MBPTL - Best hands-on lab for learning the fundamentals of

项目说明

Most Basic Penetration Testing Lab (MBPTL)

![License: GPL-3.0]()
![Docker]()
![Black Hat Arsenal EU 2025]()

> 🎯 Perfect for beginners! A comprehensi penetration testing lab designed to teach cybersecurity fundamentals through practical exercises.

Getting started? Follow the Task Guide to understand how to collect all 17 flags. Need detailed solutions? Check out the Write-up Guide for step-by-step instructions. Don't worry if you don't understand e at first because this lab is designed to introduce fundamental tools, concepts, and workflows commonly used in cybersecurity and penetration testing. The goal is to help you become familiar with the topics and tools in, even if you're still learning.

📖 Table of Contents

Quick Start

Task Guide

What You'll Learn

Prerequisites

Installation

Lab Architecture

Troubleshooting

Next Steps

Contributing

Contact

🚀 Quick Start

Access your lab:

📋 Task Guide

📖 Read TASK.md to understand the complete flag collection process!

The task guide provides an o of all 17 flags organized by penetration testing phases, helping you understand what to look for as you progress through the lab. Use it alongside your reconnaissance and exploitation efforts.

📚 What You'll Learn

This lab covers complete penetration testing methodology with 17 hands-on flags. Complete the lab in this order:

1. Reconnaissance → Information gathering and target enumeration
2. Assessment → Identifying security weaknesses
3. Exploitation → Exploiting applications and services
4. Password Cracking → Breaking authentication mechanisms
5. Post-Exploitation → Maintaining access and pri escalation
6. Network Pi → Moving between networks and accessing internal systems
7. Binary Exploitation → Exploiting memory corruption in compiled programs
8. Reverse Engineering → Analyzing software to understand its functionality and identify
9. SOC Analysis → Log analysis and forensic techniques

📋 Prerequisites

System Requirements:

OS: Linux, macOS, or Windows

RAM: 2GB minimum

Storage: 1GB free space

Network: Internet connection for Docker images

Required Software:

Docker: 20.10+ with Docker Compose

Git: For cloning the repository

Recommended Skills (Will be more helpful):

Linux fundamentals: Basic experience with command line operations for file management and system na

Networking basics: Understanding of IP addressing, ports, and core network protocols

Web technologies: Familiarity with HTTP requests/responses, web servers, and client–ser

🛠️ Installation

Automated Setup (Recommended):

For manual setup and detailed installation instructions, see INSTALL.md

🏗️ Lab Architecture

The lab simulates a realistic network en with 3 interconnected containers:

🎯 Main Container (mbptl-main)

Primary target with web applications

Port 80: Web application with SQL injection

Port 8080: Administrator panel with file upload

Port 3306: MySQL database (internal-only, reachable from other containers)

Objective: Initial compromise and pri escalation

🔒 Internal Container (mbptl-internal)

Internal service for binary exploitation

Port 31337: Custom binary service with buffer o (internal-only)

Objective: Binary exploitation and reverse engineering

Access: Only accessible after compromising main container

🌐 Web Internal Container (mbptl-app)

Internal web application for pi

Port 5000: Flask application with template injection (internal-only)

Objective: Ad web application exploitation

Access: Only accessible after compromising main container

🔧 Troubleshooting

Common Issues

Lab won't start:

Port conflicts:

If ports 80 or 8080 are in use, modify the .env file or use different ports.

Permission issues (Linux/macOS):

🎓 Next Steps

Completing MBPTL is just the beginning of your cybersecurity journey! To continue building your expertise, develop a strong foundation across these essential knowledge domains:

🎯 Fundamental Knowledge Areas

Operating Systems
Learn how processes, files, and access rights are managed in Linux and Windows. This foundation helps you identify and exploit like pri escalation, rootkit installations, and malware persistence.

Networking Fundamentals
Since all systems communicate o, understanding core protocols, routing, and network architectures enables you to detect and exploit risks such as packet sniffing, man-in-the-middle (MitM) attacks, DDoS, and unauthorized port scanning.

Programming
Applications are built with code, and most security stem from programming flaws. Understanding how code works allows you to identify and exploit issues like SQL injection, buffer o, and cross-site scripting (XSS).

Cryptography
Master encryption, hashing, and cryptographic protocols to e security implementations, identify weaknesses, and defend against attacks like brute-force, side-channel exploitation, and cryptographic failures.

Threat Intelligence Frameworks
Familiarize yourself with CWE (Common Weakness Enumeration) to recognize common weakness patterns like poor input , memory management errors, and configuration mistakes. Stay current with C and Exposures) to stay informed about the latest threats and necessary security patches.

🛠️ Essential Tools to Learn

Application Security: Burp Suite, OWASP ZAP, Nikto, Sqlmap, Semgrep, Trivy

Network Security: Nmap, Angry IP Scanner, Netcat, Aircrack-ng

Exploitation Frameworks: Metasploit, Empire

Password Cracking: John the Ripper, Hashcat

Scanning: Nessus, OpenVAS

OSINT: Maltego, theHar

🏆 Practice Platforms

| Platform | Difficulty | Focus |
|----------|------------|-------|
| DVWA | Beginner | Web |
| O | Beginner-Intermediate | Wargames |
| TryHackMe | Beginner-Ad | Guided learning |
| | All Levels | VMs |
| HackTheBox | Intermediate-Expert | Real-world scenarios |

🤝 Contributing

Contributions are welcome! Please feel free to submit a Pull Request. For major changes, please open an issue first to discuss what you would like to change.

📄 License

This project is licensed under the GPL-3.0 license. See the LICENSE file for more information.

📞 Contact

Author: Bayu Fedra
Email:
LinkedIn: Bayu Fedra
Twitter:

---

⭐ If you find this lab helpful, please give it a star and recommend it to your friends!

项目信息

开发语言：Shell

Star 数：474

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Best hands-on lab for learning the fundamentals of cybersecurity and penetration testing workflows also packaged as Docker containers for fast, safe setup.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。