In this guide, you'll find a step-by-step walkthrough on how to opt in as a UGC author, submit a new User-Generated Content (UGC) lab in the OffSec Portal, and view the status of your submission.

You’ll learn:

• How do I opt in and access the UGC submission page?
• What will I see on the UGC page?
• Tiers and limits
• The UGC Wishlist
• How do I submit a new UGC machine (field-by-field)?
• How can I view my submission and its status?
• What should I do after submitting?
• Need faster support?

How do I access the UGC submission page?

1. Log in to your OffSec Portal with your account credentials.
2. In the upper-left corner of the screen, click the three horizontal lines (menu icon).
3. A left-hand navigation menu will open.
4. Scroll down to the Resources section.
5. Click on UGC.

Once you've opted in, you'll land on the UGC page, where you can create and track your UGC machine submissions.

What will I see on the UGC page?

On the UGC page, you'll see a dashboard-style view built around: 

Lab Creator Dashboard

This is where you can see all your submissions and their current state:

• Drafts
• In Review
• Changes Requested
• Rejected
• Approved

UGC Wishlist

UGC Wishlist: labs to prioritize this quarter 

See The UGC Wishlist section below for the full guide on browsing, claiming, and submitting against wishlist items.

Labs Published

Shows how many of your labs are live in our portal.

Learner Reach

Shows the feedback and future rating of your machines.

Tiers and Limits

Your weekly/concurrent submission limit depends on your Creator tier: Learn more about Tiers and limits

The UGC Wishlist

Vectors we're actively looking for, ordered by priority. Click a row for the full brief and reference notes. The wishlist is a creative starting point , pick any item that sparks an idea and shape it into a lab.

How to read the wishlist

A contributor reference guide, not a rulebook.

Treat every casefile as a creative starting point. The wishlist points at what we want to cover, but the exact details of the lab is up to you as the author.

What you can adjust

• For Grimoires:
  • Investigation question wording, ordering and count.
  • Point allocations across questions, as long as the total stays reasonable for the difficulty.
  • Artifact sets: swap, add or trim files so the investigation flows.
• Per-proof and overall difficulty ratings.
• Scenario details, characters, hostnames, IPs and the surrounding contexts.

Claiming and duplicates

• First come, first served. One accepted submission per wishlist item.
• If two concepts are submitted in close succession , the reviewer may flag the later one as a duplicate if the initial one is accepted - this process will happen at the reviewer’s discretion. There is no automatic lockout while you draft.

Who can see what

• Most wishlist topics are open to all authors.
• Rows marked "Trusted creator only" are reserved for Trusted Creators. Trusted Creator status is granted to authors with 20 or more approved labs, or assigned manually by OffSec.

Quality reminders for Grimoires

• Keep timestamps internally consistent across logs and artifacts.
• Use neutral, in-world filenames. Avoid giveaways like flag.txt or solution.pdf.
• Add enough realistic noise that the answer is found, not handed over.
• Verify proofs and walkthrough on a clean redeploy before submitting.

Questions on a specific casefile? Reach out for clarity in the creator channel before you go deep on the build.

Claiming, working on, and releasing a wishlist item

1. From the UGC Wishlist list, review the Topic, Description, Difficulty, and Bounty for each row, then click Claim on the item you want.

2. A confirmation dialog explains how claiming works before you commit:

• Your claim starts the countdown immediately.
• When you claim a topic, you're reserving it to start work within a limited time.
• If you don't submit in time, the topic may reopen for others to claim it.
• If you need more time, you may be able to request an extension.
• If a topic reopens, you may need to wait before claiming it again.

3. Once claimed, the item is added to your labs as a draft tagged "WISHLIST TOPIC," and shows a countdown until it reopens.

4. If you no longer want to pursue the topic, click Release Claim and confirm. This makes the item available for other authors to claim again. 

Note: your draft is kept after releasing , you can continue working on it, but it's no longer reserved to you, and another author may claim and submit the same topic in the meantime.

5. When you submit a lab built from a claimed wishlist item, it's submitted the same way as any other UGC machine (see the next section) , just make sure your claim is still active first. If your claim has lapsed or been released, submission will be blocked until you are able to reclaim the item.

Sample submission package

When you're ready to start creating, please familiarise yourself with the submission format and quality OffSec is expecting. A Download Sample Package button is available on the submission page - use it to download a complete example package (walkthrough, build scripts, data, and build guide) for the lab type you've selected.

How do I submit a new UGC machine?

1. From the UGC page, click Submit your lab (or start a new draft from the Lab Creator Dashboard).
2. You will see a submission form with required and optional fields. Complete the form as described below.

Required & key fields

• Lab Type*
  Choose the type of lab you are submitting (for example: VM or Grimoire)
• Kind of Lab*
  Select the format that best fits your lab (for example: Single or Chain). This determines the lab's structure and is required.
• Submission Type*
  For example: Attack or Defend.

• Lab Type*
  Enter a clear, descriptive name for your lab.
  • This is how learners and internal teams will refer to your machine.
  • Avoid overly generic names; choose something that reflects the theme, technology, or scenario.
• Is this a CVE-based lab?* Yes/No.