Repository navigation
Scenarios
The full walkthroughs contain runnable commands, expected results, review steps, and clearly labeled fictional notes.
No walkthrough launches a scan or changes a network.
An approved lab plan allows access to a demo application on TCP 3000 at 192.0.2.10.
The scanner is in the users segment.
The snapshots show an explicit closed → open change.
The reviewer compares that evidence with the deployment plan and checks the intended firewall scope.
Lesson: a change can match the plan without proving the application or network is secure.
An alternative lab policy requires the backend to accept only local connections behind a reverse proxy. Direct access to TCP 3000 from the users segment is prohibited.
This exercise uses the same XML pair as scenario 1. The generated evidence is identical, but the human interpretation differs because the access policy differs.
Lesson: Watchpost reports the observation. The policy supplies the expected behavior.
The snapshots alone do not prove the cause, application identity, Internet exposure, or compromise.
The alternative later file reports a timeout for one host, even though the run-finish marker says success. Watchpost refuses the comparison with exit code 2 and creates no report.
Lesson: successful run completion cannot override a reported host timeout.
A valid completed scan with a missing explicit port record is a different case.
That missing side remains not observed, not closed.
Start with Getting started. Then follow the version-controlled walkthrough commands.
Use new output filenames on repeat runs. Keep exercise notes clearly marked as fictional.