adversary-validation-range

This repository tests whether controlled actions against deliberately vulnerable, isolated systems produce evidence that detections can distinguish from benign baselines. The workflow is authorized action → captured evidence → detection replay → explicit result or NOT_EVALUABLE. It contains a digest-pinned Docker range and a VirtualBox internal-network range. No vulnerable application is published to the physical LAN.

The validated first slice targets the official DVWA image from an unprivileged Kali container. It enumerates only the manifest-authorized address, exploits DVWA command injection to create a fixed marker inside the disposable target, captures the transaction, and replays the PCAP through Suricata. A normal login-page request is the negative baseline.

flowchart LR
  A[Kali 10.77.0.2] -->|manifest-authorized only| D[DVWA 10.77.0.3]
  A --> J[Juice Shop 10.77.0.4]
  S[Capture namespace] -. PCAP .-> D
  P[Offline Suricata] --> R[DETECTED / NOT DETECTED / NOT EVALUABLE]
  K[Kali VM 10.77.0.10] -->|internal network| M[Metasploitable3 10.77.0.20]

Loading

Verified result

• Nmap 7.99 identified Apache 2.4.68 on DVWA port 80.
• A fixed command-injection request created /tmp/avr-exp-002-proof containing AVR_EXP_002.
• Suricata 8.0.6 rule SID 4200771 alerted on replay of the 33,740-byte attack PCAP.
• The same rule did not alert on the 2,794-byte benign PCAP.
• Missing EVE evidence evaluates to NOT_EVALUABLE, never benign.
• Juice Shop authentication SQL injection was confirmed without retaining returned session material; SID 4200774 detected its PCAP and ignored a normal failed login.
• A pipe-separator variant bypassed SID 4200771 revision 1; revision 2 detects both tested separator encodings without alerting on the benign baseline.
• Metasploit check-confirmed and exploited ProFTPD mod_copy as www-data; SID 4200775 alerted once on the 7,047-byte attack PCAP and zero times on the 1,110-byte FTP-banner baseline.

Raw PCAPs, VM disks, event logs, credentials, and generated reports are ignored. Committed manifests contain hashes and reproducible commands, not raw attack captures.

Run

Docker Desktop and Python 3.12+ are required.

python -m unittest discover -v
docker compose build
docker compose --profile capture up -d
python -m avr.runner EXP-001 10.77.0.3
python -m avr.runner EXP-002 10.77.0.3
python -m avr.runner EXP-004 10.77.0.4
pwsh -File scripts/run_vertical_slice.ps1

Review range isolation before execution. VM attack commands must use avr.vm_runner; it fails closed unless the approved VirtualBox topology and target egress lock are present.

For the VM slice, provision from infra/range, then return to the repository root and run scripts/disable_attacker_egress.ps1 and scripts/apply_target_egress.ps1. Only after both succeed may python -m avr.vm_runner VM-EXP-001 10.77.0.20 be used. Raw boxes, disks, keys, and captures remain outside Git.