add bonus points when several weaknesses combine into higher impact.
Leaderboard and debrief
The live leaderboard ranks points from valid reports. After the event, organizers walk through the top findings, and analytics show report quality and coverage across the target.
Rules of engagement that read like a real engagement
Scope discipline is a professional skill, so Raw Ops enforces it. Findings on out-of-scope assets are closed as invalid and score nothing, just as they would on a real program. A typical scope brief looks like this:
Rules of engagement
- No DoS / resource exhaustion
- No social engineering
- Max 10 req/s per participant
- Test accounts: 2 per player
- Do not modify or delete other users' data
- Report within 60 min of confirming a finding
What goes into a Raw Ops report
Every submission uses the same structure. Triagers compare like with like, and participants practice the format they will use on client deliverables and bug bounty platforms.
| Field | What triagers look for |
|---|---|
| Title | Weakness + location + impact, e.g. "IDOR on PATCH /users/{id} allows account takeover" |
| Affected asset | Exact host, endpoint, parameter or service |
| Weakness class | CWE or OWASP category (e.g. CWE-639) |
| Steps to reproduce | Numbered, deterministic, from a fresh session |
| Evidence / PoC | Requests and responses, script, screenshots |
| Impact | What an attacker gains, in business terms |
| CVSS 4.0 vector | Proposed vector with a one-line justification per metric |
| Chain references | IDs of earlier reports this finding builds on |
| Remediation | A specific fix, not "sanitize input" |
From submitted to scored: the triage states
A well-run Raw Ops event moves every report through a clear set of states, with the triager's comment on each decision. Organizers and triagers reproduce, dedupe, request info, accept or close. You configure the workflow and tooling for your event; our team can help.
| State | Meaning | Effect on score |
|---|---|---|
| Submitted | Report received and timestamped. The timestamp decides duplicate priority. | Pending |
| Needs more info | Triager could not reproduce, or evidence is missing. Reporter updates the report. | Pending; original timestamp kept if answered in the response window |
| Valid | Reproduced, in scope, first valid report of this root cause. CVSS vector finalized. | Points awarded |
| Duplicate | Same root cause as an earlier valid report, even on a different endpoint. | 0, or partial credit if the organizer enables it |
| Invalid | Out of scope: an asset or technique outside the rules of engagement. | 0; repeated violations can be penalized |
| Rejected | Not a vulnerability, not reproducible, or no security impact. | 0 |
CVSS 4.0 scoring, with a worked example
Raw Ops uses the CVSS 4.0 base metrics published by FIRST. They fall into three groups: exploitability (Attack Vector, Attack Complexity, Attack Requirements, Privileges Required, User Interaction), vulnerable-system impact (Confidentiality, Integrity, Availability) and subsequent-system impact (the same three, for systems beyond the vulnerable one).
Unlike CVSS 3.1, version 4.0 does not use a simple formula. The vector maps to a "macrovector" whose score comes from a lookup table built by FIRST from expert rankings, then gets adjusted by the vector's position within that macrovector. Participants propose a vector, and the triager validates each metric and finalizes it. Because Raw Ops scores base metrics only, the result is formally a CVSS-B score.
The full specification is at first.org/cvss/v4-0, and our CVSS 4.0 guide walks through every metric in plain language. For definitions of IDOR, CWE, PoC and other terms, see the CTF glossary.
Report #212 · IDOR on PATCH /api/v2/users/{id} → account takeover
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N → 8.6 (High)| Metric | Value | Why |
|---|---|---|
| Attack Vector (AV) | Network | Exploitable over the internet-facing API |
| Attack Complexity (AC) | Low | No security measures to bypass |
| Attack Requirements (AT) | None | No race condition or special deployment state |
| Privileges Required (PR) | Low | Any registered customer account works |
| User Interaction (UI) | None | The victim does nothing |
| Confidentiality (VC) | High | Full read access to any user's profile and orders |
| Integrity (VI) | High | Attacker changes the victim's email, then resets the password |
| Availability (VA) | None | Service stays up |
| Subsequent (SC/SI/SA) | None | No impact beyond the application |
From score to points: a common configuration is points = 100 × base score, so 8.6 becomes 860. The organizer sets the multiplier and any severity floors. Compare: an unauthenticated SQL injection with full read, write and availability impact (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) scores 9.3 Critical, or 930 points.
Why chaining low-severity bugs pays off
Real attackers rarely win with one critical bug. They string together small weaknesses. Raw Ops rewards that thinking with a chain bonus: when a report demonstrates that several findings combine into higher impact, the chain is scored on its final impact, and the triager adds bonus points for it.
#198 · Sequential user IDs leak in order receipts
Authenticated low-impact information disclosure, VC:L: 5.3 Medium on its own.
#212 · PATCH /users/{id} lacks ownership check
With the leaked IDs, the attacker overwrites any user's email and resets the password: 8.6 High.
Chain scored
860 + 172 chain bonus = 1,032 points. The earlier #198 is linked, not double-counted.
The organizer sets how much a chain earns and publishes it with the rules. The 172-point bonus shown here is an example.
