# Applied Cybersecurity: Foundations to Mastery -- Lab Index

This directory contains the complete lab pack for *Applied Cybersecurity: Foundations to Mastery*. Each chapter has its own self-contained subdirectory (`ch01` through `ch22`) with a `README.md` describing every exercise and a `docker-compose.yml` that defines the container environment for that chapter.

---

## Lab Approach

Labs use **Docker Engine with Docker Compose v2** as the universal delivery mechanism. Every chapter directory contains a `docker-compose.yml` that is syntactically valid and can be started with a single command. Where a lab cannot run in a container (Windows domain controllers, GUI desktop tools, multi-VM virtualisation frameworks), the chapter README provides a clearly marked **Host setup** section with step-by-step instructions for that exercise.

A few early chapters (Ch 01, Ch 05, Ch 09) are paper or browser exercises by design. Their `docker-compose.yml` files still exist and validate cleanly, but contain only a no-op or lightweight workspace service. Containerised targets begin in earnest from Chapter 2 onward and become the dominant pattern from Chapter 3.

---

## Shared Prerequisites

The following are required across all chapters. Install them once before starting any lab.

| Requirement | Minimum version | Notes |
|---|---|---|
| Docker Engine (Linux) or Docker Desktop (macOS/Windows) | Engine 25+ / Desktop 4.x | Compose v2 is bundled; `docker compose` (no hyphen) must work |
| Docker Compose v2 | 2.24+ | Included in Docker Desktop; install the plugin separately on bare Linux |
| Git | Any recent version | Required to clone this repository and some host-setup labs |
| 8 GB RAM available to Docker | -- | Baseline for most chapters; Ch 17 and Ch 18 recommend 16 GB for VM-backed and Wazuh labs |
| 20 GB free disk | -- | Minimum across the full course; Ch 17 adds ~40 GB for GOAD VMs; Ch 18 needs ~3 GB for the ELK stack alone |
| Internet access on first run | -- | Images are pulled from Docker Hub and public registries on first `docker compose up` |

Additional host tools required by specific chapters are documented in the relevant chapter README (e.g., Vagrant + VirtualBox for Ch 17 GOAD, KIND for Ch 13 Kubernetes labs, Ollama for Ch 19 LLM labs, Java 21 + Ghidra for Ch 17 malware analysis).

---

## Universal Quick-Start Pattern

Every containerised lab in the course follows the same three-step pattern:

```bash
# 1. Move into the chapter directory
cd labs/chNN

# 2. Start the lab environment (detached)
docker compose up -d

# 3. Work through the lab exercises in the chapter README

# 4. Tear down and remove volumes when finished
docker compose down -v
```

Some chapters define **named profiles** to avoid starting every service at once. Where profiles are used, the chapter README shows the precise `--profile` flag to pass. Example:

```bash
docker compose --profile lab2 up -d
```

For chapters with a tool-runner container (no persistent daemon), use `docker compose run` instead:

```bash
docker compose run --rm tools bash
```

Always run `docker compose down -v` at the end of a session to free disk space and reset state for the next run.

---

## Safety and Authorisation

> **All lab exercises must be performed only against the Docker targets provided in this pack, systems you personally own, or environments for which you hold explicit written authorisation.**

The offensive labs (network scanning, exploitation, privilege escalation, cloud attack simulation, malware analysis, AI red-teaming) are designed for isolated lab networks. The Docker Compose files create private bridge networks; no service is reachable from the public internet unless you explicitly publish ports. For VM-backed labs (GOAD, Sliver C2, REMnux), use host-only networking in your hypervisor and never bridge lab VMs to a production or shared network.

Performing these techniques against systems you do not own or have permission to test is illegal in most jurisdictions. The authors and publishers accept no liability for unauthorised use.

