Original AYSEC-house-style labs you can host locally.
Original lab exercises designed for AYSEC. Each lab is hostable on the AYSEC platform without licensing concerns. Format: brief brief + setup + tasks + flag-style validation.
Use these in addition to (not instead of) the external platform mappings. They give AYSEC its own "house style" challenges.
Foundations (Labs 1–5)
Pentest (Labs 6–15)
SOC / Blue (Labs 16–22)
DFIR (Labs 23–28)
Cloud (Labs 29–34)
AppSec (Labs 35–42)
Specialty (Labs 43–46)
Capstone (Labs 47–50)
Difficulty: Beginner.
Track: AYSEC-000 M02.
Setup: SSH server with 10 users (level0 … level9). Each user's home contains a password.txt readable only after solving a small puzzle (e.g., decoding base64, finding a file by extension, reading via find -exec).
Tasks: Progress from level0 to level9. Each level's password unlocks the next SSH login.
Validation: Solve all 10. Submit the level9 password as the flag.
Difficulty: Beginner.
Track: AYSEC-000 M01.
Setup: A Wireshark PCAP with 2,000 packets including DNS, HTTP, ICMP, and a covert channel.
Tasks: (a) How many distinct private IPs sent traffic? (b) What is the canonical IP for internal.aysec.local per the PCAP? (c) The PCAP contains an exfil over DNS — what string is being smuggled?
Validation: Three answers; concatenate to form a flag.
Difficulty: Beginner. Track: AYSEC-000 M04. Setup: A list of 1000 URLs. Some are alive, some not. Some return tokens. Tasks: Build a Python script that probes each URL, reports status, and extracts any token in the response. Submit the cumulative token. Validation: Token regex matches a known SHA-256.
Difficulty: Beginner. Track: AYSEC-000 M03. Setup: A snapshot of a Windows registry with planted artifacts. Tasks: Identify (a) the username with the most-recent UserAssist entry, (b) the most-recent USB device serial, (c) the most-recently installed program. Validation: Three answers concatenated.
Difficulty: Beginner. Track: AYSEC-000 M05. Setup: A short fictitious incident write-up. Tasks: Classify each described impact against the CIA triad and propose the most-relevant defense. Validation: Multi-choice scoring.
Difficulty: Beginner.
Track: AYSEC-101 M03.
Setup: A small network of 5 VMs on 10.10.10.0/24.
Tasks: (a) Identify all live hosts. (b) For each, list open TCP ports + service banners. (c) Find the host running an outdated Apache 2.4.49 — submit its IP as the flag.
Difficulty: Intermediate.
Track: AYSEC-101 M02.
Setup: A fictitious organization (acme-saas.local) with a mock mail server, web app, GitHub org.
Tasks: Without active scanning of the corporate network, enumerate (a) 10 subdomains, (b) the email format, (c) one leaked secret in the GitHub mirror.
Validation: Submit the secret; matches a planted token.
Difficulty: Beginner.
Track: AYSEC-101 M05.
Setup: A login form vulnerable to SQL injection via the username field.
Tasks: Bypass authentication; obtain admin's session.
Validation: Visit /admin/secret while logged in as admin.
Difficulty: Intermediate.
Track: AYSEC-101 M07.
Setup: Windows 7 SP1 VM unpatched against MS17-010 on the lab network.
Tasks: Identify the vulnerability with Nmap. Exploit via Metasploit. Capture C:\flag.txt.
Difficulty: Intermediate. Track: AYSEC-101 M08. Setup: A custom Vulnserver-style binary on Windows; no DEP/ASLR. TCP listener on port 9999. Tasks: Discover crash, find offset, identify bad chars, find a JMP ESP, place shellcode, get reverse shell.
Difficulty: Beginner.
Track: AYSEC-101 M09.
Setup: Linux VM with level1 user; exploit a sudo NOPASSWD on a benign-looking utility (e.g. find).
Tasks: Become root.
Difficulty: Intermediate. Track: AYSEC-101 M10. Setup: Windows 10 VM with a vulnerable service whose binary is in a writable directory. Tasks: Replace the service binary; trigger restart; SYSTEM shell.
Difficulty: Intermediate. Track: AYSEC-101 M11. Setup: Mini AD with one Kerberoastable service account using a weak password. Tasks: Enumerate SPNs; request ticket; crack offline; impersonate.
Difficulty: Advanced.
Track: AYSEC-101 M12.
Setup: 3-host AD lab with a path: regular user → ACL abuse → workstation admin → DCSync.
