cyberlab

An offline cyber range built for a cybersecurity class. Students start a challenge from the command line, attack a deliberately vulnerable target with the same tools used in the real world, and submit a flag for instant feedback. Thirteen challenges cover four tracks: web (SQL injection, reflected XSS, IDOR, directory enumeration, forging an admin session by editing an unsigned JWT, and a double-extension file upload), network (packet captures that open in Wireshark with cleartext credentials, a port scan and a DNS tunnel, plus nmap service discovery), passwords (auditing weak hashes and a weak login) and log forensics. Every correct answer shows a debrief on what happened, why it matters and how to defend against it, often by comparing the vulnerable endpoint with a fixed one, and each challenge carries AP Cybersecurity unit, topic and skill metadata for classroom alignment. It is safe by construction: targets bind to 127.0.0.1 only, nothing contacts the network, and flags are derived from a per-workspace secret, so they differ for each student and are not stored in the repo. It runs on stock Python 3.10+ with the standard library only, with an optional offline tools pack for the class machines, a progress report for the teacher, and unit and smoke tests run in CI.

November 2026