syscfg@lab:~$ ls --sort=time ./archive/
The Lab An archive of 65 interactive simulations, filed by the moment they recreate: from the 1988 Morris worm to this server's own honeypot in 2026. Period screens look the way they did at the time. Anything invented for the scene, such as usernames, posts or addresses, is marked as a simulated recreation.
All 65 Research 23 RF / SIGINT 11 Hardware 8 Underground 8 Malware 12 Social eng 3
The first worms, and the export fight over strong crypto.
1988 Stack Buffer Overflow strcpy, EIP control, NOP sled Step-through visualization of a classic stack buffer overflow. Watch input spill past a 32-byte buffer, overwrite saved EBP and return address, and redirect EIP into attacker shellcode. Step or auto-play through all 6 phases. Malware How it works run → 1993 Is This a Munition? 1990s crypto export test Nine artifacts - PGP source, a t-shirt with RSA on it, a 40-bit key. Guess which ones were arms trafficking to export under 1990s law. You will get some wrong, which is the point. Research Calculator run →
Carding forums, and the first consumer hacking hardware.
2003 ShadowCrew Forum phpBB carding forum circa 2002 Navigate the original carding forum that invented modern cybercrime. Browse categories, read threads, see the vendor reputation system. Underground Period recreation simulated recreation run → 2007 Proxmark3 RFID Cloner HID, MIFARE, EM410x attacks Scan real RFID/NFC card types - HID Prox, EM410x, MIFARE Classic, iCLASS. Watch the CRYPTO1 attack crack sectors, clone the card, then emulate against a reader. Hardware Device simulator simulated recreation run → 2008 WiFi Pineapple Evil twin + captive portal Full WiFi Pineapple attack workflow: scan for APs, clone a target SSID, deauth clients, deploy captive portal, harvest credentials. Hardware Device simulator simulated recreation run →
Stuxnet, LulzSec, Silk Road and the celebrity cloud leak.
2010 Stuxnet PLC Sabotage First cyberweapon against infrastructure Deploy Stuxnet against Natanz enrichment facility. Watch centrifuge RPMs go haywire while SCADA shows nominal readings. Compare real vs spoofed feeds. Malware Period recreation simulated recreation run → 2010 USB Rubber Ducky HID injection simulator Plug the Ducky into a simulated target. Watch DuckyScript execute keystroke by keystroke. Three payloads: WiFi dump, reverse shell, persistence. Hardware Device simulator simulated recreation run → 2011 #antisec IRC Channel mIRC circa 2011 Live IRC session in the #antisec channel. Sabu, Topiary, tFlow, Kayla - type commands and get responses. Classic Windows gray UI. Underground Period recreation simulated recreation run → 2013 Silk Road Marketplace Dark web market simulation Browse the Silk Road marketplace circa 2013. Listings, vendor ratings, escrow system, Tor hidden service aesthetic. Underground Period recreation simulated recreation run → 2014 Apple ID Phishing Email Analyst mode: click to reveal IOCs Recreation of the Ryan Collins phishing email. Toggle analyst mode to highlight every indicator - sender domain, fake urgency, malicious link. Social eng Period recreation simulated recreation run → 2014 HackRF Spectrum Analyzer Live waterfall display Animated waterfall spectrum across FM, 433 MHz ISM, ADS-B aircraft, pager networks, and GSM. Click signals to see what's being broadcast. Hardware Device simulator simulated recreation run →
Mirai, WannaCry, NotPetya and the darknet market busts.
