CYBRARY Practice the engagement before you perform it.
Develop offensive skills across emulated hosts, identities, applications and security-tool workflows. Plan the engagement, investigate a target, collect exercise evidence and explain your findings.
Capabilities
Five consoles, one deliverable.
Scope, rules of engagement, findings scored on CVSS 3.1, kill-chain timeline, print-ready report.
- Scope + ROE editor locks on Start
- Findings with CWE and OWASP tags
- Auto-flagged scope violations
- Executive summary and appendix
Nodes and edges rendered from the emulated directory, with shortest-path finding from any user to any target.
- Tiered layout: users → groups → hosts → DAs
- Kerberoast, DCSync, GenericAll edges
- Shortest-path highlighter
- Backed by directoryEstate seed
A deterministic beacon fleet with a 13-task catalog: shell, hashdump, mimikatz, kerberoast, screenshot, exfil.
- Fleet health, sleep and jitter
- SYSTEM-gated hashdump, Kerberoast tickets
- Task timeline per beacon
- Loot drawer with sha256
Repeater and Intruder over the emulated storefront: catch IDOR, stored XSS and blind SQLi with OWASP-tagged findings.
- Repeater with byte-perfect responses
- Intruder fuzz over endpoint chips
- OWASP Top 10 categorization
- Findings feed the engagement report
Replay a campaign from the defender's chair: the log lines each move leaves, the rule that fires, and the techniques that stay dark.
- Attacker command beside defender telemetry
- ATT&CK technique and tactic coverage
- Alert latency per move
- Blind spots listed as findings to write up
For each offensive lab: the way in, the CIS, NIST 800-53 and ATT&CK mitigations that answer it, the hardening change, and the replay that proves it took.
- Controls named against published frameworks
- Hardening written the way an engineer makes it
- A verification replay for every change
- What legitimately breaks, called out
How to read a mirrored row in order, what to change when it is partial or blind, and a drill that hides the verdict and asks you to call it.
- Sources, lines, rule, latency, then verdict
- Remediation plan per blind spot
- Tuning versus onboarding, named
- Scored verdict drill with explanations
And on top of that
Real msfvenom flags (-p / -f / -e / -i / -x / -b), deterministic bytes, sha256 / md5 / imphash, artifact dropped on the VFS.
nmap, sqlmap, gobuster, ffuf, nikto, hydra, netexec, impacket, responder, powersploit, bloodhound, mimikatz, aircrack-ng, atomic-red-team.
Fire ATT&CK techniques from the C2, check the SIEM for a signal, and file the ones that produced nothing as detection gaps.
Learner track
Seven offensive labs, deliverable-first.
Each lab ends with an entry filed to a real /pentest engagement — CVSS score, OWASP tag, remediation. The consoles above are what you use to get there.
pt-01-external-recon-to-footholdpt-02-ad-attack-graphpt-03-web-app-assessmentpt-04-cloud-privescpt-05-purple-team-emulationpt-06-wireless-assessmentpt-07-phishing-simulationFor working testers
Forge Anvil — the same workspace, real tools, your machine.
A separately entitled, signed desktop kit for authorized engagements. Real tools run locally on the tester’s own computer against targets an approved scope names, with every command, artifact and capture recorded into evidence that traces straight to a finding. No hypervisor, no remote shell, and no traffic originating from Cybrary.
- Reviewed rules of engagement become an enforced scope
- Real terminal and qualified native tool packs
- Crash-proof session recording with visible gaps
- Portable, hashed evidence package and report