Tasks: Reach Domain Admin; submit krbtgt hash.
Difficulty: Intermediate. Track: AYSEC-101 M13. Setup: 3-network lab. Initial Kali reaches Network A. Pivot host on Network B; victim on Network C. Tasks: Use chisel/ligolo-ng to reach C and exploit.
Difficulty: Beginner.
Track: AYSEC-102 M09.
Setup: 5 phishing emails (real but de-fanged) in .eml.
Tasks: For each: (a) verdict (phishing? generic spam? legit?), (b) IOCs to block, (c) impact assessment.
Difficulty: Intermediate. Track: AYSEC-102 M03. Setup: Indexed Splunk environment with simulated 7-day logs incl. one intrusion. Tasks: Identify (a) initial access vector, (b) lateral-movement target, (c) exfil destination.
Difficulty: Intermediate. Track: AYSEC-102 M07. Setup: Provided ATT&CK-mapped technique list + access to a Sysmon-instrumented endpoint. Tasks: Write 5 Sigma rules covering specific techniques. Validate each against an Atomic Red Team test.
Difficulty: Intermediate. Track: AYSEC-102 M04. Setup: Free Sentinel workspace with Azure Activity + simulated alert events. Tasks: Build 3 KQL detections from given hypotheses. Promote one from Hunting to Analytics.
Difficulty: Intermediate. Track: AYSEC-102 M05. Setup: A Zeek/Wireshark capture with an embedded TLS-tunneled C2 + an HTTP exfil. Tasks: Identify (a) the C2 domain, (b) JA3 fingerprint, (c) bytes exfil'd over HTTP.
Difficulty: Intermediate. Track: AYSEC-102 M06. Setup: Sysmon EVTX bundle on a host where a defender ran 5 Atomic Red Team tests. Tasks: Identify each ATT&CK technique used.
Difficulty: Intermediate. Track: AYSEC-102 M11. Setup: A written ransomware scenario with stakeholder roles. Tasks: Deliver decisions for each scenario step. Self-grade against a rubric.
Difficulty: Intermediate. Track: AYSEC-103 M02. Setup: An $MFT extracted from a Windows host with planted timestomping + recently-deleted file. Tasks: (a) Find the timestomped file. (b) Find the deleted file's name + recent path.
Difficulty: Intermediate. Track: AYSEC-103 M03. Setup: Hives extracted from a compromised host. Persistence in IFEO. Tasks: Identify the IFEO Debugger persistence + the program it hijacks.
Difficulty: Intermediate. Track: AYSEC-103 M04. Setup: Security + Sysmon EVTXs from a compromised host. Tasks: Reconstruct a 7-step attacker timeline; identify lateral movement target.
Difficulty: Advanced.
Track: AYSEC-103 M07.
Setup: A .mem snapshot containing a process injection scenario.
Tasks: With Volatility, find the injected process and the C2 destination.
Difficulty: Advanced. Track: AYSEC-103 M09. Setup: Disk image of a compromised Linux server. Tasks: Build a super-timeline with Plaso. Identify patient-zero file modification.
Difficulty: Advanced. Track: AYSEC-103 M11. Setup: UAL + Sign-in logs from a 30-day window with a BEC. Tasks: Identify the compromised user, OAuth app abused, mailbox rule planted.
Difficulty: Beginner.
Track: AYSEC-105 M04.
Setup: AWS account with one public S3 bucket containing a planted flag.txt.
Tasks: (a) Find the bucket. (b) Apply the AYSEC hardened-bucket Terraform module. (c) Confirm the flag is no longer publicly accessible.
Difficulty: Intermediate.
Track: AYSEC-105 M02 / 12.
Setup: AWS sandbox with an IAM user whose policy permits iam:CreatePolicyVersion on a custom policy.
Tasks: Use Pacu's iam__privesc_scan. Escalate to admin.
Difficulty: Intermediate. Track: AYSEC-105 M05. Setup: Pre-recorded CloudTrail events + 3 attack patterns. Tasks: Identify each: leaked-key + crypto-mining; new public bucket; new IAM user creation by non-admin.
Difficulty: Intermediate. Track: AYSEC-105 M06. Setup: Azure subscription with simulated Defender alerts. Tasks: Triage 5 alerts; identify which are TPs.
Difficulty: Beginner. Track: AYSEC-105 M08. Setup: A Terraform module with 12 deliberate misconfigurations. Tasks: Run Checkov + tfsec. Fix all High findings.