2016 AlphaBay Market Dark market circa 2016 The largest dark web market at its peak. Browse listings, vendor ratings, BTC prices. Seizure banner included. Underground Period recreation simulated recreation run → 2016 Mirai Botnet IoT DDoS - 600,000 bots Watch Mirai scan IPv4 space for default-credential IoT cameras and routers, build a botnet, then launch a DDoS attack against real targets. Malware Period recreation simulated recreation run → 2017 NotPetya Wiper MEDoc supply chain - $10B destruction Step through the NotPetya attack: MEDoc supply chain infection, EternalBlue propagation, Mimikatz credential theft, MBR overwrite, and the fake ransom screen. Malware Period recreation simulated recreation run → 2017 WannaCry Ransom Screen Ransomware recreation Interactive recreation of the WannaCry ransom note. Countdown timer, BTC payment address, decryptor UI. Built from documented samples. Malware Period recreation simulated recreation run → 2018 SIM Swap Call Step-through social engineering A real SIM swap social engineering call, exchange by exchange. Toggle analyst notes to see what each step exploits and where the data came from. Social eng Period recreation simulated recreation run → 2019 O.MG Cable Weaponized USB cable with WiFi payload delivery A USB-C cable with an embedded ESP8266 WiFi chip. Operator connects remotely, selects a DuckyScript payload, and triggers HID injection over WiFi. Target sees a normal cable. Hardware Device simulator simulated recreation run → 2019 Pwnagotchi AI WiFi handshake harvester Watch the AI hunt WPA2 networks, send deauth frames, and capture handshakes. Pixelated face changes mood. Live console log. Hardware Device simulator simulated recreation run →
Supply chains, Log4Shell, pipelines and help-desk phone calls.
2020 Flipper Zero Full OLED UI simulator Full Flipper Zero OLED interface simulation. Sub-GHz scanning, NFC reading, BadUSB payload execution, IR learning. With analyst panel. Hardware Device simulator simulated recreation run → 2020 SolarWinds / SUNBURST Supply chain attack - 18,000 victims Step through the SUNBURST supply chain attack: build system injection, 18,000-org distribution, 9-month dormancy, Golden SAML pivot to cloud, and detection by FireEye. Malware Period recreation simulated recreation run → 2021 Colonial Pipeline DarkSide ransomware - East Coast fuel crisis Network map showing DarkSide's spread through Colonial's IT network. Ransom note, the $4.4M Bitcoin negotiation, and the aftermath timeline. Malware Period recreation simulated recreation run → 2021 Log4Shell (CVE-2021-44228) CVSS 10.0 - every Java app Fire JNDI injection payloads at a vulnerable Log4j server. Watch the DNS callback, LDAP referral, class loading, and RCE play out step by step. Malware Period recreation simulated recreation run → 2022 BreachForums Underground data market - 2022-2025 Browse the BreachForums interface circa 2024. Databases, combolists, exploits, malware source code, and services. Simulated posts from real threat actor patterns. Toggle analyst mode for context on each category. Underground Period recreation simulated recreation run → 2023 COM Group Chat Telegram coordination group Inside a COM threat actor Telegram group. SIM swap coordination, social engineering tips, target sharing. Underground Period recreation simulated recreation run → 2023 Vishing Call IT helpdesk social engineering Annotated replay of a Scattered Spider-style IT helpdesk vishing call. Seven distinct social engineering techniques, from pretexting to complicity anchoring. Social eng Period recreation simulated recreation run →
Recent incidents, reconstructed from advisories, and this site's own honeypot.
