Learn security by doing — no VM, no setup pain.

Eleven hands-on labs that run in Docker and open in a friendly console or your browser. Real tools — nmap, Wireshark, John the Ripper, iptables — with the plumbing hidden. You just log in and start.

Get started Browse the modules

bash — ./start.sh

  +=================================================+
  |   A S S U M E   B R E A C H   ·   S E C U R I T Y  |
  |   Network Security Workstation · Module 07       |
  +=================================================+

  Connection established. You are logged in.

  lab> rules load
  lab> ping pc3 pc1
  [pc3] $ ping 10.1.1.2
  From 10.1.2.254  Destination Host Unreachable
  lab>

Get started

First time? About 10 minutes — most of it Docker installing. Done once.

Install Docker Desktop

Free, one-time, and the only software you need. Download for your system ↗, install it, and start it — wait until it shows “running”.

Download the labs — no git needed

⭳ Download the ZIP, then unzip it. You'll get a folder named assume-breach-labs-main — put it somewhere easy, like your Desktop.

On Windows, “Extract All” nests it one level deeper — assume-breach-labs-main\assume-breach-labs-main. That's normal: the inner folder (the one containing start.bat) is the one you want. Move it somewhere easy and delete the empty outer one.

Launch it

Open the folder and double-click start.command.
First time only: if macOS blocks it, right-click the file → Open → Open.
A Terminal window opens, the machines boot, and you land at the lab> prompt. Pick a module (see the cards below) and follow it.

Prefer the terminal? Open Terminal, type cd (with a trailing space), drag the folder onto the window, press Enter, then run ./start.sh

One-time: install Git for Windows — it's the lab launcher. Run the installer and click Next through every screen; the defaults are all fine.
Open the unzipped folder — the inner one, containing start.bat — and double-click start.bat.

If a window flashes open and vanishes: right-click an empty spot inside the folder → Open in Terminal, type .\start.bat and press Enter — the message stays on screen. It usually says Docker Desktop isn't running yet.

Open a terminal in the folder — in most file managers, right-click → Open Terminal Here.
Run ./start.sh and pick a module.

Or from any terminal: cd path/to/assume-breach-labs-main && ./start.sh

The twelve modules

Independent — pick any. Click a card for what it teaches and how to run it.

Part of the Assume-Breach series

Hands-on security labs across the lifecycle — plus two companion books and a game that tie it together. Found one? Here's the rest — or browse the whole series on the series home.

Offensive · break inEthical HackingRecon, scan, and exploit your way in Offensive · move throughLateral MovementPivot deeper once you have a foothold

DefensiveAssume BreachYou are here

Post-breachDigital ForensicsReconstruct the incident from the evidence Govern · auditSecurity AuditAudit a company against the Essential Eight The gameIncident Zero ↗Play the whole lifecycle — print & play The bookAssume Breach ↗The defender's-mindset thesis behind the labs The bookSubstantiate, Don't Assume ↗Security audit & controls — prove it, don't assume it