In this guide, you'll find a step-by-step walkthrough on how to opt in as a UGC author, submit a new User-Generated Content (UGC) lab in the OffSec Portal, and view the status of your submission.

You’ll learn:

• How do I opt in and access the UGC submission page?
• What will I see on the UGC page?
• Tiers and limits
• How do submission quotas work?
• The UGC Wishlist
• How do I submit a new UGC machine (field-by-field)?
• How do I choose how to build my UGC lab?
• How do I import my lab from Lab Builder?
• How do I build a UGC lab in Lab Builder?
• How can I view my submission and its status?
• Can I cancel a submission after I submit it?
• When I can't cancel a submission?
• What should I do after submitting?
• Need faster support?

How do I access the UGC submission page?

1. Log in to your OffSec Portal with your account credentials.
2. In the left-hand navigation menu, click UGC. If you have not opted in yet, click Become a UGC author instead.

Once you've opted in, you'll land on the UGC page, where you can create and track your UGC machine submissions.

What will I see on the UGC page?

On the UGC page, you'll see a dashboard-style view built around: 

My Labs

This is where you can see all your submissions and their current state:

• Drafts
• In Review
• Changes Requested
• Rejected
• Approved

Quarterly Quota

Shows how many submission slots are used in each lab category this quarter. See How do submission quotas work? below.

UGC Wishlist

UGC Wishlist: labs to prioritize this quarter 

See The UGC Wishlist section below for the full guide on browsing, claiming, and submitting against wishlist items.

Labs Published

Shows how many of your labs are live in our portal.

Learner Reach

Shows the feedback and future rating of your machines.

Tiers and Limits

Whether you can submit a lab also depends on the quarterly quota for its lab category. See How do submission quotas work? in this guide.

Your weekly/concurrent submission limit depends on your Creator tier: Learn more about Tiers and limits

How do submission quotas work?

OffSec sets a submission quota for each lab category every quarter. A quota is shared across all UGC authors. The categories are:

• Attack labs: standalone labs without a CVE, standalone CVE labs, and chain labs.
• Defend labs: standalone labs without a CVE, standalone CVE labs, and chain labs.
• Grimoire labs.

Each lab that you or another author submitted this quarter, and that is in review or approved, uses one slot in its category. A slot becomes free when a lab is rejected.

The My Labs page shows a Quarterly Quota card. For each category, the card shows the slots that are used out of the quota for the current quarter, for example 1/2. A number in red means that the category is full or closed.

If a category's quota is full, the submission form displays a message naming the quarter and category. Save your lab as a draft and submit it when a slot becomes available. Choose the category that accurately describes your lab.

If OffSec is not accepting a lab category, for example because its quota is closed, the form shows (paused) next to that option and a message that explains why. You cannot submit that type of lab until OffSec accepts it again. For example, the form can show Attack (paused).

The UGC Wishlist

Vectors we're actively looking for, ordered by priority. Click a row for the full brief and reference notes. The wishlist is a creative starting point , pick any item that sparks an idea and shape it into a lab.

How to read the wishlist

A contributor reference guide, not a rulebook.

Treat every casefile as a creative starting point. The wishlist points at what we want to cover, but the exact details of the lab is up to you as the author.

What you can adjust

• For Grimoires:
  • Investigation question wording, ordering and count.
  • Point allocations across questions, as long as the total stays reasonable for the difficulty.
  • Artifact sets: swap, add or trim files so the investigation flows.
• Per-proof and overall difficulty ratings.
• Scenario details, characters, hostnames, IPs and the surrounding contexts.

Claiming and duplicates

• First come, first served. One accepted submission per wishlist item.
• If two concepts are submitted in close succession , the reviewer may flag the later one as a duplicate if the initial one is accepted - this process will happen at the reviewer’s discretion. There is no automatic lockout while you draft.

Who can see what

• Most wishlist topics are open to all authors.
• Rows marked "Trusted creator only" are reserved for Trusted Creators. Trusted Creator status is granted to authors with 20 or more approved labs, or assigned manually by OffSec.

Quality reminders for Grimoires

• Keep timestamps internally consistent across logs and artifacts.
• Use neutral, in-world filenames. Avoid giveaways like flag.txt or solution.pdf.
• Add enough realistic noise that the answer is found, not handed over.
• Verify proofs and walkthrough on a clean redeploy before submitting.

Questions on a specific casefile? Reach out for clarity in the creator channel before you go deep on the build.

Claiming, working on, and releasing a wishlist item

1. From the UGC Wishlist list, review the Topic, Description, Difficulty, and Bounty for each row, then click Claim on the item you want.

2. A confirmation dialog explains how claiming works before you commit:

• Your claim starts the countdown immediately.
• When you claim a topic, you're reserving it to start work within a limited time.
• If you don't submit in time, the topic may reopen for others to claim it.
• If you need more time, you may be able to request an extension.
• If a topic reopens, you may need to wait before claiming it again.