2024 Ransomware Negotiation Portal Victim-side negotiation with ransomware operators The dark web negotiation portal ransomware victims are directed to. Choose your response: ask the price, request an extension, or refuse to pay. Each path shows the operator's counter and analyst notes on the negotiation tactics being used. Malware Period recreation simulated recreation run → 2025 CVSS Divergence Calculator Working CVSS 3.1 base scorer A real CVSS 3.1 calculator loaded with CVE-2025-25249, where NVD says 9.8 and Fortinet says 8.1. Flip attack complexity and watch the severity band cross the line that decides your patch SLA. Research Calculator run → 2025 EchoLeak Bypass Chain Zero-click Copilot prompt injection How CVE-2025-32711 chained four separate defences into a zero-click data exfiltration against M365 Copilot. Each defeated control, in order. Research Incident scene run → 2025 One Breach, Four Numbers Claim vs confirmation The Oracle Health breach as a claim ledger: the 20 million headline, the state filings that add up to 5.3 million, the federal 501 placeholder, and Oracle's silence. Filter to what you can stand behind and see each figure's provenance. Research How it works run → 2025 The 44-Hour Intrusion Incident scene: you are the SOC Watch a 44-hour intrusion arrive in your EDR, DNS and AD logs, from a poisoned search result to Akira. The real commands from The DFIR Report, the ATT&CK technique for each, and three moments to step in. Research Incident scene simulated recreation run → 2025 The OAuth Blind Spot Why sign-in monitoring missed it The same CRM theft by three routes - stolen password, stolen cookie, stolen OAuth token - against eight controls. The OAuth route walks past almost all of them, because none of them watch a token that never signs in. Switch on the behaviour controls and see what changes. Research How it works run → 2026 HASSH Fingerprint Explorer Testing a dead IOC A HASSH fingerprint published for the mdrfckr botnet in 2022, tested against 632 implants in a 2026 honeypot corpus - where it matches zero. Explore how the fingerprint drifted and why. Research Real honeypot data run → 2026 How DV Certs Collapse ccTLD hijack to trusted cert Seven links from registry hijack to revocation, then try the defences yourself: CAA, ACME account binding and CT monitoring, with DNS in the owner's or the attacker's hands. Includes the real google.sl entries from the public CT logs. Research How it works run → 2026 One Write, Preloaded Everywhere CVE-2026-104286 file-write chain How an unauthenticated FortiMail file write becomes ld.so.preload persistence inside every process. The control step is inferred from the advisory's IOCs, not vendor-confirmed - the demo says so. Research Incident scene run → 2026 PeopleSoft Intrusion Chain Zero-day to leak site in 14 days Step through the ShinyHunters PeopleSoft campaign - MeshCentral dressed as an Azure service, an SSH-spraying bash script, zstd exfiltration - with the detection opportunity at each stage. Research Incident scene run → 2026 SSH Recon Campaign Timeline Five addresses, this server's own name 1,976 login attempts from five coordinated addresses hunting this honeypot's own usernames, drawn straight from the raw Cowrie logs. Original data that exists nowhere else. Research Real honeypot data run → 2026 The FortiBleed Chain Incident scene: you are on call Sit at the defender's console as the campaign the FBI/USSS advisory reconstructed unfolds over three weeks. Three moments to step in; choose well and watch what you prevented. No CVE, no patch, only exposure and missing MFA. Research Incident scene simulated recreation run → 2026 There Is No C2 To Block SaaS dead-drop channels TukTuk's C2 ran over ClickHouse and Supabase, with Ably, Dropbox, GitHub Issues and an Arweave dead drop built in as fallbacks. Block each channel and watch it fall through to the next - because every destination is a product your company might pay for. Research Incident scene run → 2026 Time From Exposure to Trouble Honeypot-measured discovery + compromise A log-scale clock from one second to 24 hours. Pick SSH, Postgres, RDP or an unauthenticated endpoint and watch the playhead pass the times real honeypot studies measured for first probe and compromise. Research Real honeypot data run → 2026 Two Ways Into the Build ChainDrop + XCSSET stepper An npm worm and a macOS infostealer, side by side, with the control that should have caught each stage and why it did not - including valid Sigstore provenance for malicious code. Research Incident scene run →
Concepts and calculators that are not tied to one moment.