---

## Chapter Lab Table

| Chapter | Lab pack folder | Labs | Key targets / tools | Notes |
|---|---|---|---|---|
| Ch 01: Foundations of Cybersecurity | `ch01` | 3 | MITRE ATT&CK Navigator (web), spreadsheet, browser | No containers required; all analytical exercises |
| Ch 02: Networking, OS Internals, and the Protocol Stack | `ch02` | 5 | Wireshark, Nginx/Postgres stack, Ubuntu sandbox, PowerShell | Lab 2.2 Wi-Fi passive audit requires a physical Wi-Fi adapter in monitor mode |
| Ch 03: Programming Principles for Secure Systems | `ch03` | 7 | Deliberately vulnerable Flask app, Bandit, Semgrep, pip-audit | All exploit and fix labs target the same vuln-app container |
| Ch 04: Cryptography and Encryption - Foundations | `ch04` | 3 | CBC padding-oracle target, OpenSSL CLI, OWASP Juice Shop, Python cryptography | Padding-oracle service is isolated on an internal lab network only |
| Ch 05: Cybersecurity Compliance and Management | `ch05` | 2 | Python/pandas crosswalk tools, NIST CSF 2.0 reference tool | GRC chapter; no offensive targets; Lab 5.1 is a tabletop exercise |
| Ch 06: Digital Forensics and Penetration Testing: Introduction | `ch06` | 6 | Recon target, OWASP Juice Shop, Jupyter kill-chain notebook, dd, Autopsy | Labs (a) and (b) are host-setup exercises requiring a physical device or image and Autopsy GUI |
| Ch 07: Cyberthreat Intelligence | `ch07` | 4 | ATT&CK Navigator (self-hosted), OSINT tools, Flask vuln app, MISP | MISP stack (misp-core, misp-modules, misp-db, misp-redis) is the heaviest service in this chapter |
| Ch 08: AI and Machine Learning for Security Practitioners | `ch08` | 4 | Jupyter + scikit-learn + BERTViz, Ollama (host), synthetic data endpoint | Labs 08c Parts 1 and 2 require Ollama running on the host at `host.docker.internal:11434` |
| Ch 09: Law, Ethics, Professional Practice, and AI Governance | `ch09` | 4 | Ubuntu 24.04 workspace with nano/vim/pandoc | All labs are desk exercises (CRA trace, AI Act tiering, policy drafting, moot court) |
| Ch 10: Cryptography Theory and Practice (Advanced) | `ch10` | 6 | Python 3.12 tools runner, CBC oracle target, testssl.sh (host) | Lab (d) TLS audit uses testssl.sh on the host; Lab (e) covers post-quantum hybrid TLS |
| Ch 11: Security Frameworks and GRC at Scale | `ch11` | 6 | Jupyter notebook (Python) | No attack targets; all labs are framework analysis and documentation exercises |
| Ch 12: Zero Trust Architecture | `ch12` | 5 | Traefik whoami backend, Pomerium identity-aware proxy, oauth2-proxy, Linkerd, osquery | Labs 2 and 3 (Linkerd service mesh, osquery device posture) require host-side setup |
| Ch 13: Cloud Security | `ch13` | 6 | LocalStack (local AWS emulator), awslocal tools, Checkov, KIND Kubernetes cluster, Falco | Labs 13.1-13.4 require KIND on the host; ~3 GB disk for images |
| Ch 14: Secure Programming and Scripting | `ch14` | 7 | Semgrep, Trivy, Cosign, syft, grype, gitleaks, truffleHog, fat/slim app targets | Lab 14.4b CI integration is a host-setup exercise using GitHub Actions |
| Ch 15: Forensic Principles and Analysis - Advanced | `ch15` | 6 | forensic-tools (RegRipper, Volatility 3), network-tools (Zeek, Suricata), Jupyter | Lab 15.6b container forensics is a host-setup exercise; all artefacts are synthetic or defanged |
| Ch 16: Data and Application Security | `ch16` | 5 | OWASP Juice Shop, crAPI, DVGA (GraphQL), MobSF, diffprivlib | crAPI is a multi-service stack (API gateway, web, mailhog, MongoDB, Postgres) |
| Ch 17: Penetration Testing and Malware Analysis | `ch17` | 7 | Juice Shop, vulnerable Ubuntu (LinPEAS), LocalStack + Pacu/ScoutSuite, Volatility 3, Ghidra + YARA | AD lab (Lab 17.3 Parts A-D: Kerberoasting, BloodHound, DCSync) is host setup via GOAD (Orange Cyberdefense); requires Vagrant, VirtualBox, ~40 GB disk |
| Ch 18: Incident Analysis and Response (Part II) | `ch18` | 5 | Wazuh (cloned from official repo), Elasticsearch 8.13, Kibana 8.13, Sigma tools | Wazuh Lab 1 needs ~8 GB RAM and git; ELK stack needs ~3 GB disk and 4 GB RAM minimum |
| Ch 19: AI Security and Adversarial Machine Learning | `ch19` | 5 | garak 0.15.0, ART Jupyter (FGSM/PGD), RAG harness, Ollama (host) | Labs 1, 4, and 5 require Ollama on the host; Lab 2 is a host-setup model-card audit |
| Ch 20: Operational Technology and Critical Infrastructure Security | `ch20` | 5 | Conpot ICS honeypot (honeynet/conpot), Kali-based OT tools (Modbus client, tshark, Zeek, Suricata) | Lab 20.4 is an analytical zone-and-conduit drill; Lab 20.6b (GRFICS) requires host-setup virtualisation |
| Ch 21: Research Methods and Dissertation Skills | `ch21` | 4 | Jupyter scipy-notebook (Python 3.11, scipy, matplotlib) | All labs are research-craft exercises (literature review, survey design, statistics, ethics application) |
| Ch 22: The Capstone - Your Final Project | `ch22` | 4 | Jupyter scipy-notebook, Python reproducibility demo container | Labs 1, 2, and 4 are host-side planning and writing exercises; Lab 3 and the Reproducibility Lab run in containers |

**Total: 22 chapters, 114 labs.**

---

## Tips for Running the Full Course

- **Pull images ahead of class.** Run `docker compose pull` in each chapter directory before your session to avoid waiting on slow connections during labs.
- **Disk hygiene.** After finishing a chapter, run `docker compose down -v` and `docker image prune` to reclaim space. Do not prune between labs within the same session.
- **Resource-heavy chapters.** Ch 17, Ch 18, and Ch 13 are the most resource-intensive. If running on a laptop, close other applications before starting those labs. Assign at least 4 CPU cores and 8 GB RAM to Docker Desktop for Ch 18.
- **Offline use.** Once images are pulled, most labs run fully offline. Exceptions: Ch 01 and Ch 07 use web-hosted MITRE ATT&CK resources; Ch 08, Ch 19 require Ollama model downloads on first use.
- **Rebuild custom images.** Chapters 3, 8, 14, 17, 19, and 20 build custom images from local Dockerfiles. Run `docker compose build` before `docker compose up -d` in those directories, or pass `--build` flag.
