Cybersecurity Lab Library

Open ports tell you a port number; banners tell you the software. Use Netcat to connect to each service on the target and read what it announces about itself.

Map a target's DNS footprint. Use dig and dnsrecon to enumerate records and find a forgotten subdomain, then read the registration details with whois.

Fingerprint a web server's exact version, then use searchsploit to find the matching public exploit and its Exploit-DB id.

Before you scan ports, you map the network. Find every live host on the lab LAN with arp-scan, confirm one is reachable, and run a no-port ping sweep with Nmap.

You recovered a hash dump. Identify the algorithm with hashid, then crack it with hashcat against a wordlist.

A suspicious executable was quarantined from an endpoint. Pull its readable strings to find hardcoded indicators, then classify it with YARA and ClamAV.

A suspicious image was pulled from a phishing email. Examine its metadata, hunt for embedded files, and extract the hidden payload.

A single target sits on the lab network. Map its services, recover a weak credential, get a shell and read the flag — all in a browser Kali shell.

SupportBot is an LLM assistant with a hidden system prompt containing a confidential token. Use direct prompt injection to override its instructions and leak the token. Maps to OWASP LLM01: Prompt Injection.

A packet capture from a suspicious workstation is on disk. Read it with tcpdump, spot where the host is calling out, and recover the token it leaked in cleartext.

A misconfigured file server allows a null session. Enumerate its shares with enum4linux and smbmap, then read loot from the world-writable share.

Fingerprint a web server, brute force its directories, and read what a vulnerability scanner reports. Everything targets a site hosted inside this lab.

You recovered one credential. Spray it across the domain's hosts with NetExec, find where it is valid, and identify the host where it grants admin (Pwn3d!).

OpsAgent is an LLM agent wired to real tools, including one that can send email. It has no approval step before dangerous actions. Trick it into calling the send_email tool to exfiltrate a secret. Maps to OWASP LLM06: Excessive Agency.

You already have a low-privilege shell on a host. Enumerate your sudo rights and turn a misconfigured rule into a root shell, then read the root flag.

Triage a memory image from an infected Windows host with Volatility 3. List processes, spot the rogue one, and follow its network connection to the C2 server.

A Windows server allows a null session. Enumerate its shares, crack the administrator hash you dumped earlier, and validate the credential across the host with NetExec.

A product page passes an id straight into a query. Confirm the injection with sqlmap, enumerate the databases, and dump the users table to recover the flag.

A capture from a compromised host is on disk. Use tshark to review the protocol mix and follow the traffic to the credentials an attacker sniffed in cleartext.

A marketing site runs WordPress. Enumerate its version, plugins and users with WPScan, then identify the vulnerable plugin and a valid author.