Every PoC and tool on this site is built and tested in the lab described here. Write-ups link back to this page instead of re-explaining the setup, and this page is kept current as the lab changes.
Virtualization
Proxmox VE hosts everything. Each PoC gets its own isolated network with a vulnerable target VM and an attacker VM, and snapshots put the target back to a clean state between runs. Nothing in the lab has a route to a production network, and vulnerable targets never get internet access.
Network monitoring
Security Onion watches a mirror of the lab network and runs Zeek and Suricata. The Zeek logs and Suricata alerts generated while a PoC runs are what the Detect sections of the write-ups are built from.
SIEM and detection engineering
The Elastic Stack receives logs from Security Onion and from agents on the target VMs. Sigma rules are converted to Elastic queries and tested against the data produced during the Reproduce step, so every published detection has been fired at least once against real traffic.
Hardware
Specifics for each host will be listed here as the hardware write-ups are published.
Rules
What gets reproduced here, and why, is governed by the Ethics page.