cybersecurity-edu — Defensive/Analysis Security Teaching Arsenal

Purpose: Support elite (MSc/PhD) cybersecurity teaching: how attacks work (for defenders), malware analysis, reverse engineering, forensics, detection engineering, CTF, secure coding. All work is analysis/defensive/lab-oriented.

Installed (Python, /usr/bin/python3, verified 2026-06-21)

• Reverse engineering / static: capstone 6.0, unicorn 2.1, pefile, lief, flare-capa (capa), r2pipe, rzpipe
• Detection/classification: yara-python 4.5
• Memory forensics: volatility3 2.28
• Network analysis: scapy 2.7
• CTF / exploitation teaching: pwntools 4.15 (+ ropgadget, pyelftools, vivisect)
• Detection engineering: sigma-cli / pysigma, mitreattack-python (ATT&CK)

Typical workflows

• Malware static triage: capa <sample> + YARA rules + pefile/lief for PE/ELF structure.
• Behavioral/dynamic: run sample ONLY inside the isolated Docker/VM lab (see lab/), capture with scapy/tshark.
• Memory forensics: vol -f mem.raw windows.pslist etc.
• Detection authoring: write Sigma rules → sigma convert to SIEM backends; YARA for file signatures.
• CTF teaching: pwntools for exploit-dev exercises against the lab's intentionally-vulnerable targets.

CLI tools (host VPS, via SSH)

• ✅ Installed on host (2026-06-27): radare2, nmap, tcpdump.
• ⏳ Optional (large / not yet): Ghidra (headless, needs Java ~1GB), Suricata, Zeek, Wazuh — install on host on request.

Deploy on the host VPS via SSH, or request and we add the brew-available ones.

Lab (isolated training targets) — lab/

Docker Compose for DVWA + OWASP Juice Shop + CTFd on an internal-only network. Runs on the HOST (the openclaw container has no docker.sock). See lab/README.md.

Boundary (locked, honest — 2026-06-21)

Full depth on legitimate defensive/analysis/lab teaching. We do NOT build or install safety-bypass/jailbreak tooling, and we do NOT produce deployable weaponized malware intended to harm real third parties. Education uses analysis, defanged/annotated samples, isolated-lab PoCs, and detection — exactly like top security programs (SANS/MIT/CMU).