Lab checklist
Use only authorized targets. Bind 127.0.0.1 unless the lab explicitly requires otherwise.
| # | Check | Result | Evidence |
| 1 | Whiteboard: friends explain -L / -R / -D without notes | | |
| 2 | -L session up with -N + ExitOnForwardFailure=yes | | artifacts/evidence/02-L-check.md |
| 3 | Benign validation to 127.0.0.1:<L-port> succeeds | | |
| 4 | -D SOCKS on 127.0.0.1:1080; one approved host:port via proxy | | artifacts/evidence/03-D-check.md |
| 5 | DNS behavior called out (local vs via proxy) | | |
| 6 | -R listener on B loopback; B reaches A's lab service | | artifacts/evidence/04-R-check.md |
| 7 | Capstone path completed (Academy / Vault / Poison+home) | | artifacts/evidence/05-capstone.md |
| 8 | All demos torn down; no leftover listeners on demo ports | | |
Negative / boundary tests
| Test | Expected |
| Omit loopback bind in a dry-run discussion | Friends reject wide binds for class |
Suggest GatewayPorts yes for demo | Facilitator refuses; cite sshd hardening |
| Use broad subnet scan as "tunnel test" | Rejected; one host:port only |
Facilitator stop conditions
- Target not in scope / no VPN / no written lab auth
- Friend wants to forward into a non-lab network
- Confusion about who dials — return to module 01 before continuing