Lab Summary Top

Summaries of Labtainer Exercises

The following labs are packaged within the Labtainer distribution.  Many of these are derived from the SEED labs from Syracuse University. There is no separate download step required for any of the labs.  Whenever they are run the first time, the framework automatically downloads whatever is needed from the Docker Hub.  Labs are organized into the following categories:

Software Vulnerabilities

 Software Vulnerabilities

 
Lab Description difficulty
bufoverflow An example program vulnerable to a stack buffer overflow, derived from a SEED lab. 3
formatstring Explore C library printf function vulnerabilities, derived from a SEED lab. 2
retlibc  Exploit a program using a buffer overflow and return-to-libc, derived from a SEED lab. 3
gdblesson An introduction to using gdb to debug a simple C program. 1
metasploit Use metasploit on a Kali Linux system to attack a "metasploitable" host. 1
setuid-env Risks of the setuid feature, including environment variables, derived from a SEED lab. 2
ghidra Reverse engineer a simple vulnerable service to discover and demonstrate some of its properties. 2
Networking Labs

Networking 

 
Lab Description difficulty
telnetlab The student uses telnet to access a remote computer, and employs the tcpdump tool to view plaintext passwords, and to observe how use of ssh mitigates that vulnerability.  1 
nmap-discovery The nmap utility is used to locate an ssh server on a network and to discover the port number being used by the service. 2
nmap-ssh The nmap utility is utilized in combination with the tshark network traffic analysis utility to demonstrate a security problem with an ssh server. 2
routing-basics A simple routing example with two LANs and an internet connection via NAT 2
iptables The iptables utility is used to configure a “firewall” component to only forward selected application service traffic between a client and a server. 2
tcpip TCP/IP protocol vulnerabilities, including SYN flooding, RST attacks and session hijacking.  Derived from the SEED lab. 2
arp-spoof Use of ARP spoofing for Man-in-the-middle attacks. 2
local-dns DNS spoofing and cache poisoning on a local area network.  Derived from the SEED lab. 3
snort Use of snort for network intrusion detection 2
dmz-lab Set up a DMZ for an enterprise. 2
radius Use a Radius authentication service to authenticate network devices. 2
ldap Authenticate users of Linux servers using an LDAP service. 2
Also see crypto labs, e.g., ssh, vpn and ssl labs.  And Network Traffic Analysis  below.
Crypto Labs

Crypto Labs 

 
Lab Description difficulty
macs-hash Exploration of cryptographic hashes and the potential for hash collisions. 2
onewayhash  Introduction to generating cryptographic hashes using the openssl utility. 1
pubkey

Explore public key certificates from a variety of web sites

 1
sshlab

Use of a public/private key pair to access a server via ssh.

 1
ssh-agent Use an SSH agent to manage your private key and avoid retyping your passphase 1
ssl Use of SSL to authenticate both sides of a connection, includes creating and signing certificates using a CA.  
symkeylab

 Exploration of symmetric key encryption modes.

 1
vpnlab

 Example use of OpenVPN to protect network traffic.

 2
vpnlab2  Similar to vpnlab, but with the use of a vpn gateway. 2
Web Security Labs

Web Security Labs 

 
Lab Description difficulty
webtrack Illustrates web tracking techniques and the role of ad servers 1
xforge  Cross Site Request Forgery with a vulnerable web site 2
xsite

 Cross site scripting attacks on a vulnerable web server.

 2
sql-inject  SQL injection attacks and countermeasures. 2
System Security & Operations

System Security & Operations

 
Lab Description difficulty
acl Acess Control Lists (ACLs) on Linux 2
backups2 Using tar and dump/restore for file backups, including remote backups. 1
capabilities Use of Linux capabilites to limit program privileges. 2
sys-log System log basic usage and configuration on an Ubuntu system. 2
centos-log2  System log basic usage and configuration on a CentOS system. 2
file-deletion Data recovery from deleted files within EXT2 and NTFS file systems. 2
file-integrity File integrity checking and intrustion detetion with AIDE 2
pass-crack  Introduction to passwords and elementary cracking schemes. 2
denyhost Use of the denyhost utility to block brute force attacks on SSH 2
nix-commands Introduction to Linux and shell commands. 1
Industrial Control System Security

Industrial Control System Security 

 
Lab Description difficulty
softplc Program a software-based programmable logic controller (PLC) 3
plc-forensics  Forensic analysis of a PLC session from a rouge client. 2
plc-forensics-adv Forensic analysis of a PLC session from a rouge client, including CIP & EtherNet/IP protocols. 4
plc Simulated example of a vulnerable Programmable Logic Controller system. 2
plc-app Application firewall and whitelisting to protect a PLC. 2
iptables-ics Use iptables to limit traffic destined for a PLC through a firewall. 2
grassmarlin Introduction to the GrassMarlin SCADA/ICS network discovery tool. 2
plc-traffic Use the GrassMarlin tool to view traffic you generate interacting with a PLC. 2
Also see the ssl; radius and ldap labs for authentication of devices and people.
Miscellaneous

Miscellaneous

Lab Description
cyberciege The CyberCIEGE video game.
quantum Explores quantum algorithms: (1) teleportation; and, (2) Grover's algorithm.

 

This work was supported by NSF grant DUE-1438893. The views expressed in this material are those of the authors and do not reflect the official policy or position of the National Science Foundation, the Naval Postgraduate School, the Department of Defense, or the U.S. Government.