Difficulty: Advanced. Track: AYSEC-105 M07. Setup: A Kind/k3s cluster with deliberately misconfigured RBAC + a vulnerable pod. Tasks: Run kube-bench + kube-hunter. Tighten RBAC. Apply Pod Security Admission "restricted."
Difficulty: Beginner. Track: AYSEC-106 M02. Setup: A target web app with 5 small bugs (XSS, IDOR, weak auth, CORS, SQLi). Tasks: Find each via Burp Repeater + Intruder. Document one-line proof per bug.
Difficulty: Intermediate. Track: AYSEC-106 M04. Setup: App accepts a JWT signed with a weak HMAC. Tasks: Crack with hashcat -m 16500. Forge admin JWT. Access /admin.
Difficulty: Beginner.
Track: AYSEC-106 M05.
Setup: Multi-user web app where /api/orders/{id} doesn't enforce ownership.
Tasks: As user A, read user B's order. Submit B's order ID.
Difficulty: Intermediate. Track: AYSEC-106 M06. Setup: A web app with 4 different injection bugs (SQLi, command, NoSQL, LDAP). Tasks: Exploit each. Capture flags.
Difficulty: Intermediate. Track: AYSEC-106 M07. Setup: A web app with reflected, stored, and DOM XSS. Tasks: Exploit each. Steal an admin's cookie via stored XSS.
Difficulty: Advanced. Track: AYSEC-106 M08 + AYSEC-105 M12. Setup: A web app behind AWS EC2 with IMDSv1 enabled and an SSRF-vulnerable endpoint. Tasks: Through SSRF, retrieve EC2 IAM credentials. Use them to list S3 buckets.
Difficulty: Intermediate. Track: AYSEC-106 M10. Setup: crAPI-style API with BOLA + mass-assignment + SSRF. Tasks: Find each in 30 minutes.
Difficulty: Advanced. Track: AYSEC-106 M11. Setup: Front-end + back-end web infrastructure with a CL.TE smuggling vulnerability. Tasks: Smuggle a request that captures the next user's auth cookie.
Difficulty: Intermediate.
Track: AYSEC-150 M05.
Setup: An MQTT broker with multiple "smart-home" devices subscribing to topics.
Tasks: Subscribe to #. Identify which devices leak credentials in topic content. Inject a topic to alter device state.
Difficulty: Intermediate. Track: AYSEC-151 M02. Setup: A small RAG chatbot with an attacker-controllable doc upload. Tasks: (a) Direct injection. (b) Indirect via uploaded markdown. (c) Build defenses; re-test.
Difficulty: Beginner. Track: AYSEC-152 M01. Setup: A vulnerable encrypt/decrypt service that reuses nonces. Tasks: Demonstrate plaintext recovery via nonce reuse. Patch + reverify.
Difficulty: Intermediate. Track: AYSEC-153 M01. Setup: Photos + multimeter readings of a (synthetic) IoT PCB. Tasks: Identify GND/VCC/TX/RX. Determine baud rate.
Difficulty: Capstone. Track: AYSEC-101. Setup: 5-host network: standalone Linux + standalone Windows + BOF box + 3-host AD set. Tasks: 24-hour exam. Capture every flag. Write report.
Difficulty: Capstone. Track: AYSEC-102. Setup: 24-hour multi-stage simulated intrusion (phish → endpoint → AD → exfil). Tasks: Detect, triage, contain, document.
Difficulty: Capstone. Track: AYSEC-106. Setup: Two web apps, ~2 hours each, BSCP-style. Tasks: Get from standard user to admin to flag in each.
Difficulty: Capstone. Track: AYSEC-105. Setup: AWS + Azure free-tier accounts + GitHub repo. Tasks: Deploy the multi-cloud secure architecture (M14 deliverable). Pass Checkov + tfsec with zero High findings. Connect logging to Sentinel.
For your AYSEC site:
Hosting: Most labs need cloud / VM hosting. Use:
Flag format: AYSEC{<random-string>}. Per-lab unique seed.
Per-user instances: Use ephemeral containers with cleanup hooks.
Hint system: Three tiers — gentle nudge, partial walkthrough, full solution. Tax students for using deeper tiers.
Capstone validation: Auto-detection where possible (file presence, command success); manual report-grading otherwise.
50 lab projects spanning every AYSEC track, from beginner to capstone. Combined with PortSwigger, TryHackMe, HackTheBox, and the other free resources, AYSEC students have 1,000+ hours of structured hands-on practice without licensing concerns.