capstone
05 — Capstone
Learning objectives
- Complete one capstone path (Academy / Vault / Poison+home).
- Meet the three friend success criteria and record cleanup evidence.
Intuition
Under mild pressure, pick the narrowest forward that still works — then tear it down.
Practitioner
Goal: Use the right flag under mild pressure; debrief OPSEC/cleanup.
Pick one path
| Path | Who | What to force |
|---|---|---|
| A — Academy | Best default | Finish pivoting/tunneling exercises that use -L, -R, -D |
| B — Vault | VIP+ / retired access | Pause at each forward; name the flag before typing |
C — Poison + home -R | Free / lighter | Poison for -D/-L; tiny home lab for -R |
Capstone script (facilitator)
- Freeze the room: draw A/B/C for this target.
- Before each forward: friend nominates a flag + bind address.
- Run narrow validation only (one URL / one TCP connect).
- Debrief: narrowest flag that would have worked; what showed up in auth logs / long SSH session / listeners.
Success criteria (friends)
- Explain
-Lvs-Rvs-Dwithout notes - Build and verify one of each with loopback binds
- Choose the right flag for a new scenario in under a minute
Cleanup checklist (always)
# On A after Ctrl-C
lsof -nP -iTCP -sTCP:LISTEN | egrep '8080|1080|18080' || true
Record: client, server, listeners, ports, start/end, one validation, tear-down confirmation — same spirit as the peachcyber note.
Out of scope (point forward, don't teach today)
ligolo-ng, chisel, full mesh pivots, GatewayPorts, production jump hardening — after this course clicks.
Cite: [S-HTB-ACAD-01], [S-HTB-VAULT-01], [S-HTB-POISON-01], [S-PC-01].
Deep dive
After this course: ligolo/chisel and multi-hop pivots — only once -L/-R/-D are boring.
Check
Success criteria 1–3 met; artifacts/evidence/05-capstone.md filled.