Red › Module 1 › Lesson 3
Lab-Only Infra
Red team practice runs on intentional lab VMs at $LAB_RT — isolate infra you can revert, never production or classmate targets.
Visual · rt_lab_only_infra
Lab-only infra literacy. $LAB_RT only. Original Cyberlium.
Opening
Professional red teams rehearse on disposable infra. So will you — on $LAB_RT, not production.
Lab-only infrastructure means VMs, AD forests, and network segments you provision, snapshot, and revert — dedicated to authorized emulation at $LAB_RT. Isolation prevents C2 callbacks, phishing lures, and lateral movement from touching employer production, cloud tenants you do not own, or classmates' projects. Cyberlium treats lab-only as a hard requirement. You will NOT 'just test' a classmate's hackathon URL because tools make it easy. Next: RoE Lab.
1. What lab-only infra includes
Virtual networks, domain controllers, workstations, logging/SIEM fixtures, and C2 listeners bound to $LAB_RT ranges — all revertible via snapshots or rebuild scripts. Document IP plan, DNS, and admin boundaries before emulation.
Lab infra supports purple-team loops: red action → blue detection → debrief. Production without signed engagement is never a substitute lab.
Command guide
Try these commands — What lab-only infra includes
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Lab-only infrastructure — https://attack.mitre.org/resources/adversary-emulation-plans/ (isolated targets) CISA red team resources — https://www.cisa.gov/resources-tools/resources/red-team-exercises
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap
macOS:
Command — copy this
brew install nmap
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t21-rt"
cat > "$HOME/cyberlium-lab/t21-rt/lab.env" <<'EOF'
export LAB_HOST=${LAB_HOST:-127.0.0.1}
export LAB_RT=$HOME/cyberlium-lab/t21-rt
EOFCommand — copy this
chmod 600 "$HOME/cyberlium-lab/t21-rt/lab.env" source "$HOME/cyberlium-lab/t21-rt/lab.env" nmap -sn "$LAB_HOST" 2>/dev/null | head -12 || nmap -sn 127.0.0.1 | head -8
Primary tools to practice this lesson: nmap, mkdir. Reference sites: Lab-only infrastructure (https://attack.mitre.org/resources/adversary-emulation-plans/); CISA red team resources (https://www.cisa.gov/resources-tools/resources/red-team-exercises). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Isolation and revert discipline
Segment lab from home production Wi-Fi where possible. Firewall rules block lab egress to stranger networks. Snapshot before campaigns; revert after — contain mistakes without neighbor harm.
If a tutorial uses public IP ranges, rewrite mentally to $LAB_RT before copying habits. Classmates run their own labs; do not pivot through each other's VMs.
3. Lab-only protects you and strangers
Written lab boundaries defend operators in disputes and protect neighbors from collateral C2, scan noise, and accidental exfil. chmod 600 notes that say NEVER production/classmate/dorm/café targets.
Ship: lab infra diagram placeholder — segments, snapshots, $LAB_RT IP plan. Next: RoE Lab.
4. What you ship: lab-only infra note for $LAB_RT
Diagram or bullet list: segments, snapshots, isolation. $LAB_RT IP plan. NEVER production/classmates. chmod 600.
5. What you record before the next lesson
Date. Lab infra note. $LAB_RT IP plan. File t21-m01-l03-lab-only-infra.txt chmod 600.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run C2 on employer laptop 'because it's my machine.' Use classmate cloud tenant as red team range.
Right
Write lab-only infra note for $LAB_RT. Next: RoE Lab.
Mission: document YOUR lab-only infra
1) List $LAB_RT segments and snapshot/revert plan. 2) Write isolation rules (no production egress). 3) chmod 600. Never list stranger or classmate hosts as lab targets.
Stuck? Ask Cyberlium AI Mentor
Disposable labs beat one irreversible mistake on production.
Knowledge Check
APPLY: Lab-only infra on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Snapshots/revert are optional for red team labs.
True or False
Knowledge Check
APPLY: Lab egress to stranger networks should be:
Multiple choice