Purple › Module 1 › Lesson 2
Lab Hosts Only
Lab hosts only means YOUR authorized VMs and endpoints under $PURPLE_LAB — labeled courseware targets, self-authored host inventory — document host scope in notes before any simulation.
Visual · t35_lab_hosts_only
Lab host scope. $PURPLE_LAB only. Original Cyberlium.
Opening
The host owner is part of scope — Cyberlium refuses attack simulations on stranger production networks or cloud tenants you do not have authorization to exercise.
Your purple lab hosts are VMs and endpoints YOU operate — CYBERLIUM-LAB-WIN01, CYBERLIUM-LAB-LNX01, labeled courseware simulation targets on example.local VLANs. Simulations live on $PURPLE_LAB only — never copied from live breach replays or run against stranger cloud subscriptions. Cyberlium maps allowed host inventory on YOUR $PURPLE_LAB — hostname, OS, simulation role, fictional org label — never 'borrowed' employer production endpoints or scraped live victim infrastructure. Next: No Stranger Sims.
1. Allowed lab host surfaces (named)
Self-authored lab VMs with fictional org names. Courseware purple packs with explicit training labels. Isolated lab VLAN diagrams with example.local assets. Simulation targets enrolled in YOUR EDR lab tenant only.
On $PURPLE_LAB, list host inventory row — hostname, OS, simulation role, fictional org label — never paste live victim infrastructure from public dumps.
Command guide
Try these commands — Allowed lab host surfaces (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, curl. Reference sites: MITRE ATT&CK (https://attack.mitre.org/); Sigma (https://sigmahq.io/); Splunk security content (https://github.com/splunk/security_content). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why lab host scope matters before simulations
Attack simulation tools — Atomic Red Team, CALDERA, custom scripts — are powerful on any network. Scope is what keeps practice legal and ethical. Employer production endpoints, live breach replays, and stranger-network simulations are out of scope.
If you cannot answer 'who owns this host and is it labeled lab-only?', pause and fix scope notes before running the simulation.
3. Lab host inventory habit
Forbidden: importing live breach infrastructure because they 'look like training.' Allowed: host inventory row — hostname, role, fictional org, source = $PURPLE_LAB self-authored.
Ship: lab host inventory row for three fictional targets. Next: No Stranger Sims.
4. What you ship: lab host inventory row for $PURPLE_LAB
Three fictional lab hosts with role labels. $PURPLE_LAB named. NEVER live victim infrastructure. chmod 600.
5. What you record before the next lesson
Date. Lab host inventory row. $PURPLE_LAB named. File t35-m01-l02-lab-hosts-only.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Import live breach host list because lab targets are boring. Skip host label because 'it's just a sim.'
Right
Write lab host inventory row for YOUR $PURPLE_LAB. Next: No Stranger Sims.
Mission: document YOUR lab host inventory
1) Write three fictional lab hosts. 2) Label each as lab-only with simulation role. 3) Confirm zero live victim infrastructure. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Lab host inventory exists for scope — use it instead of live victim infrastructure replays.
Knowledge Check
APPLY: Lab hosts only on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Simulation on $PURPLE_LAB uses YOUR lab hosts with explicit labels.
True or False
Knowledge Check
APPLY: Before running attack simulations you should:
Multiple choice