3. Once claimed, the item is added to your labs as a draft tagged "WISHLIST TOPIC," and shows a countdown until it reopens.

4. If you no longer want to pursue the topic, click Release Claim and confirm. This makes the item available for other authors to claim again. 

Note: your draft is kept after releasing , you can continue working on it, but it's no longer reserved to you, and another author may claim and submit the same topic in the meantime.

5. When you submit a lab built from a claimed wishlist item, it's submitted the same way as any other UGC machine (see the next section) , just make sure your claim is still active first. If your claim has lapsed or been released, submission will be blocked until you are able to reclaim the item.

Sample submission package

When you're ready to start creating, please familiarise yourself with the submission format and quality OffSec is expecting. A Download This Example Package button is available on the submission page - use it to download a complete example package (walkthrough, build scripts, data, and build guide) for the lab type you've selected.

How do I submit a new UGC machine?

1. From the My Labs page, click Create a New Lab.
2. You will see a submission form with required and optional fields. Complete the form as described below.

Required & key fields

• Lab Type*
  Choose the type of lab you are submitting: VM Submissions or Grimoire.
• What Kind of Lab?*
  Select the format that best fits your lab (Single or Chain). This determines the lab's structure and is required.
• Submission Type*
  Select Attack or Defend.

• Name*
  Enter a clear, descriptive name for your lab.
  • This is how learners and internal teams will refer to your machine.
  • Avoid overly generic names; choose something that reflects the theme, technology, or scenario.
• Is this a CVE-based lab?* Yes/No.

How do I choose how to build my UGC lab?

You can submit a UGC lab in one of two ways. In the submission form, under How are you building this?, select the option that matches how you built your lab.

Note: Lab Builder does not change which lab types OffSec accepts. Please review the New Submission Acceptance Policy in this guide before you start to build. Lab Builder import is currently available for single-VM labs only. Chain labs and Grimoire labs use Upload a package.

Option 1: How do I submit by uploading a package?

To submit your lab as an archive, select Upload a package under How are you building this?, then follow the steps for Upload Submission Archive and Required files below.

At the bottom of the form, you will be asked to upload your lab package:

• Upload Submission Archive*
  • Upload your complete lab archive in a compressed format.
  • Recommended: ZIP.
  • Once you select a file, the upload will usually start automatically.

The submission form accepts one ZIP file, with a maximum size of 10 GB. The archive must not be password protected. If your file is larger than 10 GB, please contact the UGC Liaisons on Discord.

Option 2: How do I import my lab from Lab Builder?

To submit a lab that you built in Lab Builder, save your project and snapshot first, then import the project into your submission. Follow these steps:

1. Build your lab in Lab Builder. For the steps, see How do I build a UGC lab in Lab Builder?
   • Change the default root or Administrator password on your machine. OffSec does not accept labs that keep the default password.
2. Save your project in Lab Builder, and take a snapshot of your machine. A snapshot is required.
3. Go to the My Labs page and click Create a New Lab.
4. Select your Lab Type, What Kind of Lab?, and Submission Type.
5. Under How are you building this?, click Use Lab Builder.
6. In the Lab Builder project list, select your project.
7. Check the machine card. It shows the project name, machine name, image, flavor, network, and date.
8. Enter the flag values (the proof.txt values) in the submission.yml file in the form, and check that they are correct.
9. Complete the other fields, attach one ZIP file that contains your autopwn script, your walkthrough, and a README, and accept the Terms and Conditions.
10. Click Save to keep a draft, or Submit for review to send your lab to the UGC Review team.

Note: The project list shows only your own projects. A project marked (not built yet) cannot be imported. Open that project in Lab Builder, save it, and then import it again. A Snapshot ready label appears on the machine card when your snapshot is complete.

After you select a project, the form shows an Imported from Lab Builder summary. The import fills in your lab details (name, difficulty, and submission type), your flags or questions, and the machine definition. You can adjust these values in the form. What you change in the form is what reviewers see, and it does not change your Lab Builder project.

Note: You must take a snapshot before you submit. The submission form does not check for a snapshot, and it lets you import any project that you have saved. However, reviewers deploy a preview of your lab from your snapshot. Without a snapshot, a reviewer sees only the base image and does not see your finished lab. The Snapshot ready label is for your information only.

Lab Builder is a beta feature, and the Use Lab Builder option shows a BETA label in the submission form. As a beta feature, Lab Builder may change as OffSec improves it.

Which files do I still need when I use Lab Builder?

When you import a lab from Lab Builder, your lab environment is pulled in directly from your Lab Builder project, so you do not need to upload a build guide or an artifacts.zip file. You still upload one ZIP file with your submission, containing your autopwn script, your walkthrough, and a README.

The Validation panel in the form lists the files that it expects for your build method. It updates as you change the form. The panel gives advice and does not block your submission, but please include every file that it lists. Please do not include virtual machine image files in any submission.

What happens if I change my Lab Builder project after I import it?