First valid reporter wins
Duplicates are where report-based competitions win or lose credibility, so we recommend an explicit policy, published before the event. This is a recommended setup, and organizers define the final rules:
- Earliest valid report wins. Priority is decided by the submission timestamp of the first report that is eventually marked valid.
- Root cause, not URL. The same missing authorization check on five endpoints is one finding. A different root cause on the same endpoint is a new finding.
- Needs more info keeps your place. If a triager requests details and you answer within the response window, your original timestamp stands.
- Low-quality reports do not squat. A report that cannot be reproduced is rejected, and the next valid reporter takes priority.
- Optional partial credit. Organizers may choose to award a fraction of the points to duplicates that add new impact or a better proof of concept.
Leaderboard: we recommend ranking teams by points from valid reports, with ties broken by the earliest valid submission, so pending reports never count until marked valid.
Raw Ops vs jeopardy CTF vs a real bug bounty program
Raw Ops sits deliberately between the two: the realism of a bug bounty with the safety, fairness and time box of a competition. For the wider career view, read CTF vs bug bounty: key differences and how to switch.
| Dimension | Raw Ops | Jeopardy CTF | Real bug bounty |
|---|---|---|---|
| Target | One realistic application or network | Many isolated puzzles | Production systems |
| Proof of success | Reproducible vulnerability report | Submitting a flag string | Reproducible vulnerability report |
| Scoring | CVSS 4.0 after human triage, plus chain bonus | Fixed or dynamic points per flag | Bounty table set by the program |
| Feedback speed | Minutes to hours, during the event | Instant | Days to months |
| Scope discipline | Enforced and scored | Rarely relevant | Enforced, legal risk if breached |
| Report writing | Core skill | Optional writeups | Core skill |
| Exploit chaining | Rewarded explicitly | Only within one challenge | Often rewarded via severity |
| Duplicates | Recommended: earliest valid report wins, policy published | Not applicable | First reporter wins; duplicates often unpaid |
| Fair comparison of people | Same target, same time box | Same board | Different programs and timing |
| Safe for beginners | Dedicated lab target with published scope | Yes | Requires care and experience |
Better training for real pentest, VAPT and bug bounty jobs
A flag shows that a player found a bug. A report also shows whether they can explain its impact to a client.
In a real engagement, the deliverable is the report. Clients read the impact statement, developers follow the reproduction steps, and managers prioritize by severity. Raw Ops makes participants practice every part of that loop under time pressure, with a triager pushing back the way a demanding client would.
Methodology over guesswork
No category labels or hints. Participants must enumerate, prioritize and test like a consultant.
Severity judgment
Proposing and defending a CVSS 4.0 vector builds the risk-rating skill every VAPT report needs.
Report-writing reps
Many structured reports in a weekend, each with triager feedback. That is far more practice than a typical course offers.
Attacker thinking
Chain bonuses teach players to ask "what can I do with this?" instead of stopping at the first bug.
Who runs Raw Ops, and why
Universities & cyber clubs
Give final-year students and club members a portfolio-grade experience. A weekend Raw Ops produces real reports they can discuss in interviews, and faculty get a rubric-based view of each student's skill.
Raw Ops for universitiesHiring rounds
Pentest and AppSec hiring depends on communication as much as exploitation. A 24-hour Raw Ops round shows both, and the reports become the agenda for the technical interview.
Hiring CTFsCorporate red team drills
Run your red team or internal VAPT staff against a replica of your own stack, custom-built by our challenge developers. Pair it with a SOC simulation for a purple-team day.
Raw Ops for enterprisesA 48-hour Raw Ops event against “ShopNova”
A fictional e-commerce stack with a storefront, a REST API, a staff panel and a small internal network, built for about 150 participants.
| When | Participants | Organizers & triagers |
|---|---|---|
| T − 2 weeks | Register, read the rules, practice report writing on a sample finding | Target built and internally tested; scoring rules and duplicate policy published |
| Hour 0 | Scope released, VPN or URLs issued, test accounts assigned | Triage rota starts; queue monitoring |
| Hours 0–6 | Recon and quick wins: auth issues, exposed files, verbose errors | Peak of low-severity reports; fast dedupe matters most here |
| Hours 6–36 | Deep testing: business logic, IDOR, SSRF into the internal range, chains | Reproduce high-severity findings; request info where evidence is thin |
| Hour 44 | Final submissions; chain reports tie earlier findings together | Announcement: triage continues after close; response window for needs-info |
| Hour 48 | Submissions close | Finish triage, finalize vectors, freeze the leaderboard |
| Day 3 | Results and debrief of the top 5 findings | Analytics: coverage per vulnerability, report quality, certificates |
Plan triage capacity. Human triage is what makes Raw Ops fair, and it is also the main organizer workload. As a starting point, budget one experienced triager for every 25 to 40 active participants during the busiest hours, and publish a response-time expectation. Talk to us about scoping triage for your event.
Other competition formats on CTF7
Practicing solo instead? War Zone bundles challenges, missions and raw targets into time-boxed operations.
Run a bug-hunting round
Bring a target you own, or ask us about the target library. Set the scope, the severity rules and the review team, then open the round. Raw Ops runs on Standard and Premium events and on the Pro and Enterprise organization plans.
