Labs

Labs

The library ships several ranges as blueprints. Load one, clone it, edit it, compile, and deploy. Each lab ships with its solution, because the solutions are operator validation references, not answer keys to hide.

The GOAD family

Recreated natively as redStackPRO topologies, so they compile through redStackPRO's own Terraform and Ansible.

• goad-light: a two-domain Active Directory range, sevenkingdoms and its child north in one forest, two domain controllers and a member server, plus a jumpbox. The smallest full GOAD experience.
• goad: the full lab, three domains across two forests with their trusts and hosts.
• goad-mini: a smaller GOAD for a quick stand-up.
• dracarys: the GOAD escalation chain built out end to end.
• goad-wazuh: GOAD with a Wazuh sensor for detection work.
• nha (Ninja Hack Academy): a GOAD community lab centered on an ESC4 certificate-template takeover in ninja.hack, reached across a forest trust.
• sccm: a Configuration Manager (SCCM/MECM) lab.

The GOAD templates are derived from GOAD and carry GPLv3. They are data the canvas loads; the rest of the project is MIT.

Harbor

A corporate forest of our own, with no theme, covering the path a real engagement tends to take.

Attack infrastructure

• redstack: the ops blueprint. Redirector, teamservers (Mythic, Sliver, Adaptix), a jumpbox with Guacamole, Kali and Windows operators, and a collector.
• minimal-c2: a small attack topology to start from.

Solutions

The walkthrough solutions ship alongside the ranges. The written solution for a lab is generated from the same topology, so it matches what was deployed. For detection work, each escalation edge is a known test case.