SHIFTED = set('~!@#$%^&*()_+{}|:"<>?ABCDEFGHIJKLMNOPQRSTUVWXYZ')
REACH = set('0123456789[]=-`')
RARE = set('\\|`~^')
DIFFICULT = SHIFTED | REACH | RARE

def check(s):
    dc = sum(1 for c in s if c in DIFFICULT)
    pct = round(dc / len(s) * 100, 1)
    diff_chars = ''.join(c if c in DIFFICULT else '.' for c in s)
    print(f'  len={len(s)} diff={dc} pct={pct}%')
    print(f'  {s}')
    print(f'  {diff_chars}')
    return len(s), dc, pct

# Targets: tier -> (target_len, target_pct)
# novice: 115-125, 10%  -> ~12 diff in 120
# below-average: 125-135, 15% -> ~20 diff in 130
# average: 125-135, 20% -> ~26 diff in 130
# above-average: 140-150, 25% -> ~36 diff in 145
# expert: 150-160, 30% -> ~46 diff in 155
# legendary: 165-175, 35% -> ~60 diff in 170

snippets = []

# NOVICE: 115-125 chars, 10% (8.5-11.5%) -> ~12 diff chars in ~120
# Easy chars: a-z space . / , ; '
# Diff chars: pipes |, hyphens -, digits 0-9, uppercase A-Z, symbols

print("=== NOVICE ===")
novice = [
    # 1: grep pipeline with a few pipes and digits
    "cat /var/log/auth.log | grep 'failed' | sort | tail -20 | tee /tmp/ssh.failed.login.scan.log; echo 'filtered entries saved'",
    # 2
    "find /etc -name '*.conf' | sort | head -15 | tee /tmp/config.discovery.log; echo 'found 15 config files on this host now'",
    # 3
    "ps aux | grep -v 'root' | sort | head -10 | tee /tmp/running.user.process.scan.list.log; echo 'process scan complete'",
    # 4
    "ls -la /var/log/nginx | grep '.log' | sort | head -10 | tee /tmp/biggest.sorted.nginx.logs; echo 'top files pulled now'",
    # 5
    "who | sort | head -10; last -n 20 | grep -v 'reboot' | tee /tmp/user.session.history.log; echo 'session history saved'",
    # 6
    "cat /tmp/ports.list | sort | uniq | grep '80' | head -15 | tee /tmp/http.port.filtered.scan.log; echo 'filter is finished'",
    # 7
    "find /home -name '*.sh' | sort | head -20 | tee /tmp/shell.scripts.found.in.home.dirs.log; echo 'shell scripts discovered'",
    # 8
    "du -sh /var/log/*.log | sort -rn | head -5 | tee /tmp/disk.usage.hogs.report.log; echo 'top five largest log files found'",
    # 9
    "ss -tlnp | grep -i 'http' | sort | tee /tmp/listening.http.services.scan.log; echo 'found all http services on this host'",
    # 10
    "grep -rn 'error' /var/log/syslog | sort | tail -30 | tee /tmp/syslog.error.scan.report.log; echo 'error scan is finished'",
]
for s in novice:
    check(s)

print("\n=== BELOW-AVERAGE ===")
below_avg = [
    # target: 125-135, 15% (13.5-16.5%) -> ~20 diff in 130
    "find / -name '*.sh' -perm /111 2>/dev/null | head -20 | tee /tmp/exec.scan.log; echo 'Executable scan is finished for host'",
    "grep -rn 'Failed' /var/log/auth.log | awk '{print $11}' | sort -u | tee /tmp/bad.ip.hosts.log; echo 'Filtered bad hosts done'",
    "netstat -tulnp | awk '{print $4}' | grep -v '127.0.0.1' | sort -u | tee /tmp/open.ports.remote.list.log; echo 'Ports scanned now'",
    "ls -la /proc/*/exe 2>/dev/null | grep -v 'Permission denied' | head -30 | tee /tmp/running.binary.scan.log; echo 'Scan is finished'",
    "cat /etc/crontab | grep -v '^#' | awk '{print $6,$7}' | sort | tee /tmp/cron.schedule.entries.saved; echo 'Cron entries all listed'",
    "ps aux | grep -v root | sort -k3 -rn | head -15 | tee /tmp/top.procs.sorted.full.report.txt; echo 'Process scan finished here'",
    "find /var -name '*.log' -mtime -7 | sort | head -20 | tee /tmp/recent.modified.logs.full.report.txt; echo 'Log discovery finished'",
    "who -a; last -n 20 | grep -v 'reboot' | sort | tee /tmp/user.active.session.full.log; echo 'Session scan is now complete here'",
    "df -h /home /var /tmp | sort -k5 -rn | tee /tmp/disk.usage.full.report.txt; echo 'Disk usage scan completed for this host now'",
    "ss -tulnp | grep 'LISTEN' | sort | tee /tmp/listening.ports.full.scan.log; echo 'Port enumeration finished, results saved to file'",
]
for s in below_avg:
    check(s)

