SOC-Analyst-Training-Lab - Purple Team Lab: Offensive Recon & Defensive Harde

项目说明

🛡️ SOC Analyst Training Lab

MiroslavSec — practical cybersecurity portfolio for SOC / Blue Team growth with real lab e.
De independently by MiroslavSec. Not affiliated with any educational institution.

![Status]()
![Focus]()
![Content]()

![Last Commit]()
![Repo Size]()
![Issues]()
![Stars]()

![GitHub]()
![LinkedIn]()
![YouTube]()

> Building public, repeatable SOC skills: attack simulation, defensi, and clear documentation.

---

🎯 Objective

Build practical e of security skills through:

This repository is portfolio-first: every block shows what was done, how it was , and what defensi was learned.

---

🧭 Quick na

---

📊 Tracks o

| Track | Scope | Status |
| ------------------------- | --------------------------------------------------------------------------------------- | ---------------------------- |
| Linux Hardening | UFW, SSH hardening, banners, agent forwarding, Fail2Ban, final automation | ✅ 01–06 (docs + scripts) |
| Red Team (Offensive) | Nmap + Hydra + Hashcat + SQLi 00 on video; John queued | 🚧 In progress |
| Blue Team (Defensive) | Tool track: Wireshark → Wazuh → Suricata (labs/defensi) | 🧱 Lab 01 docs in repo |
| SOC expansion | Windows/AD and extra incident cases (not the Blue tool playlist) | ⏳ Planned |

---

📈 Progress dashboard

| Series | Labs total | Published | In repo | Status |
| --------------- | ------------- | -------------------------------------- | ------- | ----------------- |
| Linux Hardening | 06 | 05 + 01 docs/script | ✅ | 🟢 Stable |
| Nmap | 06 | 06 | ✅ | 🟢 Complete block |
| Hydra | 00–03 | 04 (Labs 00–03) + docs/menu | ✅ | 🟢 Complete block |
| Hashcat | 01–02 | 2 (Labs 01–02) | ✅ | 🟢 Complete block |
| John the Ripper | 01 (planned) | 0 (docs skeleton) | ✅ | 🟡 Recording queue |
| SQL Injection | 00 | 1 video (Lab 00) | ✅ | 🟢 Lab 00 published |
| Defensive Blue | 01–03 | 0 (Lab 01 docs + Hydra ticket companion) | 🧱 | 🔵 Wireshark first |

> Target rhythm: steady weekly releases with one-tool-per-series discipline.

---

🚢 What is shipping now

---

🔥 Current focus

---

📺 Video index

Where a lab has a walkthrough, the link is below. Shared / orchestration scripts (Linux Lab 06 auto-secure.sh, Nmap nmap-labs-menu.sh, Hydra hydra-labs-menu.sh) stay GitHub-only — documented here, not as a separate video.

Linux Hardening

| # | Lab | Video / materials |
| --- | -------------------- | ------------------------------------------------------------------ |
| 01 | Firewall (UFW) | ▶️ Watch |
| 02 | SSH Keys | ▶️ Watch |
| 03 | Security Banners | ▶️ Watch |
| 04 | SSH Agent Forwarding | ▶️ Watch |
| 05 | Fail2Ban | ▶️ Watch |
| 06 | Final Automation | Docs + auto-secure.sh |

Nmap (published)

| # | Lab | Video / materials |
| --- | ---------------------------------- | -------------------------------------------------------------- |
| 01 | Host Discovery + Fast Scan | ▶️ Watch |
| 02 | SYN Scan Basics | ▶️ Watch |
| 03 | Service Detection | ▶️ Watch |
| 04 | Speed | ▶️ Watch |
| 05 | Output & Reporting | ▶️ Watch |
| 06 | Safe NSE Intro | ▶️ Watch |
| — | Interactive menu (runs Labs 01–06) | Docs + nmap-labs-menu.sh |

Hydra

| # | Lab | Video / materials |
| --- | ------------------------------------------------------ | ------------------------------------------------------------------------------------------- |
| 00 | Speed (local range, rate limit / lockout) | ▶️ Watch |
| 01 | SSH brute-force + Fail2Ban bridge (lab + scripts) | ▶️ Watch · Docs |
| 02 | HTTP form (http-post-form, PHP + Apache) | ▶️ Watch · Docs |
| 03 | FTP (Pure-FTPd, PASV on localhost) | ▶️ Watch · Docs |
| — | Interactive menu (starts/stops Labs 01–03 targets) | Docs + hydra-labs-menu.sh |

Hashcat

| # | Lab | Video / materials |
| --- | --- | ------------------- |
| 01 | Baseline — local lab hashes only | ▶️ Watch · Docs |
| 02 | Rules + mask attack (candidate expansion) | ▶️ Watch · Docs |

