Security Lab Catalog and Requirements Traceability
The track contains 58 runnable core labs (including five advanced, intensive labs: HTTP request smuggling, the seccomp-BPF compiler, the coverage-guided fuzzer, the lethal-trifecta agent guard, and the Windows token-escalation analyzer). Labs use Python, C, C++, Rust, Go, Java, Kotlin/JNI, IaC, policy, and configuration where each is appropriate. Every core has learner work, a reference, adversarial verification through pytest or the native toolchain, and a platform extension. Larger phase exercises compose these cores rather than duplicating policy logic in throwaway scripts.
Phase 00 - Safety and Lab Operations
| Lab | Core attack/failure cases | Infrastructure extension |
|---|---|---|
| Engagement Guard | adjacent asset, prohibited technique, expired window, excessive rate/data, safety stop, evidence tamper | wrap local assessment commands and require a signed ROE policy |
| Range Containment | missing telemetry, attacker-to-management, victim-to-LAN/internet, OT egress | implement equivalent VM/firewall rules and prove with pcaps |
| Evidence Redaction | bearer token, email, IP, API-key disclosure | add manifest transformation records and reviewer approval |
Covers isolated range, endpoint inventory inputs, telemetry paths, cloud sandbox policy, ROE, disclosure, evidence handling, and research notebook discipline.
Phase 01 - Systems
| Lab | Core attack/failure cases | Infrastructure extension |
|---|---|---|
| Bounded Parser | truncation, oversized length, duplicate tenant, invalid UTF-8, critical unknown, trailing bytes | port to C and Rust; fuzz under sanitizers |
| Binary Hardening | missing PIE/ASLR, NX, canary, RELRO, signature, W^X | collect real ELF/PE/Mach-O metadata |
| Syscall Policy | forbidden kernel interfaces, unexplained additions, obsolete policy | trace owned Go/Python/Rust/C tools across normal/error paths |
| C Memory Safety | stack overwrite, truncation, integer conversion, trailing bytes, boundary lengths | ASan/UBSan reproduction, hardened release flags, sandbox execution |
| Rust Capability Token | malformed fields, wrong tenant/action, expiry, replay, trailing data | bind to signed capabilities and fuzz parser/state transitions |
Covers vulnerable/fixed C, parsers, fuzzing, ELF/binary analysis, syscall tracing, debugger inputs, secure systems tooling, HTTP-service boundaries, and secret-manager prerequisites.
Phase 02 - Network, Web, Identity, and Crypto
| Lab | Core attack/failure cases | Infrastructure extension |
|---|---|---|
| Tenant Authorization | BOLA, role abuse, cross-tenant access, token mix-up/expiry, service confused deputy | apply matrix to REST, GraphQL, gRPC, and WebSocket fixtures |
| Secure Upload | traversal, unsafe name, oversized/unsupported content, malformed digest | add isolated scanner/transformer and quarantine release workflow |
| OIDC Transaction | state replay, session/issuer/redirect mix-up, expiry | connect to local IdP with PKCE, nonce, refresh, logout, and key rotation |
| Go Webhook Gateway | body/signature mismatch, timestamp and nonce replay, oversized body, SSRF/private IP | put behind mTLS/API gateway and add DNS rebinding tests |
| JVM Deserialization | callback execution during native deserialization, oversized/malformed envelope | migrate to explicit schema and inventory serialization entry points |
| Request Smuggling (advanced) | CL.TE / TE.CL / TE.TE / CL.CL parser desync, TE obfuscation, duplicate Content-Length | model proxy/origin framing policies and prove a uniform strict (RFC 9112) policy removes the differential |
Phase extensions add packet captures, vulnerable/fixed web routes, SAML, SCIM, mTLS, TLS inspection, password recovery, JWT policy, and secrets rotation using the same negative-test model.
