Pick a phase and start. Each lab boots its own simulated hosts, tooling and reporting flow.
Enumerate a customer's public perimeter from an approved scan window, chain a stale service to a foothold, and file the first finding with CVSS and remediation before you touch anything else.
Use the /pentest/attack-graph view to spot the shortest path from a helpdesk account to Domain Admin, walk it end-to-end with the simulated Kerberoast/DCSync tools, and file the delegation finding.
Assess a storefront with the Burp-lite workbench at /pentest/proxy: repeat a login, fuzz an id parameter, catch an IDOR and a stored XSS, and file each finding under its OWASP Top 10 category.
Given an access key with s3:GetObject only, walk a chain of over-permissive roles and trust policies to end up in a shell on a build server. File the trust-policy finding — the fix is one JSON edit.
Play both seats. Fire five ATT&CK techniques from the C2 console, check the SIEM after each one, and file a detection-gap finding for the two that produced nothing. Score is the ratio of techniques with a signal.
Sit in an authorized coffee-shop parking lot, sweep the 2.4/5 GHz bands, capture the guest-WPA2 handshake, crack it against a scoped wordlist, then file a rotation-and-802.1X finding on the corporate SSID.
Clone the customer's SSO portal, send a hundred lures against a pre-agreed roster, watch clicks and credentials land in the C2, and file a template-plus-training finding without ever holding a real password.
On an authorized workstation, land a payload past an EDR that is watching AMSI, ETW and the usual hooked syscalls. Every step files an evidence line and a matching detection ask, so the report reads as both an attack write-up and a purple-team gap register.
Stand up a small beacon fleet in the /pentest/c2 console, run it over jittered HTTPS and a DNS fallback, stage a compressed collection and file the tunnel-and-egress finding — beacon fingerprints, jitter, callback cadence, all in the report.
Emulate a named ransomware crew end-to-end against the simulated estate: scheduled-task persistence, token-theft privilege escalation, WinRM lateral hop, benign fixture-swap impact, then hand the recovery team a per-stage detection-gap table linked to the RAN track.
CYBRARY