Penetration › Module 10 › Lesson 2
Lab Path
Attack path diagram for YOUR lab engagement — hops, goals, and RoE boundaries mapped.
Visual · t19_lab_path
Lab path = visual attack chain on in-scope lab hosts. Original Cyberlium.
Opening
Draw the path you actually took on lab IPs — not a fantasy map through someone else's domain.
Document lab path from initial access through privesc/post-ex/pivot (if any) to brief goal on $LAB_VM/$LAB_AD: diagram or numbered steps with hostnames, roles, and evidence row IDs. Mark RoE boundary on diagram — lab VLAN only. Include defender choke points where detection could break the path. No paths through unauthorized subnets, no 'and then we owned production' fiction. Mermaid or paper sketch in private notes chmod 600.
1. Path elements
Entry host, privesc hop, AD segment (if used), goal asset, data touched (synthetic only).
Each step links report finding or timeline row.
Command guide
Try these commands — Path elements
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Exploit correlation review — YOUR lab versions SearchSploit — https://www.exploit-db.com/searchsploit
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install exploitdb
macOS: Prefer Kali: searchsploit
Windows: Use Kali VM — searchsploit from exploitdb
═══ LINUX / macOS ═══
Command — copy this
grep open "$HOME/cyberlium-lab/t19-versions.txt" 2>/dev/null | head -5 || searchsploit apache | head -5 grep recommendation "$HOME/cyberlium-lab/t19-finding.txt" 2>/dev/null || echo 'Complete finding draft'
Primary tools to practice this lesson: searchsploit, grep. Reference sites: Exploit correlation review; SearchSploit (https://www.exploit-db.com/searchsploit). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. RoE overlay
Draw VLAN border — pivot stops at line.
Note time box and brief objective met Y/N.
3. Defender breakpoints
Mark where MFA, segmentation, or EDR would alter path — purple-team mindset.
Honest N/A if AD segment unused in your lab.
4. What you ship: lab path diagram
Attack path diagram with RoE border + defender breakpoints — chmod 600.
5. What you record before the next lesson
Lab path diagram path.
6. Wrong vs right: stranger nets vs YOUR lab VMs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Draw path through employer prod you never had scope to test.
Right
Lab path documented. Next: Evidence Pack.
Mission: lab path diagram
1) Map steps from entry to goal on $LAB hosts. 2) Mark RoE VLAN boundary. 3) Add two defender breakpoints.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Diagram vs numbered list for capstone?”
Knowledge Check
APPLY: Lab path documents:
Multiple choice
Knowledge Check
APPLY: True or False: Path through dorm LAN is capstone credit.
True or False
Knowledge Check
APPLY: Path diagram should show:
Multiple choice