All labs

This one came out of a recent audit. We found a host everyone had written off as decommissioned, still quietly answering on a few ports and still running software nobody had touched in years. It gave up far more than it should have to anyone who bothered to ask it the right questions, and a credential left lying in the open did the rest. The box stuck with us, so we rebuilt the idea into a room.

A server was “remediated” after a supply-chain breach. The team rotated the keys, ran the checklist, and called it done. But maybe It wasn’t. The box still runs the exact same configuration it did on the day of the incident. Trace what was left behind, recover what shouldn’t be recoverable, and prove the door was never actually closed.

Map networks and enumerate services with Nmap, from first ping to full attack surface.

Scan at speed with Rustscan and pivot straight into deeper enumeration.

Walk a real CVE (Superset auth bypass) from discovery to a working exploit.

Find and exploit SQL injection with SQLmap, from detection to full database dump.

Put an adapter in monitor mode, capture traffic and break WPA2 step by step.

Smash your first stack: control flow, saved return addresses and landing a shell.