Stratocyberlab

<h1 align="center">StratoCyberLab</h1> <p align="center"> <img src="https://github.com/stratosphereips/BSY-playground/assets/26445918/1898de8c-840f-46a5-ad73-fca0b9b84c14" alt="Logo" width="200"/> </p>

StratoCyberLab (SCL) is a local cyber range to test and practice your offensive and defensive cybersecurity skills. It was developed by the Stratosphere Laboratory with two primary goals:

• To allow anyone to run local capture-the-flag challenges (think HackTheBox, but local on your computer!).
• To set up local security environments for students of the Introduction to Security class to follow weekly classes and practice hacking.

<br> <p align="center"> <img src="https://github.com/user-attachments/assets/d0164304-c7b2-4f3a-8ac9-2bfcbc52e573" alt="Screenshot" width="800"/> </p>

Features

• 🔒 Local-only. No cloud. No tracking. No login. No data collection.
• ⚙️ Easy-To-Use. Only Docker required and a single command to start the lab.
• 🧩 Many cybersecurity exercises in the form of CTF challenges.
• 🎓 Predefined network and service environments for students of the Introduction to Security class.
• 🐳 The lab runs using Docker containers on shared virtual network(s).
• 🛠️ A container is created for you as your attacking machine. Install any tools you want without modifying your host computer.
• 🌐 A web interface to manage challenges and play.
• 💻 Solve all challenges from the web interface using the built-in WebSSH terminal.
• 🤖 AI-assisted: the web interface includes a local LLM chat (using Ollama) to assist your hacking. You can choose any Ollama model.
• 🧑‍🔧 Support for flexible third-party plugins to add any custom behavior into the SCL.

Requirements

Hardware

Resource consumption depends heavily on user actions. We do not recommend starting all challenges at once, as this may require significant compute by generating a lot of network traffic and starting many services.

We estimate the minimum requirements to be 3 GB of disk space and 2 GB of spare RAM. (Note: downloading an LLM model will require additional disk space depending on the model.)

Software

The only requirement to run SCL is to have docker (v>20.10) installed.

How to start

1. To start the lab, run:

git clone https://github.com/stratosphereips/stratocyberlab.git
cd stratocyberlab
docker compose up

This uses the already prepared docker-compose.yml file to start three services:

• hackerlab — a container with SSH and core utilities for hacking
• dashboard — a web interface to start/stop challenges, submit flags, control Ollama, etc.
• ollama — a container that optionally handles the local LLM models

2. After the lab bootstraps, navigate in your browser to http://127.0.0.1/ to access the lab dashboard.

3. Read the welcome message and solve a Hello World challenge to verify your setup is working correctly.

4. Hack the world!

Troubleshooting

Q: I pulled new updates but the lab is running the old version.
A: Depending on the changes, sometimes it’s required to force Docker to rebuild and/or restart the containers. Re-run the lab using: docker compose up --build --force-recreate.

Q: I see a REMOTE HOST IDENTIFICATION warning when trying to SSH into the hackerlab container.
A: The ID of the hackerlab container is regenerated when the container is recreated. Add -o UserKnownHostsFile=/dev/null to your SSH command to fix the issue.

Q: I have a Windows OS and the challenges are not working correctly for me.
A: Git for Windows uses CRLF line endings by default, which may break some designed functionality. Either replace all CRLF line endings with LF or set this behavior globally in Git using these commands (note that you have to re-clone the repository after making this change to take effect):

git config --global core.autocrlf false
git config --global core.eol lf

Plugins

Plugins are third party projects adding custom features to SCL.

To start using plugins, clone any plugin into the ./plugins directory and restart SCL.

To see a more detailed documentation regarding plugins, see ./docs/plugins.md.

Important Note: most plugins will have access to docker socket meaning plugins have theoretical access as root to your host machine. Be completely sure you fully trust all plugins you intend to use!

Development

We appreciate all PRs with new challenges or bug fixes.

Please refer to a separate Development documentation at ./docs/development.md.

Architecture Diagram