Student lab manual

Deadwire lessons are designed for a disposable, isolated lab. The lab is a place to test a hypothesis and collect evidence; it is never a reason to probe a public or production system.

Minimum environment

The current core route can start on one workstation with Python 3.12+ and curl. The detection and OT decoders use only the standard library; the web fixture binds to loopback. Windows lessons include synthetic worksheets, with optional native inspection on Windows.

For later multi-machine exercises, use one host-only virtual network with snapshots or rebuildable images. The broader lab roles are:

Role	Suggested system	Purpose
Analyst	macOS or Linux workstation	terminal, editor, packet capture, notes
Linux target	disposable Linux VM	processes, permissions, networking, services
Windows target	disposable Windows VM	tokens, policy, event logs, remote administration
Identity lab	disposable directory controller plus member VM	Kerberos, authorization, and lateral-movement evidence
Web target	bundled synthetic Python authorization fixture	request/response testing and findings

Students may complete the available local and offline exercises on the analyst workstation; no VM is required for those fixtures. The web exercise supplies a loopback-only target with two fictional records, vulnerable/fixed modes, and a restart reset; no VM is needed. The detection exercise runs with python3 -m labs.detection and compares rules on synthetic labels; it does not collect or replay traffic. The binary-frame parser runs with python3 -m labs.binary_frame; the integrity experiment runs with python3 -m labs.integrity. Both use only the standard library, fixed synthetic data and no network. The industrial-protocol exercise runs entirely offline with python3 -m labs.ot_trace, using bundled synthetic records and no additional packages. The architecture and investigation chapters use that same fictional scenario; no controller or simulator installation is needed. Native Windows inspection needs your own Windows lab account. Future AD, cloud, reverse-engineering, wireless and physical OT exercises require suitable targets and written scope. Deadwire does not download or deploy vulnerable targets automatically.

Isolation checklist

For VM or multi-machine labs, complete the following checklist. For bundled local fixtures, follow the chapter's bounded setup and reset procedure; a VM snapshot is unnecessary.

1. Create or restore a clean snapshot.
2. Confirm the target network is host-only or otherwise disconnected from personal and production networks.
3. Write the target names, allowed source address, allowed ports, time window, and reset method in the evidence note.
4. Remove real credentials, personal data, and unrelated files from the snapshot.
5. Set command, request, and time limits before starting.

If any item is unknown, stop at the prediction step and ask the instructor. A failed prerequisite is useful evidence; bypassing it is not.

Evidence layout

Keep evidence outside the public repository. A simple private layout is:

learning/
  2026-09-11-foundations/
    scope.md
    prediction.md
    transcript.txt
    observations.md
    teach-back.md
    reset-check.md

Use the evidence template. For every command or request, record the timestamp, lab host, scope, exact input, redacted output, interpretation, and defensive implication. Mark a command unverified until the transcript proves it ran in the authorized lab.

Lab progression

Phase	Lessons	Smallest useful exercise	Promotion evidence
Observe	01, 07	inventory one disposable host and trace one local request	observation/interpretation table and reset check
Model identity	02, 03	inspect a test token and draw one ticket or authorization flow	diagram, one failed prerequisite, and event reference
Evaluate detection	05	score the six-case offline fixture and add a counterexample	confusion matrices, exact denominators and telemetry limitations
Model a remote path	04	five-case worksheet; optional query on an existing two-host Windows lab	distinguish service response, authentication, authorization and execution
Find and explain	06, 08	test one local web behavior and write one defensive finding	reproducible request, impact boundary, and fix hypothesis
Build and inspect	09, 10, 14	review one container, parser, binary, or cryptographic invariant	fixture, test or observation, and limitation
Broaden context	11, 12, 13	perform a passive or forensic exercise on supplied material	chain of custody, safety plan, and teach-back
Integrate	capstone	reproduce an authorized investigation from scope to report	reviewer sign-off, clean reset, and failed-attempt analysis

Reset and failure protocol

Stop immediately when a command reaches an unexpected host, asks for an unknown credential, changes more state than planned, or produces data outside scope. Save only the minimum redacted diagnostic, record the stop reason, restore the snapshot, and explain the missing assumption. Never “repair” a lab by disabling controls or deleting evidence.

An incomplete or failed experiment can satisfy the evidence requirement when the learner identifies the prediction, observed failure, missing prerequisite, and next safe test. It cannot satisfy execution mastery by itself; score recall, execution, and explanation separately.

Instructor handoff

An instructor supplies target images, credentials, reset instructions, scope, and any licensed training material. Keep those details private. When a lesson needs a target that is not available, substitute a synthetic fixture or mark the exercise deferred; do not improvise against an internet host.