DEFENSIVE CYBER RANGE 12 Operational Modules Active
Interactive Cybersecurity Labs
Investigate simulated cybersecurity incidents within deterministic, air-gapped training environments. Execute simulated terminal investigations, analyze cryptographic evidence and telemetry, complete incident triage challenges, and receive instant scored debriefs.
Endpoint DefenseFREE
3 DIFFICULTIESReal-Time File Integrity Monitor (FIM)
Detect unauthorized filesystem modifications, compare cryptographic baseline SHA-256 hashes, and analyze tamper events in an isolated host sandbox.
Learning Objectives✓Understand cryptographic file hashing (SHA-256) vs filesystem timestamps
✓Investigate unauthorized PAM and configuration changes
✓Distinguish authorized administrative updates from adversary backdoors
sha256sumdiff -uls -latouch -r
Security OperationsPRO
3 DIFFICULTIESMini-SIEM & Log Correlation Engine
Ingest authentication logs, correlate suspicious brute-force attempts and privilege escalations, and fire defensive alerting rules.
Learning Objectives✓Analyze Linux syslog and authentication event streams
✓Formulate event correlation rules for distributed brute-force attacks
✓Triage security incident severities with precision
grepawkwc -ltail -n
DevSecOpsPRO
3 DIFFICULTIESGit Secrets & Credential Scanner
Scan code repositories and commit histories for leaked AWS API keys, private certificates, and credentials using regex and Shannon entropy calculation.
Learning Objectives✓Identify high-entropy strings and secret token formats
✓Differentiate true secrets from synthetic placeholders and UUIDs
✓Implement automated pre-commit hook scanning workflows
git log -pgit diffentropy-calctrufflehog-sim
Network ForensicsPRO
3 DIFFICULTIESLayer 3/4 Packet Dissector
Inspect PCAP captures, dissect IPv4 headers and TCP/UDP flags, reconstruct network flows, and identify suspicious port scans and DNS tunneling.
Learning Objectives✓Dissect IPv4 header TTL, checksum, and fragmentation fields
✓Analyze TCP 3-way handshake, SYN scans, and RST teardowns
✓Reconstruct layer 4 stream payloads from captured frames
tcpdump -rtsharkflow-dissecthex-dump
Deception & TelemetryPRO
3 DIFFICULTIESInteractive Network Service Decoy
Deploy deterministic SSH and HTTP honeypot decoys, inspect adversary commands in real time, and gather threat intelligence without risk to production.
Learning Objectives✓Understand deception technology and low-interaction honeypots
✓Capture adversary credential stuffing and web vulnerability probes
✓Formulate containment recommendations based on attacker behavior
honeypot-tailcurl -Issh-simthreat-intel
CryptographyPRO
3 DIFFICULTIESCryptographic Secret Vault CLI
Investigate authenticated symmetric encryption (AES-256-GCM), key derivation via PBKDF2 with SHA-256, and tamper-resistant encrypted storage mechanisms.
Learning Objectives✓Apply password-based key derivation functions (PBKDF2) with random salts
✓Verify AES-256-GCM authenticated encryption and authentication tags
✓Audit cryptographic secret vaults against ciphertext tampering
vault initvault setvault getvault lock
Host SecurityPRO
3 DIFFICULTIESLinux Privilege Escalation Auditor
Inspect Linux SUID/SGID binaries, world-writable cron jobs, capabilities (cap_setuid), and GTFOBins vectors in an isolated host audit sandbox.
Learning Objectives✓Audit SUID binaries and GTFOBins relative path execution risks
✓Inspect /etc/cron.d/ scheduled tasks for world-writable scripts
✓Enforce least-privilege host permissions via chmod and setcap
audit suidaudit cronaudit capabilitiesaudit inspect
Web SecurityPRO
3 DIFFICULTIESWeb Application Firewall Rule Engine
Inspect HTTP request streams, match SQL injection, XSS, and path traversal signatures, and formulate precision WAF rules with zero false positives.
Learning Objectives✓Analyze HTTP payload structures for SQLi (' OR 1=1 --) and XSS (<script>)
✓Tune regex WAF blocking policies without impacting benign queries
✓Evaluate WAF false positive ratios and mitigation accuracy
waf logswaf inspect <id>waf ruleswaf block
Container SecurityPRO
3 DIFFICULTIESContainer Isolation & Docker Daemon Auditor
Audit Docker container isolation boundaries, detect dangerous host daemon socket mounts (/var/run/docker.sock), privileged containers, and capabilities.
Learning Objectives✓Inspect container volume bindings for host socket exposure
✓Identify privileged mode flags (--privileged=true) and device leaks
✓Enforce CIS Docker Benchmark hardening and non-root execution
container pscontainer inspect <id>container mountscontainer harden
API SecurityPRO
3 DIFFICULTIESAPI Security & JWT Token Inspector
Deconstruct JSON Web Tokens, cryptographically verify HMAC-SHA256 signatures, reject alg: none attacks, and audit weak secret passphrases.
Learning Objectives✓Understand JWT Header, Payload, and Signature components
✓Mathematically verify HMAC-SHA256 signatures vs Base64URL claims
✓Enforce gateway rejection of alg: none bypasses and brute-force weak secrets
jwt listjwt inspect <id>jwt verify <id>jwt crack <id>
Network SecurityPRO
3 DIFFICULTIESDNS Tunneling & C2 Beacon Detector
Analyze DNS query telemetry, compute Shannon entropy across subdomain labels, detect 30s C2 heartbeat beacons, and configure DNS RPZ sinkholes.
Learning Objectives✓Calculate Shannon entropy to distinguish Base32/Base64 tunnels from human lookups
✓Measure inter-arrival timing jitter to isolate automated C2 beacons
✓Implement Response Policy Zone (RPZ) sinkholing for threat containment
dns logsdns analyzedns entropydns beacon
Firmware SecurityPRO
3 DIFFICULTIESIoT Firmware Deconstructor & Secret Extractor
Deconstruct embedded IoT firmware images, extract SquashFS partitions, locate hardcoded RSA private keys, and audit unauthenticated debug backdoors.
Learning Objectives✓Analyze binary partition layouts and extract SquashFS filesystem hierarchies
✓Locate static TLS private keys and root shadow password hashes
✓Identify unauthenticated debug services (/etc/init.d/rc.debug telnetd)
firmware partitionsfirmware extractfirmware secretsfirmware services
