ISEC 6450UA – Lab Artifacts README

Host Environment Specification

Field	Value
Host OS	macOS (Apple Silicon / Intel)
Docker version	29.4.0
Docker Compose version	v5.1.2
Architecture	arm64 / amd64

Prerequisites

# Install Docker Desktop for macOS from:
# https://www.docker.com/products/docker-desktop/

# Verify installation
docker --version          # Docker version 29.4.0
docker compose version    # Docker Compose version v5.1.2

Network Architecture

subnet-dmz      172.20.1.0/24   [internal: true – no internet egress]
subnet-internal 172.20.2.0/24   [internal: true]
subnet-db       172.20.3.0/24   [internal: true]

Containers:
  attacker   172.20.1.10   (DMZ)
  web-server 172.20.1.20   (DMZ) – Flask app on port 5000
  gateway    172.20.1.30 / 172.20.2.10 / 172.20.3.10  (all subnets)
  honeypot   172.20.2.20   (internal)
  db-server  172.20.3.20   (db subnet) – SSH:22 / MySQL:3306

Build & Run

# Clone / enter lab root
cd pentest-lab

# Build and start all containers
docker compose up --build -d

# Verify all 5 containers running
docker compose ps

# Verify network isolation (no internet)
docker network inspect pentest-lab_subnet-dmz | grep Internal
# Expected: "Internal": true

# Open a shell on attacker node
docker exec -it attacker bash

Per-Question Quick Start

Q1 – Reconnaissance

docker exec -it attacker bash
nmap -sV 172.20.1.0/24
nmap -sV 172.20.2.0/24

Q2 – Vulnerability Scanning

# Web app available at http://localhost:5000
nikto -h http://localhost:5000
# SQLi PoC
curl -s "http://localhost:5000/login" -d "username=' OR '1'='1' --&password=x"
# XSS PoC
curl -s "http://localhost:5000/search?q=<script>alert('XSS')</script>"

Q3 – Hash Generation

cd Q3-cryptanalysis
pip3 install bcrypt
python3 generate_hashes.py
ls output/

Q4 – Pivoting

# From attacker, SSH to gateway
docker exec -it attacker ssh root@172.20.1.30   # password: toor
# From gateway, reach db-server
ssh root@172.20.3.20   # password: dbpassword
cat /root/secret.txt

Q5 – Forensics

# Record hashes before attacks
docker exec attacker bash -c "find /etc -name '*.conf' | xargs sha256sum" > Q5-forensics/before_hashes.txt

Q6 – Remediation

cd Q6-remediation
python3 app_hardened.py   # runs on port 5001

Teardown

docker compose down -v
docker network prune

pentest_lab