---- Build a Browser Fingerprint Entropy, and the fixes that backfire Switch on canvas, fonts, WebGL and audio and watch 'one in a few' become 'one in billions', then try VPN, cookie-clearing, incognito and user-agent spoofing against it - and see which do nothing and which two make you easier to track. Research How it works run → ---- Classify the Signal Legal to receive? Encrypted or just digital? Pick a signal and see what it actually is - open, digital, or genuinely encrypted - and the broad legal posture of receiving it in the US and Australia. General information, not legal advice; digital is not encryption, and a 'privacy code' is a squelch tone. RF / SIGINT Calculator run → ---- Cobalt Strike Team Server Live C2 beacon simulation Three active beacons calling home to a Cobalt Strike team server. Run real commands (whoami, hashdump, lateral movement), watch the C2 traffic, and toggle analyst mode for JARM fingerprinting and detection signatures. Malware How it works simulated recreation run → ---- Decode an ADS-B Frame 112-bit aircraft message, field by field Step through a real extended-squitter frame - downlink format, ICAO address, type code, altitude, CRC - the same format every aircraft overhead broadcasts in the clear. RF / SIGINT How it works run → ---- DNS Tunneling C2 Command and control hidden in DNS queries Watch malware exfiltrate data through DNS queries that blend with legitimate traffic. Base32-encoded data hidden in subdomain labels, commands received in TXT responses. Toggle analyst mode to see why this evades most firewalls. Malware How it works simulated recreation run → ---- Find the Gain Sweet Spot Overload, noise floor, dBFS Drag the gain and watch the signal and noise floor rise together, SNR peak then fall, and the share of 'too-strong' messages cross into overload - the ADS-B result that proves more gain decodes fewer aircraft. RF / SIGINT How it works run → ---- Fixed / Rolling / RollJam Replay attacks on remotes Replay a fixed code (works), a rolling code (fails), then RollJam a rolling code (works anyway) - the jam-and-withhold attack that beats rolling codes without breaking the crypto. RF / SIGINT How it works run → ---- Hopping vs the Jammer Spread spectrum, animated A signal hops a pseudo-random channel sequence while a jammer sits on fixed channels. Switch jammer type and toggle whether the interceptor has the hop set. RF / SIGINT How it works run → ---- Live Spectrum + Waterfall Real FFT, watch aliasing happen A real 256-point FFT of a synthetic IQ stream drawn as spectrum and waterfall. Slide a tone past the band edge and watch it alias back - Nyquist, made visible. RF / SIGINT How it works run → ---- Modulation, Live AM/FM/PSK waveforms + band map Switch between AM, FM, FSK, BPSK and QPSK and watch the carrier change - every trace computed from its equation, with a live constellation. Second tab: the radio spectrum, band by band. RF / SIGINT How it works run → ---- Multi-OS Terminal Kali · Windows · macOS · Cisco IOS Interactive terminal simulator across six operating systems: Kali Linux, Windows CMD, PowerShell, macOS, Busybox, and Cisco IOS. Real command behaviour, realistic output. Hardware Calculator open → ---- OPSEC Case Files Evidence board Click-through evidence board for Sabu, DPR, Alpha02, Pompompurin, IntelBroker, Brett Johnson. The mistake, the context, the consequence. Underground Period recreation run → ---- Secure Against Whom? Threat-model picker Pick an adversary - opportunist, stalker, police, nation-state - and watch which privacy measures actually matter versus which are theatre. 'Secure' means nothing without 'against whom'. Research Calculator run → ---- Shodan: Internet Exposure Scanner ICS, medical, cameras, RDP - everything exposed Browse simulated Shodan search results: exposed Siemens S7 PLCs, hospital HL7 interfaces, IP cameras with default creds, and RDP with BlueKeep. Click any result to see the banner and CVEs. Underground Calculator simulated recreation run → ---- Spot the Real Signal Images, aliases, intermod, birdies Five blips, one real. Run three tests - attenuate, retune, change sample rate - and watch each phantom betray its type, from the mixer image that slides the wrong way to the DC spike pinned to centre. RF / SIGINT How it works run → ---- SQL Injection Lab Classic auth bypass, UNION dump, blind probe