Network Labs
Multi-host campaigns that mirror a real engagement. Land a foothold, loot credentials, and pivot deeper — each host you compromise reveals the intel to reach the next. Chain your way from the DMZ to Domain Admin.
Foothold: Nimbus Startup
Nimbus is a small startup with a lean stack. A beginner-friendly three-host chain: enumerate the perimeter, break the web app, then abuse the API to reach user data.
Breach: Sentient Systems Healthcare Network
Sentient Systems, a healthcare SaaS provider, stores PHI for 200+ clinics. Intelligence suggests they run a legacy admin panel exposed to the internet and use Active Directory internally. Your objective: breach the perimeter, pivot through their internal network, compromise AD, and exfiltrate the production patient database.
Breach: Meridian Corp
Meridian Corp hired you for a full-scope internal penetration test. You start with a single foothold on their public DMZ web server. Your objective: chain your way from the edge to Domain Admin, pivoting host-to-host as you loot credentials along the way.