print("\n=== AVERAGE ===")
average = [
    # target: 125-135, 20% (18.5-21.5%) -> ~26 diff in 130
    "find /var -type f -mtime -1 -size +100k 2>/dev/null | head -20 | tee /tmp/big.recent.files.log; echo 'Found 100K+ files on host'",
    "awk -F: '$3>=1000 {print $1,$3,$6}' /etc/passwd | sort -k2 -n | tee /tmp/local.users.extracted; echo 'All Users extracted here'",
    "grep -rn 'password' /etc/*.conf 2>/dev/null | head -20 | tee /tmp/secret.hits.log; echo 'SCAN finished; found 20 possible leaks'",
    "for svc in nginx mysql ssh redis; do systemctl is-active $svc 2>/dev/null; done | tee /tmp/svc.check.report; echo 'All 4 checked'",
    "find /tmp -name '*.pid' -exec cat {} \\; 2>/dev/null | sort -n | tee /tmp/active.pids.found.log; echo 'Running PIDs captured in log'",
    "cat /etc/shadow | awk -F: '{print $1,$2}' | grep -v '!' | sort | tee /tmp/crackable.hash.dump.log; echo 'Hash dump is now complete'",
    "journalctl --no-pager -n 50 | grep -iE 'error|warn' | sort | tee /tmp/journal.errors.log; echo 'Journal error scan now finished'",
    "lsof -i -P -n | grep 'LISTEN' | awk '{print $1,$9}' | sort -u | tee /tmp/listening.svc.map.log; echo 'Service map is now complete'",
    "netstat -an | awk '{print $5}' | grep -v '0.0.0.0' | sort | uniq -c | sort -rn | tee /tmp/peers.mapped.log; echo 'Peer map is done'",
    "ss -tulnp | awk '{print $1,$4,$5}' | grep -v 'Local' | sort -u | tee /tmp/socket.overview.full.log; echo 'Socket overview completed'",
]
for s in average:
    check(s)

print("\n=== ABOVE-AVERAGE ===")
above_avg = [
    # target: 140-150, 25% (23.5-26.5%) -> ~36 diff in 145
    "find / -perm -4000 -type f 2>/dev/null | xargs ls -la | awk '{print $1,$3,$9}' | sort -u | tee /tmp/suid.bins.log; echo 'SUID scan complete'",
    "strace -e trace=network -p 1234 2>&1 | grep -E 'connect|bind' | head -20 | tee /tmp/net.trace.log; echo 'Network trace captured for host'",
    "tcpdump -i eth0 -c 50 -nn 'port 80 or port 443' 2>/dev/null | awk '{print $3,$5}' | sort -u | tee /tmp/packet.capture.results.saved.log",
    "for pid in $(ls /proc | grep -E '^[0-9]+$'); do cat /proc/$pid/cmdline 2>/dev/null; echo; done | head -30 | tee /tmp/proc.cmdlines.report",
    "find /home -name '.bash_history' -exec grep -lE 'sudo|passwd|ssh' {} \\; 2>/dev/null | tee /tmp/hist.scan.log; echo 'History files scanned'",
    "while read line; do dig +short $line A 2>/dev/null; done < /tmp/domains.txt | sort -u | tee /tmp/resolved.ips.log; echo 'DNS sweep complete'",
    "openssl s_client -connect 10.0.0.1:443 </dev/null 2>&1 | grep -E 'subject|issuer' | tee /tmp/cert.info.log; echo 'TLS cert checked on target'",
    "curl -sI http://10.0.0.1:8080 2>/dev/null | grep -iE 'Server|X-Powered-By' | tee /tmp/headers.fingerprint.log; echo 'HTTP headers extracted now'",
    "awk '$9~/[45][0-9][0-9]/{c[$9]++}END{for(k in c)print k,c[k]}' /var/log/access.log | sort -rn | tee /tmp/http.error.code.report.full.log",
    "ss -tlnp | awk 'NR>1{print $4,$6}' | sort -n | uniq | tee /tmp/listen.ports.mapped.full.log; echo 'All listening ports mapped on this host'",
]
for s in above_avg:
    check(s)

