5. Machines

5.1 Services Overview

The following services are deployed within the simulated infrastructure to represent typical enterprise systems. They are distributed across three internal networks (LANs):

5.1.1 LAN A

This LAN hosts core infrastructure services that support authentication, name resolution, and centralized logging within the internal environment.

• bind1: Internal DNS server for local hostname resolution and service discovery.
• rsyslog: Centralized logging system for auditing and monitoring.
• oldap: Directory service providing centralized authentication and user management.

5.1.2 LAN B

LAN B contains key backend systems responsible for hosting web applications, managing databases, and providing internal communication and storage services.

• wsa1: Apache web server responsible for hosting various internal web-based services and tools used by the organization. It provides access to multiple subdomains for different operational functions, including:

  • helpdesk.theboys.it – Internal ticketing and support portal for IT and facility requests.
  • mail.theboys.it – Webmail interface or mail gateway for employee email access.
  • manager.theboys.it – Financial management portal used for tracking company accounts, expenses, and accounting operations.
  • sysloghub.theboys.it – Web-based log collection and monitoring interface for infrastructure diagnostics.

• mdb: MariaDB relational database for storing application and system data.

  • helpdesk – Stores tickets, user requests, and support records for the helpdesk system, allowing easy tracking and updates.
  • roundcubemail – Contains user data, settings, and configurations for the Roundcube webmail application, ensuring seamless email functionality.
  • azienda – Holds company information, including employee details, roles, and departmental structures to streamline organizational management.
  • rsyslogdb – Maintains log entries from various systems and applications, enabling efficient log management and monitoring for security and compliance purposes.

• smb: Samba server offering Windows-compatible file and printer sharing.

• mxs: Mail server with Postfix and Dovecot services.

5.1.3 LAN C

This LAN provides externally accessible services and secure remote connectivity, acting as the main interface between the internal infrastructure and external users or systems.

• wsa2: Apache web server responsible for delivering public-facing websites and online applications. It hosts the following domains:
  • blackhoney.theboys.it – Brand-focused website or e-commerce platform for a dedicated product line.
  • invest.theboys.it – Financial portal presenting investment projects and funding opportunities.
  • quix.theboys.it – Interactive web application quiz designed for fun.
  • techsolve.theboys.it – Showcase website for promoting IT solutions and technical services offered by the company.
• wsn: Nginx-based reverse proxy and lightweight web server used for serving public landing pages and promotional content. It manages the following domains:
  • agency.theboys.it – Landing page for the company’s marketing and digital services division.
  • ecopulse.theboys.it – Informational platform focused on environmental sustainability and green initiatives.
  • myrecipe.theboys.it – Themed content portal centered around food and cooking-related material.
  • puffcats.theboys.it – Entertainment website displaying a curated gallery of cats, likely for fun, engagement, or community sharing.
• bind2: External DNS server for Internet resolution.
• ovpn: OpenVPN server providing secure remote access to the internal network.

5.2 Workstations and Pcs

5.2.1 LAN S

5.2.1 LAN D

5.2.1 LAN O

5.3 Other Machines

The following machines are not restricted to a specific Local Area Network (LAN) and can be deployed in various network environments. All of these machines can execute Python scripts that enable them to function across different LANs, adapting to various security requirements and testing scenarios. This flexibility allows users to deploy these tools effectively, regardless of the network setup.

5.3.1 RedHornet

This machine is designed for penetration testing and includes a variety of tools and utilities to facilitate security assessments that contains essential packages such as:

• dirsearch: A directory brute-forcing tool that uncovers hidden files and directories on web servers, helping identify vulnerabilities.
• dsniff: A set of tools for monitoring network traffic and capturing passwords from protocols like FTP and HTTP.
• hping3: A network packet generator that allows users to send custom TCP/IP packets, useful for testing firewalls and network configurations.
• hydra: A password-cracking tool that supports numerous protocols, enabling brute-force attacks to test the strength of passwords.
• john: Known as John the Ripper, this tool efficiently cracks password hashes using multiple attack methods, critical for security assessments.
• masscan: A fast and efficient network scanner that identifies open ports across large networks quickly.
• metasploit framework: An advanced exploit tool used for penetration testing and security assessments. It allows users to develop and execute exploits against vulnerabilities in systems, simulating real-world attacks to enhance security measures.
• nmap: A widely used network exploration and security auditing tool that provides detailed information about hosts and services.
• whatweb: This web scanner identifies technologies used by websites, assisting in the reconnaissance phase of pentesting.

5.3.2 Suricata

This machine is for monitoring and intrusion detection. It includes Suricata, a high-performance network IDS (Intrusion Detection System) and IPS (Intrusion Prevention System). Suricata can analyze network traffic in real-time, detecting and preventing a wide range of attacks. Key features include:

• real-time traffic analysis: Suricata can monitor and analyze network traffic, providing alerts for suspicious activities.
• protocol detection: It automatically identifies various protocols and applies the appropriate detection methods, enhancing accuracy.
• integration with tools: This image integrates well with web servers through Apache and PHP, allowing for a comprehensive setup for managing and visualizing alerts.

5.3.3 Wireshark

This machine contains Wireshark, a powerful open-source network protocol analyzer. It allows users to capture and interactively browse traffic on a computer network. With its user-friendly interface, Wireshark provides detailed analysis of various protocols, facilitating network troubleshooting, performance analysis, and security auditing. Users can view packets in real-time, apply filters for targeted analysis, and generate detailed reports, making it an essential tool for network administrators and security professionals.