Phase 03 - Application Security and SDLC
| Lab | Core attack/failure cases | Infrastructure extension |
|---|---|---|
| Release Gate | reachable high/critical, secret, expired exception, missing SBOM/provenance/signature | wire into CI with seeded scanner fixtures |
| Threat Model Validator | missing asset/actor/boundary/owner/test, duplicate threat, vague verification | generate DFD and 20 abuse cases for Aegis Transit Cloud |
| Provenance Verifier | artifact, source, builder, lockfile, SBOM, signer tampering | sign and verify a local container/package with Sigstore tooling |
Covers threat modeling, design review, checklists, SAST/DAST/SCA/secrets/container/IaC gates, vulnerability workflow, developer training, executive memo, and release approval.
Phase 04 - Android
| Lab | Core attack/failure cases | Infrastructure extension |
|---|---|---|
| Manifest Exposure | exported unprotected component, unconstrained deep link, backup, cleartext, debug, broad URI grant | run against vulnerable/hardened APK variants |
| Deep-Link Validator | untrusted scheme/host/path, duplicate parameters, cross-tenant object, redirect | call through an owned test app and instrumentation suite |
| Mobile Data Policy | clipboard/screenshot/backup leakage, absent Keystore protection, excessive retention, offline high-risk action | implement Kotlin storage and lifecycle controls |
| Kotlin/JNI Boundary | native truncation, signedness, size mismatch, excessive payload, ABI boundary | Android instrumentation plus ASan/UBSan/libFuzzer across supported ABIs |
Phase extensions use JADX/apktool/adb/Frida on the owned app, Binder/AIDL caller validation, WebView fixtures, local proxying/pinning rotation, JNI parser sanitizers, and native fuzzing.
Phase 05 - OS Security
| Lab | Core attack/failure cases | Infrastructure extension |
|---|---|---|
| Service Hardening | privileged identity, writable executable/root, wildcard egress, env secret, missing logs/limits/rollback | collect systemd, Windows service, and launchd profiles |
| Event Normalizer | missing time/identity/process/action, platform schema mismatch | ingest auditd, Sysmon, and macOS unified-log fixtures |
| Privilege Boundary | broad/unneeded/unjustified capabilities, privileges, entitlements | review real owned endpoint service rights |
| Token Escalation (advanced) | SeImpersonate/SeDebug/SeBackup primitives, unquoted service path, writable service binary, integrity-level gating | map a token + service inventory to user -> SYSTEM paths; emit ATT&CK IDs |
Covers Linux LSM/seccomp/eBPF/systemd, Windows ETW/Sysmon/PowerShell/AD/Kerberos, and macOS signing, TCC, Keychain, entitlements, and endpoint telemetry.
Phase 06 - Isolation
| Lab | Core attack/failure cases | Infrastructure extension |
|---|---|---|
| Sandbox Policy | root, host namespaces, runtime socket, broad capability, metadata/wildcard egress, missing limits, no jailer | compile to rootless container, gVisor, and Firecracker launch configs |
| Seccomp Regression | forbidden/unexplained syscalls after upgrade | trace and enforce in a dedicated Linux VM |
| MicroVM Lifecycle | invalid transition, cancellation, resource leak, destroy-before-cleanup | bind state machine to jailer, TAP, cgroup, namespace, socket, and scratch operations |
| seccomp Compiler (advanced) | missing-architecture-check ABI bypass, default-allow, non-semantic pointer-syscall trust, dangerous syscalls | build the number+arch+arg decision; gate on a pinned, default-deny hardening standard |
Covers minimal runtime, namespaces, cgroups, seccomp, capabilities, rootless operation, syscall interception, gVisor comparison, microVM isolation, monitoring, and escape-prevention controls.
