Offensive Lab 02 — Network Attack-Path / Pivot Planner

Lens: Lateral movement as graph reachability. WARMUP: Chapters 6–7.

The problem

One foothold is rarely the goal. Lateral movement spreads from the compromised host to the crown jewels (the domain controller, the database, the backup server) over a graph whose nodes are hosts/identities and whose edges are "can move from A to B" (network reachability, a shared credential, an admin session, a trust). The attacker runs a breadth-first search from the foothold; the defender runs the same search to find the choke point — the node that, if cut, disconnects the foothold from a target. (BloodHound for offense and attack-path analysis for defense are the same algorithm.)

What you build (lab.py)

  • reachable(edges, start, exclude=None) — BFS reachable set, optionally removing a node.
  • reaches / reachable_targets — what crown jewels the attacker reaches from a foothold.
  • shortest_path(edges, start, target) — deterministic BFS attack path.
  • choke_points(edges, start, targets) — the nodes whose removal disconnects the foothold from a currently-reachable target: the highest-leverage defensive cuts.

Attack cases the tests cover

  • From a workstation foothold, the attacker reaches the file server, jump host, DC, and backup (but not a disconnected island).
  • The DC has two paths (via the file server and the jump host) → no single choke; the backup is reachable only via the jump host → jumphost is the choke point.
  • Removing the jump host cuts the backup but leaves the DC reachable (second path).
  • A linear a→b→c chain makes b the choke point.
  • Deterministic shortest paths; excluding the start yields an empty reachable set.

Run

pip install -r requirements.txt
LAB_MODULE=solution pytest -q
pytest -q

Hardening / extensions

  • Weight edges by attacker cost (a cracked Kerberos ticket vs. a clear-text admin session) and find the cheapest path, not just the shortest.
  • Model credential nodes explicitly so a shared local-admin password becomes a visible choke point (the argument for Windows LAPS).
  • Compute true dominators (every path passes through) and rank choke points by how many targets they cut.
  • Import a real BloodHound/Azure graph export (authorized environments only).

Interview / resume

"Built an attack-path planner that models lateral movement as reachability over a host/credential graph — computing reachable crown jewels from a foothold and the choke points a defender cuts — demonstrating that BloodHound (offense) and attack-path analysis (defense) are one algorithm, and why segmentation and unique local-admin passwords are the highest-leverage controls."

Limitations: unweighted directed graph; choke points found by node-removal (not full dominator analysis); synthetic graph only.