Lab setup¶
Every PoC is designed to run on an isolated Layer-2 segment built from a
Linux network namespace and a veth pair. Nothing leaves your host.
Install¶
git clone https://github.com/goabonga/netsec-lab
cd netsec-lab
uv sync # workspace + all packages + scapy
Build the isolated segment¶
The netlab-core package ships VethLab, but you can also do it by hand:
sudo ip netns add attacker
sudo ip link add veth-host type veth peer name veth-ns
sudo ip link set veth-ns netns attacker
sudo ip link set veth-host up
sudo ip netns exec attacker ip link set veth-ns up
veth-hoststays on the host - run detectors and defenders here.veth-nslives in theattackernamespace - run offensive PoC here:
Tear everything down (also removes the veth):
Consent guardrail¶
Offensive subcommands emit real traffic and refuse to start without an
explicit --i-own-this-network flag. This is a deliberate friction: it forces
you to acknowledge, every single run, that you own the segment.
Privileges¶
Sniffing and raw packet injection need CAP_NET_RAW - run the offensive and
detection subcommands with sudo (or grant the capability). The brief
subcommand needs nothing and works everywhere.