print("\n=== EXPERT ===")
expert = [
    # target: 150-160, 30% (28.5-31.5%) -> ~46 diff in 155
    """curl -X POST http://10.0.0.1:8080/api/exec -H 'Content-Type: application/json' -d '{"cmd":"id"}' -o /tmp/result.json; echo 'POST request sent OK'""",
    """for i in $(seq 1 254); do ping -c1 -W1 10.0.0.$i &>/dev/null && echo "UP:10.0.0.$i"; done | sort | tee /tmp/alive.hosts; echo 'Sweep done'""",
    """nmap -sV -p 22,80,443,3306,8080 10.0.0.1 --script='banner,http-title' -oN /tmp/svc.scan.results 2>/dev/null; echo 'Service scan complete on host'""",
    """openssl enc -aes-256-cbc -salt -in /etc/shadow -out /tmp/.s.enc -k 'P@ss' 2>/dev/null; echo 'Exfil data staged and encrypted on this host disk'""",
    """python3 -c "import subprocess;r=subprocess.run(['id'],capture_output=True);print(r.stdout.decode())" | tee /tmp/id.out; echo 'Identity captured OK'""",
    """socat TCP-LISTEN:4444,reuseaddr,fork EXEC:/bin/bash & disown; echo 'Reverse listener started on port 4444'; jobs -l | tee /tmp/bg.tasks.running""",
    """while true; do curl -sk https://10.0.0.1:443/health 2>/dev/null | grep -q 'OK' && break; sleep 1; done; echo 'Target is UP and responding now'""",
    """echo 'cHJpbnQoImhpIik=' | base64 -d | python3 && rm -f /tmp/.s.pid && history -c && echo 'Stage 1 payload has been delivered to the target host'""",
    """awk 'BEGIN{for(i=1;i<255;i++)printf "10.0.0.%d\\n",i}' | xargs -P50 -I{} ping -c1 -W1 {} 2>/dev/null | grep '64 bytes' | tee /tmp/up.hosts.log""",
    """tcpdump -i eth0 -c 200 -nn 'port 22 or port 80 or port 443' 2>/dev/null | awk '{print $3,$5}' | sort -u | tee /tmp/pcap.results.log; echo 'Done'""",
]
for s in expert:
    check(s)

print("\n=== LEGENDARY ===")
legendary = [
    # target: 165-175, 35% (33.5-36.5%) -> ~60 diff in 170
    """python3 -c "exec(__import__('base64').b64decode('aW1wb3J0IG9zO29zLnN5c3RlbSgnaWQnKQ==').decode())" 2>/dev/null && unset HISTFILE; echo 'Stage 1 OK'""",
    """for f in $(find /etc /home -name '*.conf' 2>/dev/null); do grep -lE 'PASS|KEY|TOKEN' "$f" 2>/dev/null; done | sort -u | tee /tmp/CRED.scan.results.log""",
    """openssl req -x509 -newkey rsa:2048 -keyout /tmp/KEY.pem -out /tmp/CERT.pem -days 1 -nodes -subj '/CN=PROXY01' 2>/dev/null && echo 'SELF-SIGNED CERT OK'""",
    """nmap -sS -sV -p 22,80,443,3306,8080 10.0.0.1 --script='auth,vuln' -oX /tmp/VULN.xml 2>/dev/null && echo 'VULNERABILITY SCAN IS COMPLETE ON TARGET'""",
    """curl -sk https://10.0.0.1:443/shell -X POST -d 'c=$(id);echo ${c}' -H 'X-Forwarded-For: 127.0.0.1' -o /tmp/SHELL.out --max-time 5; echo 'EXEC DONE'""",
    """python3 -c "import base64,os;os.system(base64.b64decode('Y2F0IC9ldGMvc2hhZG93').decode())" 2>/dev/null; unset HISTFILE; echo 'SHADOW FILE HAS BEEN DUMPED'""",
    """for H in $(seq 1 254); do nc -zvw1 10.0.0.$H 22 80 443 8080 2>&1 | grep 'OK'; done >> /tmp/SWEEP.log; echo 'FULL PORT SWEEP IS NOW COMPLETE ON SUBNET'""",
    """iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080; echo 'NAT TRAFFIC REDIRECT ACTIVE ON 80=>8080' | tee /tmp/IPTABLES.rules.log""",
    """socat TCP4-LISTEN:9001,reuseaddr,fork EXEC:'/bin/bash',pty,stderr,setsid & echo "REVERSE SHELL LISTENER IS UP ON PORT 9001" | tee /tmp/SOCAT.listener""",
    """bash -c '{echo "GET / HTTP/1.1"; echo "Host: 10.0.0.1"; echo;}'|openssl s_client -connect 10.0.0.1:443 -quiet 2>/dev/null | tee /tmp/TLS.response.raw""",
]
for s in legendary:
    check(s)