Lateral Movement Lab

A hands-on pivoting lab

Break in, then move laterally.

An isolated eight-machine network in Docker. Start on the attacker box, enumerate, get a foothold, then tunnel through it to reach internal services and web apps you can't touch directly. You just log in and start.

Get started See the lab

Get started

First time? About 10 minutes — most of it Docker installing. Done once.
1

Install Docker Desktop

Free, one-time, and the only software you need. Download for your system ↗, install it, and start it — wait until it shows “running”.

2

Download the labs — no git needed

⭳ Download the ZIP, then unzip it. You'll get a folder named cybersecurity-lab-lateral-movement-main — put it somewhere easy, like your Desktop.

On Windows, “Extract All” nests it one level deeper — cybersecurity-lab-lateral-movement-main\cybersecurity-lab-lateral-movement-main. That's normal: the inner folder (the one containing start.bat) is the one you want. Move it somewhere easy and delete the empty outer one.

3

Launch it

  1. Open the folder and double-click start.command.
    First time only: if macOS blocks it, right-click the file → Open → Open.
  2. A Terminal window opens, the machines boot, and you land at the lab> prompt. Type connect to drop into the attacker box.

Prefer the terminal? Open Terminal, type cd (with a trailing space), drag the folder onto the window, press Enter, then run ./start.sh

  1. One-time: install Git for Windows — it's the lab launcher. Run the installer and click Next through every screen; the defaults are all fine.
  2. Open the unzipped folder — the inner one, containing start.bat — and double-click start.bat.

If a window flashes open and vanishes: right-click an empty spot inside the folder → Open in Terminal, type .\start.bat and press Enter — the message stays on screen. It usually says Docker Desktop isn't running yet.

  1. Open a terminal in the folder — in most file managers, right-click → Open Terminal Here.
  2. Run ./start.sh; type connect to start.

Or from any terminal: cd path/to/cybersecurity-lab-lateral-movement-main && ./start.sh

The lab

Two network segments. Break in, then pivot to reach what you shouldn't.

You start on the attacker box (secutils). The goal is to move laterally — enumerate the network, get a foothold on a host, then tunnel through it (SSH / SOCKS proxy) to reach internal services (LDAP, MySQL, telnet) and the vulnerable web apps you can't hit directly.

How to run it

  1. Install Docker, download the ZIP, unzip it.
  2. Run ./start.sh (macOS: double-click start.command).
  3. At the lab> prompt, type connect for the attacker box.

Commands you'll use

lab> connect
lab> machines
lab> open juice
lab> open dvwa
Open the lab guide ↗

The network

Eight machines across two segments — corp and internal. The attacker box is highlighted.

The lab network

Part of the Assume-Breach series

Hands-on security labs across the lifecycle — plus two companion books and a game that tie it together. Found one? Here's the rest — or browse the whole series on the series home.

Offensive · break inEthical HackingRecon, scan, and exploit your way in
Offensive · move throughLateral MovementYou are here
DefensiveAssume BreachDefend assuming the attacker is already in Post-breachDigital ForensicsReconstruct the incident from the evidence Govern · auditSecurity AuditAudit a company against the Essential Eight The gameIncident Zero ↗Play the whole lifecycle — print & play The bookAssume Breach ↗The defender's-mindset thesis behind the labs The bookSubstantiate, Don't Assume ↗Security audit & controls — prove it, don't assume it