Your submission does not update by itself. If you save changes to your project in Lab Builder after you import it, the form shows a message that the project has changed since its last build.

To apply the changes, click Pull the latest build and confirm. The pull replaces the lab details and the flags or questions in your submission with the values from the project. Any change that you made to those fields in the form since the last import is lost. Your files, your walkthrough, and anything else that you typed are not changed.

The changes that you make in the submission form do not change your Lab Builder project. If you take a new snapshot in Lab Builder after you import, Lab Builder updates your project, so click Pull the latest build again to bring the new snapshot into your submission.

How do I switch back to uploading a package?

1. In the submission form, click Upload a package.
2. In the Discard the imported lab? message, click Remove it. To keep the import, click Keep the import.

The imported machine definition is removed. Your lab details stay as they are, and the form asks for the build guide and artifacts.zip again.

What can reviewers do with a Lab Builder submission?

After you submit, OffSec reviewers can deploy a preview of your lab to inspect it. The preview uses the snapshot that you created in Lab Builder.

How do I build a UGC lab in Lab Builder?

For the full steps to build your lab, see How do I build a UGC lab in Lab Builder? The article covers how to create a project, choose your machine settings, add lab details and flags, deploy and connect to your machine, save a snapshot, and destroy your machine. It also includes a tutorial video.

Lab Builder is a beta feature in the OffSec Learning Portal (portal.offsec.com). Lab Builder currently supports single-VM labs.

Accepting the Terms and Conditions

Before you can submit:

• You must confirm: “I have read and agree to the Terms and Conditions.”

Make sure you review any linked terms or policies so you understand the submission, review, and payment process.

Once all required fields are completed, your archive is uploaded, and the Terms and Conditions checkbox is selected:

1. Review your information for accuracy and completeness.
2. Click Submit for review at the bottom of the form.

Your machine will then be sent to the UGC team for review.

Note: Payment will be processed after your submission is reviewed and approved.

How can I view my submission and its status?

After you submit your machine, you can track its progress in the portal:

1. Open the My Labs page. To get there, click UGC in the left-hand navigation menu.
2. You will see a list of all your UGC submissions, including:

• Machine / lab name
• Date of submission
• Current status

Status descriptions:

• Approved , Your submission has passed review and has been accepted. Payment processing and release will follow according to the program's timelines.
• Rejected , Your submission did not meet the requirements or review criteria and will not move forward in its current form. Where possible, you may receive notes or feedback to help you understand why, which you can use to improve future submissions. Please do not resubmit the same concept. 
• Changes Requested (previously "Blocked") , Your submission needs updates before it can proceed.
  • This usually means the review team has identified issues that must be addressed for example: 
    • missing files
    • policy conflicts
    • unclear scenarios
    • technical problems
    • or incomplete content.
  • You should review the feedback from the team, update your lab accordingly, and resubmit.
    • Once you resubmit with the requested changes, the review process can continue but is not guaranteed to culminate in an approval.

Can I cancel a submission after I submit it?

Yes, as long as review hasn't started yet. If you submitted by mistake or need to fix something, you can pull the submission back to Draft.

1. Open the submission from the My Labs page.
2. If its status is Pending, click Cancel submission at the top of the page.
3. In the confirmation dialog, click Cancel submission to confirm. To leave it in the queue, click Keep it submitted.

Your lab goes back to Draft. Your uploaded package stays attached, so you can edit and resubmit without uploading it again. Cancelling removes your lab from the review queue, so when you resubmit it joins the queue again as a new submission.

When I can't cancel a submission?

What should I do after submitting?

• Monitor your status:
  Check the My Labs page periodically to see when your machine moves to Approved, Rejected, or Changes Requested.
• For Approved submissions:
  No further action is typically required from you unless the team requests clarifications. Payment and release will follow the normal process.
• For Rejected submissions:
  Use any feedback you received to refine your ideas and improve future labs. You can always submit new concepts that better align with the requirements. Please do not resubmit the same rejected concept.
• For Changes Requested submissions: Carefully read the review team's feedback, make the required changes to your archive or lab details, and resubmit so the review can continue.
• If you used Lab Builder: Keep your Lab Builder project. If the review team requests changes, update the project in Lab Builder, take a new snapshot, click Pull the latest build in your submission, and resubmit. You do not need to delete your submission.
• Submitting against the Wishlist: If your lab matches a UGC Wishlist item, it gets priority review (within 3 days), and approved labs earn a 25% rate uplift.
• Clarify if needed:
  If anything about your status or feedback is unclear, reach out to OffSec Support or the designated UGC contact channel (such as Discord or email) for clarification.

Need faster support?

When submitting a support ticket, please include your Discord name and ID. This allows our team to reach out to you directly in Discord for instant assistance. 

If you added your Discord username when you opted in, it is already on file. Including your Discord name and ID in your ticket still helps our support team route your request quickly.

Related articles

• User-Generated Content FAQ
• How do I build a UGC lab in Lab Builder?