Phase 07 - Cloud and Kubernetes
| Lab | Core attack/failure cases | Infrastructure extension |
|---|---|---|
| IAM Attack Paths | wildcard grants, sensitive permission, transitive impersonation, cycles | export normalized bindings from owned AWS/Azure/GCP sandbox |
| Kubernetes Admission | privileged/host pod, hostPath, root, mutable image, missing seccomp/resources | port fixtures to Gatekeeper/Kyverno in kind |
| Control Evidence | stale/missing evidence, absent owner/test, scanner-as-control | map one framework deeply and compare FedRAMP/PCI/HIPAA/SOC 2/ISO |
| AWS Landing Zone | SCP gaps, wildcard/PassRole chain, unsafe trust, IMDSv1, public S3, KMS/log/EKS gaps | deploy in disposable Organizations sandbox and exercise revocation |
| GCP Landing Zone | public sharing, Owner, SA impersonation, weak WIF, VPC SC/log/GKE gaps | validate org policy, private GKE, aggregated logs, and recovery |
| Azure Landing Zone | permanent Owner, broad federation, public Key Vault/Storage, AKS/log gaps | validate management groups, PIM/CA, private endpoints, and recovery |
Phase extensions deploy landing zone, segmentation, workload identity, KMS/secrets, registry signing, logging/detection, cloud IR, Terraform security, and backup/restore.
Phase 08 - Vulnerability Research
| Lab | Core attack/failure cases | Infrastructure extension |
|---|---|---|
| Crash Triage | truncation, zero dimension, checksum, exact length, resource limit | run native sanitizer/libFuzzer version |
| Stateful Protocol Fuzzer | illegal order, duplicate auth, oversized data, post-close message | implement persistent/stateful native harness |
| Patch Variant Analyzer | symptom-only fix, missing test, sibling length/field/parser variants | analyze an authorized open-source patch and report |
| Coverage-Guided Fuzzer (advanced) | coverage-feedback corpus evolution, multi-byte gate, crash dedup by signature, delta minimization, blind-vs-guided ablation | port the loop onto a native libFuzzer/AFL++ target with sanitizers |
Covers parser/image/protocol fuzzing, sanitizers, crash/root cause analysis, reverse engineering, patch diffing, variant review, CTF-style binaries, and responsible disclosure.
The CVE Casebook adds primary-source studies of Heartbleed, Log4Shell, runc isolation failures, and ingress-nginx CVE-2025-1974, each mapped to a safe lab, patch invariant, variant search, fleet response, and detection plan.
Phase 09 - Incident Response and Detection
| Lab | Core attack/failure cases | Infrastructure extension |
|---|---|---|
| Detection Correlation | out-of-order/duplicate/missing event, cross-tenant join, time-window failure | implement Sigma/SIEM query over synthetic logs |
| Forensic Timeline | timezone, skew, confidence, duplicate event, invalid timestamp | add disk/memory/network/cloud evidence IDs |
| Detection Coverage | uncovered technique, unhealthy source, missing owner/runbook/fixtures | add Sigma/YARA/Suricata/Zeek/osquery rule tests |
Covers Windows/Linux/cloud/Kubernetes telemetry, memory/disk/network forensics, benign malware triage, dashboards, timeline, MITRE mapping, incident simulation, executive report, and PIR.
Phase 10 - OT
| Lab | Core attack/failure cases | Infrastructure extension |
|---|---|---|
| Passive Inventory | stale/future observation, address conflict, vendor/firmware disagreement | ingest synthetic Modbus/DNP3/OPC UA captures |
| Zone/Conduit Policy | internet/control path, enterprise bypass, wildcard protocol, unowned write, unjustified safety flow | implement simulated firewall matrix |
| Safety-Aware Response | disruptive action without safety/manual readiness, lost evidence, unverified recovery, absent vendor | run plant tabletop |
Covers simulated ICS network, protocol analysis, passive discovery, segmentation, cloud-connected threat model, vulnerability plan, detections, and safety-aware incident response.