John the Ripper (planned)

| # | Lab | Video / materials |
| --- | --- | ------------------- |
| 01 | Baseline — formats and wordlist | Docs (skeleton) · 🎬 Planned |

SQL Injection

| # | Lab | Video / materials |
| --- | -------------------------------------------------------------- | -------------------------------------------------------------- |
| 00 | Local training demo ( vs safe + monitoring + admin) | ▶️ Watch · Docs |
| — | Follow-up topics (fundamentals, detection/triage angles, etc.) | 🎬 Planned — split into separate after Lab 00 walkthrough |

Defensive Blue

| # | Lab | Video / materials |
| --- | --- | ------------------- |
| 01 | Wireshark — SQLi HTTP e (one scene) | Docs · 🎬 Planned |
| 02 | Wazuh — one local alert | Docs (planned) |
| 03 | Suricata — same pcap, one IDS alert | Docs (planned) |
| — | Hydra 00 HTTP ticket (companion, no Blue video) | Docs |

---

🟣 Purple Engine

This portfolio follows a Purple Team workflow:

Traceability Matrix (Attack → Defense)

| Attack phase (Red) | Tool / technique | Detection / mitigation (Blue) | Lab e |
| ------------------------ | ---------------------------------- | --------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| Network recon | nmap -sn, nmap -sV | Service minimization, banner strategy, segmentation | Nmap Lab 01–03 |
| Port exposure mapping | SYN scan (-sS -Pn) | Firewall rule review + exposure baseline | Nmap Lab 02 |
| Brute-force simulation | Hydra (web lab + SSH / HTTP / FTP) | Fail2Ban, WAF/rate limits, SFTP vs FTP, keys/MFA | Hydra 00–03 · Linux Lab 05 |
| Offline hash cracking | Hashcat / John (lab-generated hashes) | Strong KDFs, protect backups & DC sync, MFA for online paths, monitor credential theft | Hashcat track · John track |
| SQL injection simulation | SQLi local demo ( / safe) | Parameterized queries, input , query-event monitoring, pcap e | SQLi 00 · Blue Lab 01 Wireshark |
| Safe service enumeration | NSE --script safe | Logging + anomalous pattern monitoring | Nmap Lab 06 |
| SSH hardening | Key-only auth / custom port checks | sshd_config policy + UFW + backup-and- flow | Linux Lab 02/03/06 |

Lab Standard

Every lab should follow the same engineering format:

1. Scenario — what problem is being solved?
2. Scope & authorization — lab-only and authorized targets.
3. Reproduction (Red) — how the issue is observed.
4. Remediation (Blue) — fix/hardening steps.
5. — proof that behavior changed after fixes.
6. Artifacts — scripts, command logs, or reports.
7. Defensi — SOC-relevant conclusion.
8. MITRE ATT&CK mapping — 1-3 techniques with detection + mitigation notes.

Template: labs/LAB_TEMPLATE.md

---

📁 Repository structure

| Path | Purpose |
| -------------------------------------------------------------------------- | --------------------------------------------------------- |
| Linux-Hardening/ | Linux series (labs 01–06) |
| labs/offensi/ | Red Team tools and workflows (Nmap/Hydra/...) |
| labs/offensi/hydra/scripts/ | Hydra hydra-labs-menu.sh (start/stop Docker labs 01–03) |
| labs/offensi/hashcat/ | Offline hash cracking (Hashcat) — lab-only material |
| labs/offensi/john-the-ripper/ | Offline hash cracking (John the Ripper) — lab-only material |
| labs/offensi/sql-injection/00-local-demo/ | SQLi local training target (Docker, monitoring, admin demo) |
| labs/defensi/ | Blue tool track (Wireshark → Wazuh → Suricata) + ticket companions |
| labs/LAB_TEMPLATE.md | Standard template for consistent lab quality |
| docs/ | Portfolio site (GitHub Pages) |
| scripts/ | Shared automation helpers |
| ROADMAP.md | High-le and next steps |
| LICENSE | MIT — code and docs in this repo |

---

✅ Content standards

---

🚀 Release workflow

1. Publish or schedule the lab video.
2. Sync documentation and public links in repository and website.
3. Keep titles and naming consistent across GitHub, website, and playlist.

---

⚙️ Quick start

Open the lab folder you need and follow its markdown guide.

Linux Hardening — master script (final runbook)

After you understand each step, you can chain labs 02 + 03 + 01 + 05 in one safe order (SSH 2222, UFW, Fail2Ban stay aligned):

---

🌐 Portfolio & profiles

---

🤝 Collaboration

If you are building your own SOC path, feel free to open an issue or drop feedback on lab structure, detection notes, or workflow ideas.

项目信息

开发语言：Shell

Star 数：3

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Purple Team Lab: Offensive Recon & Defensive Hardening. Hands-on security workflows (Nmap, SSH, UFW, Bash) with MITRE ATT&CK mapping. SOC Analyst portfolio.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。