Student setup and operating agreement
Deadwire is a practice-led course for authorized security work. The site is the study guide; your lab notes and evidence are the record of what you can actually do. A lesson can explain a command without claiming that you ran it.
Before week one
- Choose a disposable lab you own or are explicitly authorized to use. Keep it isolated from personal and production networks.
- Install a current browser, Git, a terminal, and an editor that can show Markdown.
- Create a private evidence notebook. Redact credentials, tokens, personal data, and target identifiers before sharing a write-up.
- Read How to use this course, the assessment rubric, and the instructor guide.
- Verify that you can stop and reset your lab. If you cannot restore it, do not run the exercise yet.
Students can read the published lessons without running the ingestion stack.
The bundled web lab requires Python 3.12 or newer, Git, and
curl, but uses only the Python standard library. Docker and local model tooling
are required only for people operating the pipeline or selecting other labs that
explicitly need them.
A 90-minute session
| Time | Activity | Evidence to keep |
|---|---|---|
| 20 min | Recall reviews | What you remembered before reading |
| 15 min | Concept study | A short explanation in your own words |
| 40 min | One bounded lab step | Redacted command/output and environment |
| 15 min | Write-up and teach-back | Interpretation, defense, and next review |
Stop at the boundary of the lab step. Carry incomplete work forward; never mark it complete because the page was opened.
Evidence standard
For each practical claim, record the source reference, lab scope, timestamp, observed output, interpretation, and defensive implication. Mark commands as unverified until the evidence shows a successful run in the authorized lab. A screenshot without context is not enough to establish mastery.
Use the three separate ratings in the session template:
- Recall: can you reconstruct the idea without notes?
- Execution: can you perform the bounded step safely and explain the output?
- Explanation: can you teach the mechanism, limits, and defensive signal?
Promotion requires evidence across all three dimensions. The assessment rubric defines the 0–4 scale and capstone requirements.
Safety boundary
Never test a public host, a workplace system, or a third-party account without written authorization. Do not paste secrets into the course, run copied commands blindly, or turn a lesson into an unbounded scan. When a lab behaves unexpectedly, stop, preserve the minimum evidence needed for diagnosis, and reset it.
Suggested progression
Start with the available learner route, which links developed lessons in prerequisite order. The 24-week program describes the wider planned curriculum; some of its chapters are still outlines. The prerequisite graph may recommend a different next concept after a review, but it must show the prerequisites, evidence, score contributions, and estimated time. The lateral-movement goal is the initial pilot; later modules broaden the same method to web, cloud, reverse engineering, wireless, DFIR, and secure engineering.
Reporting a gap
Open an issue with the lesson title, source reference, reproducible steps, expected behavior, observed behavior, and a redacted evidence sample. Do not attach private books or source-derived evaluation material. A missing citation, unsafe instruction, or contradiction should block publication until reviewed.