Interactive SQL injection playground. Five payload types: auth bypass, comment truncation, UNION data exfiltration, boolean blind probe, and stacked DROP (blocked). Watch queries execute and see exactly what the database returns. Malware How it works run → ---- The Both-Ends Attack What Tor can and cannot hide Play the adversary: toggle whether you watch the entry, the exit, or both, and watch the timing fingerprint correlate the moment you have both ends - despite the encryption. Then test whether a VPN or extra hops help (they do not). Research How it works run → ---- The Intercept Chain COMINT vs ELINT -> metadata Seven stages from emission to analysis, forking into ELINT and COMINT and ending where encryption cannot: the traffic-analysis metadata that survives it. RF / SIGINT How it works run → ---- Triangulate the Emitter Direction finding, drag-and-fix Drag an emitter and watch three receivers each draw a bearing. Toggle realistic error to see the fix become a 'cocked hat' region instead of a point. RF / SIGINT How it works run → ---- Trilateration + Spoofing Why GPS needs a 4th satellite Drag the receiver clock bias until the ranges snap to one fix - the 4th-satellite problem in 2D - then spoof a satellite and watch the fix lie with no error flag. RF / SIGINT How it works run → ---- What a VPN Hides, by Adversary Adversary x asset matrix Pick who you are hiding from - ISP, the site, a Wi-Fi snoop, the VPN provider, trackers, a government - and watch what a commercial VPN actually changes about each thing it could learn. Almost everything it is sold for lives in one column. Research Calculator run → ---- What Your ISP Still Sees Encrypted DNS, SNI, ECH Choose your resolver setup - ISP, third-party DoH, or your own Pi-hole + Unbound - toggle Encrypted Client Hello, and see what your ISP can still work out and who ends up with a copy of your browsing. Encrypting DNS mostly moves the watcher. Research How it works run → ---- Who Reads Your Plaintext? TLS termination and tunnels A request travels you -> middlebox -> origin. Flip between Cloudflare Tunnel, Cloudflare Flexible, a VPS reverse proxy and TCP passthrough, and watch the middle box switch between reading your plaintext and relaying sealed ciphertext. Research How it works run → ---- Your Container Is Not a Boundary Docker socket / --privileged blast radius A community-image container gets popped. Toggle the Docker socket mount and --privileged and watch the blast radius grow from the app to root on the host - and why a read-only socket mount changes nothing. Research How it works run → ---- Your Subdomains Are Public Certificate Transparency recon Issue TLS certs for internal-sounding hosts and watch them appear in the public CT logs an attacker tails on crt.sh. Switch between per-host certs, a wildcard, and a private CA to see the exposure change. Research How it works run →
syscfg@lab:~$ cat ./malware/index.db
Malware Family Database Documented malware families - tracked, analyzed, and catalogued from public threat intelligence and independent analysis.
12 Total Families · 7 Active · 2 Critical · 4 Monitored
Family Type Platform Severity Status Data as of Tags > Lumma Stealer Windows [Active] 2025-06 #maas #credential-theft #crypto +1
> RedLine Stealer Windows [Monitored] 2025-05 #stealer #credential-theft #underground
> AsyncRAT RAT Windows [Active] 2025-06 #rat #open-source #.net +1
> DarkGate Loader Windows [Active] 2025-06 #loader #rat #persistence +1
> AgentTesla Stealer / Keylogger Windows, Linux [Monitored] 2025-04 #.net #keylogger #stealer +1
> njRAT RAT Windows [Active] 2025-05 #rat #keylogger #persistence
> Remcos RAT Windows [Active] 2025-05 #rat #commercial #espionage +1
> StealC Stealer Windows [Active] 2025-06 #stealer #c-based #crypto +1
> MetaStealer Stealer macOS, Windows [Monitored] 2025-03 #stealer #macos #cross-platform +1
> XWorm RAT Windows [Active] 2025-05 #rat #hvnc #ransomware +1
> Vidar Stealer Windows [Monitored] 2025-02 #stealer #maas #telegram +1
> RaccoonStealer Stealer Windows [Inactive] 2024-10 #stealer #maas #c++ +1
Showing 12 of 12 families — click any row to expand
[DISCLAIMER] Research and educational purposes only. No malware samples, source code, or operational infrastructure are distributed. All information is derived from public threat intelligence, independent analysis, and academic research.