You rooted the box.
Now get better at it.
owlsh records your run and grades it like a debrief — what you nailed, where you bled time, and the one thing to fix next box. On your machine, no account, no cloud.
Immersive
Record. Grade. One lesson. It rides along the whole run, grades every move across three frameworks, and hands back the single highest-value fix, before your next box.
01Record
Your run, captured live. Every command, its output and the pauses in between, read as a kill chain while the box is still open. No eBPF, ptrace or kernel hooks.
Nothing gets missed.
Every command, its output, and the gaps between, one continuous userspace capture.
No kernel hooks.
A userspace PTY, not eBPF or ptrace. The run never leaves your host.
02Grade
A score you can defend. Every move mapped to MITRE ATT&CK®, the Unified Kill Chain and CWE. They roll up into one rubric you can read line by line: coverage, breadth, efficiency, methodology, focus.
Three frameworks, one map.
Every move mapped to MITRE ATT&CK, the Unified Kill Chain and CWE.
A number you can defend.
Weighted into an explainable rubric, coverage, breadth, efficiency, methodology, focus.
03Lesson
The one thing to fix next run. A deterministic diff against the optimal line your own findings unlocked. It shows where you were ahead, where you went off-path, and where you pivoted late, then boils it down to a single deep-linked lesson.
You vs. the optimal line.
A deterministic diff against the best path your own findings unlocked.
One deep-linked lesson.
Off-path wins, skips and late pivots, distilled to the single fix that matters.
A coach beside your shell,
not a walkthrough.
Keep it in a pane next to your terminal. It mirrors your run as you work and remembers the threads you've left loose. It never hands you the next move.
Built for operators.
Trusted by the CISO.
Operators get a debrief sharp enough to change the next run. Leadership gets an auditable measure of methodology that moves across the team. And no engagement data ever leaves the host.
Your run, replayed
Methodology across the last 8 runs
On your machine, end to end
the one lesson C → A− 0 telemetryA terminal is one way in. Not the only one.
Four ways in, one engine out. Drop a file or run the CLI — every run is tagged by source and graded against the same ladder, write-up or not.
The debrief writes your report.
Every graded run becomes an OSCP/CPTS-style report: an executive summary a CISO can read, a severity-ranked findings table, then evidence and reproduction straight from your own log. Export it as Markdown or a client-ready PDF. Deterministic and offline.
| # | Finding | Severity |
|---|---|---|
| 1 | Samba print-job command injection | Critical |
| 2 | Writable systemd unit → root | Critical |
Stop finishing boxes.
Start debriefing them.
Most tools confirm you rooted the box. owlsh tells you whether you were any good at it, and exactly what to fix next run. Deterministic, on your machine, yours alone.