Phase 11 - AI and Agent Security
| Lab | Core attack/failure cases | Infrastructure extension |
|---|---|---|
| Agent Tool Gateway | unknown tool, cross-tenant action, unapproved destination, excessive batch, replay, budget, missing approval | connect read-only scanners and ticket/patch tools |
| RAG Security | ACL/tenant leak, stale/quarantined/untrusted source, injection content | build security-doc RAG with deletion and poisoning evals |
| Approval Ledger | missing actor/request/tenant, time regression, event tamper, broken hash chain | record proposal-policy-approval-capability-execution workflow |
| Trifecta Guard (advanced) | lethal trifecta (private data + untrusted content + egress), indirect injection, tainted high-risk proposal, cross-tenant, defuse-a-leg | add capability tokens, data-flow labels, and a hash-linked audit chain |
Covers code review, vulnerability triage, remediation, cloud posture, logs, threat models, compliance mapping, disclosure drafting, injection defense, least privilege, audit, and evals.
Phase 12 - Staff Practice
| Lab | Core attack/failure cases | Infrastructure extension |
|---|---|---|
| Evidence Linter | missing authorization/threat/tests/remediation/limits/teardown, secret canaries, lab claim inflation | run across final portfolio |
| Finding Quality | unsupported severity, missing evidence/root cause/owner, vague remediation | review final security assessment |
| Roadmap Prioritizer | narrow tool vs shared control, missing owner/metric, effort/adoption tradeoff | build 30/60/90-day and 12-month roadmap |
Covers executive and engineering presentations, VRP readiness, public writing, talk proposal, specialization mock interviews, STAR stories, portfolio curation, and joining plan.
Phase 13 - Hardware, Firmware, and Device Security (Elite/Principal)
| Lab | Core attack/failure cases | Infrastructure extension |
|---|---|---|
| Remote Attestation (advanced) | tampered firmware measurement, replayed/forged quote, untrusted AK, dishonest event log | drive real TPM tpm2_quote/tpm2_checkquote + event-log replay; Keylime |
| Firmware Update Integrity (advanced) | untrusted signer, tampered payload, cross-model flash, downgrade/rollback, commit-on-failure | A/B slots, TUF/Uptane, fwupd/LVFS, hardware monotonic counter |
Covers hardware root of trust, verified vs measured boot, TPM/PCRs, remote attestation, TEEs and confidential computing, firmware/SMM/ME security, secure OTA + anti-rollback, key provisioning/DICE, and the physical/side-channel threat model.
Phase 14 - Software Supply Chain Security (Elite/Principal)
| Lab | Core attack/failure cases | Infrastructure extension |
|---|---|---|
| SLSA Provenance (advanced) | injected/unlocked material, swapped digest, missing material, untrusted builder, below-required SLSA level | cosign verify-attestation, SLSA generator, Kyverno/policy-controller admission |
| Transparency Log (advanced) | forged signed tree head, untrusted log, tampered audit path, not-included entry, second-preimage | Rekor inclusion/consistency proofs, Certificate Transparency monitoring |
Covers the source-to-consumer threat model, in-toto provenance + materials reconciliation, SLSA levels, hermetic/reproducible builds, keyless signing + Merkle transparency logs, binary authorization, dependency confusion/typosquat/hijack defenses, and SBOM/VEX.
Phase 15 - Compliance and Authorization Engineering (Elite/Principal)
| Lab | Core attack/failure cases | Infrastructure extension |
|---|---|---|
| Control & Authorization Readiness (advanced) | unaddressed control, unsubstantiated inheritance, missing evidence, gap-without-POA&M, overdue POA&M, baseline nesting | express as OSCAL, import provider CRM, automate evidence freshness |
| Continuous Monitoring / POA&M (advanced) | stale/missing scan, overdue by severity (30/90/180), expired/absent deviation, vendor-scope separation | ingest scan output, OSCAL assessment-results, POA&M aging report |
Covers NIST 800-53 families/baselines, the FedRAMP ATO process, the authorization boundary and control inheritance, OSCAL/compliance-as-code, continuous monitoring + POA&M SLAs, FIPS 140-3 validated crypto, and the PCI/HIPAA/SOC 2/ISO/CMMC crosswalk.