Pentest Notes

Pentest Notes is a notebook bound to one challenge. Everything you write stays in your own browser.

Opening the panel

The Notes button in the challenge page's top navigation bar is the only control that opens the panel. Below the lg breakpoint the button shows its pencil icon alone and the word is hidden.

The button carries a number badge with this challenge's note count. The badge is rendered only while that count is above zero, so a challenge you have not written anything for shows no badge at all rather than a 0.

The open panel is headed Pentest Notes.

Panel sizes

The panel header holds Maximise / Restore, Minimise and Close.

Size	How you reach it	Layout	How you leave it
Standard	the size the panel opens at	fixed to the right edge — half the viewport wide on a wide screen, full width on a narrow one — with a dimmed backdrop over the rest of the page. The note list fills the panel; while you are editing, the editor takes the top half and the list keeps the bottom half	Maximise, Minimise, Close, or a click anywhere on the backdrop
Maximised	the Maximise button	full screen. On a wide screen the list holds the left 30% and the editor the right 70%; with nothing open for editing, the right side reads "Select a note to edit, or press + to add a new one." On a narrow screen you see one side at a time, and a back control leads from the editor back to the list	Restore, which returns you to Standard
Minimised	the Minimise button	the panel disappears and a floating button takes its place in the bottom-right corner of the page. On a wide screen that button shows the label and the same note count badge; on a narrow screen it is a bare circular icon	click the floating button

Minimising unmounts the panel body, so it discards unsaved editor text exactly as closing does. Restoring reopens the editor on the same note, showing that note's last saved content.

Writing a note

1. Press + (New note) in the header to start a new note, or the pencil button on an existing card to edit that one.
2. Type in the Edit tab. The Preview tab renders what you have typed as Markdown, with GFM enabled and a single newline treated as a line break. Both tab labels are fixed English and are not translated.
3. Press Save.

Cancel ends editing and keeps nothing you typed.

In Standard size the editor reads a note's content once, at the moment it opens. If you start editing note A and then click a second card's pencil button without saving, the editor still holds A's text — and Save then writes A's text over that second note. Pressing + in the same state creates a new note whose content is a copy of A. Finish or cancel one note before opening another. Maximised size is not affected.

Clicking a card does different things by size: in Maximised it opens that note in the editor straight away; in Standard it only selects the card.

What counts as saved

Only the Save button commits a note. Typing is not saved as you go.

What you do	The note in storage	The text in the editor
Press Save	written to the browser database; survives a reload and closing the tab	cleared, editing ends
Press Cancel	unchanged	discarded
Press Close, or click the backdrop	unchanged	discarded, with no confirmation
Press Minimise	unchanged	discarded
Reload or navigate away	unchanged	discarded

Unsaved editor text is never written anywhere — the draft key the panel reads at start-up is only ever read and removed, never written — so it is gone the moment the editor unmounts, and there is no way to recover it.

Closing the panel resets the panel size back to Standard. Whatever you typed in the search box stays, so the list may still be filtered when you reopen it. Saved notes are untouched.

Where notes are stored

• Notes live in the challenge-tools IndexedDB database in your own browser, in the pentest-notes store, alongside attack-sessions and code-drafts. Nothing is uploaded to a server.
• Notes are per challenge. Opening a challenge loads only the notes tagged with that challenge's folder name, so notes from other challenges never appear.
• That key is the challenge folder name rather than the page URL, so the English and Traditional Chinese versions of the same challenge share one set of notes.

Three things remove notes:

• deleting a note in the panel — it goes immediately, with no confirmation step;
• clearing the browser's site data, which drops the whole database and cannot be undone;
• opening the site in a different browser or on a different device, where that database does not exist.

Notes sit in a separate store from the attack log, so re-entering a solved challenge does not touch them — but it does replace that challenge's attack log, see Troubleshooting.

The note list

Each card shows the first two non-blank lines of the note; a note with no content at all shows "(empty note)". Under that preview is the creation time, followed by "(edited)" on any note that has been saved a second time.

The edit and delete buttons on a card stay hidden until the pointer is over it. On a touch device, where there is no hover, they cannot be reached.

The list has two empty states: with no notes at all it reads "No notes yet. Press + to add one."; with notes present but none matching the search, it reads "No notes match your search."

Searching

The search box at the top of the panel matches the note body only, and ignores case. Timestamps and the "(edited)" marker are not compared.

The box decides whether it is empty by trimming, but it matches with the untrimmed string. One stray leading or trailing space is matched literally, so a note only matches when its text contains that space in the same position — a trailing space typed after the last word of a note will not match.

Sorting

The sort button toggles between newest-first and oldest-first, ordering by the time each note was created. Its tooltip states the current direction and the direction a click switches to.

Deleting a note

Deleting removes the note from the list and from the database at once. The matching entry in the attack log stays where it is — that timeline is append-only — so the deleted text still appears in an exported attack log.

Editing behaves the opposite way: saving an edit rewrites the attack log entry in place and stamps it as updated, so only the newest version survives there.

Exporting

Both export buttons sit next to the success message in the challenge description column, and neither one exists before you submit a correct flag.

Button	Produces	Filename
Export Pentest Notes	a Markdown file of every saved note for this challenge	pentest-notes-<challenge-folder>-<YYYYMMDD>.md
Export Attack Log	a JSON file of the whole session — challenge description, HTTP request and response history, code runs, notes, flag attempts and timing information — headed by a system prompt you can hand to an AI to have it draft a writeup	attack-session-<challenge-folder>-<YYYYMMDD-HHMMSS>.json

The Markdown file opens with a level-1 heading pairing a fixed Traditional Chinese label with the challenge title; that label is not translated. Notes then sit under one level-2 heading per calendar day, each note introduced by a #### HH:MM heading and followed by a --- rule.

The export always runs oldest to newest whatever the sort button is set to, and it reads the full note set rather than the filtered list, so text left in the search box never leaves notes out of the file.

The two buttons do not disappear together:

• Reloading the page after solving removes both. The success message and both buttons come back only once you submit the correct flag again.
• The tool database failing to open removes only Export Attack Log. Export Pentest Notes is not behind that condition, so it still appears — see Troubleshooting.

If your work is not being recorded

An orange bar at the very top of the challenge page, headed "This session is not being recorded", means nothing you write is reaching storage — see Troubleshooting for the cause and what to do about it.