Cyber90s is an interactive cybersecurity lab training environment built with real historical exploits from the early internet era. Each module puts you inside an isolated lab where you discover, understand, and demonstrate an attack, in a real shell.

Feel like you missed out on the wild-west of security in the 90s? The goal of this lab is to understand the underlying mechanics that made these attacks possible and why they worked for so long.

Here is what you can expect when you enter a lab. The left pane is your main attack terminal, the right pane shows the mission briefing and steps. Of course, goes without saying this is intended on desktop environment, not mobile.

The lab modules will increase in difficulty, yet they will also include 3 levels of hints to help you figure out the solution. However basic UNIX knowledge, comfort within a terminal, and scripting experience will be required for most labs.

Additionally, basic networking experience with understanding of common network protocols (HTTP, telnet, SSH, etc.) with understanding of IP addresses, etc. is needed.

New to any of this or need a refresher? The Field Manual (Wiki) covers the terminal, tcpdump, netcat, SMTP, encryption and commands the labs rely on to assist you.

A living reference for the tools and concepts behind the labs lives in the Field Manual. It explains what each command does and why. It will assist with the terminal basics, common commands, port numbers, encryption, and other fundamentals.

Telnet is a protocol that allows remote acess to command-line interface to another machine formalized in the 1970s.

Easy enough except that it transmits all information in plaintext, meaning nothing is encrypted.

If someone is snooping around on your network, they can simply see the username and password of remote machine! In this session you will do just this to gain unauthorized access to a remote server, with a fun 90s twist.

SMTP (RFC 821, 1982) is how mail servers exchange messages — a plain-text, line-based conversation you can hold by hand over a raw TCP connection. Its fatal flaw: the server takes your word for who you are. Whatever you type in "MAIL FROM" becomes the sender, with no verification whatsoever.

Through the 90s most mail servers ran as open relays, forwarding mail from anyone to anyone. Combined with SMTP's blind trust, that meant you could send a message as literally any person or company. This is the origin of email spoofing and phishing, and the reason SPF, DKIM, and DMARC had to be invented later to bolt authentication onto a protocol that had none.

In this lab you telnet into an open relay by hand and forge an email impersonating the boss, watching the server accept a sender it has no business trusting.

The Character Generator Protocol (RFC 864, 1983) was designed as a simple network debugging tool. Send a UDP packet to port 19 — any packet — and the server responds with up to 512 bytes of ASCII characters.

By the early 90s, attackers had figured out that this created a massive amplification vector: one byte in, 512 bytes out. Flood a chargen server and you could generate bandwidth far exceeding your own connection. Forge the source IP and you could direct that traffic anywhere.

In this lab you discover the service, build your own flood, and verify the amplification ratio all from a browser terminal with no setup required.

Every TCP connection begins with a three-way handshake: SYN, SYN-ACK, ACK. Between the second and third step, the server holds a half-open connection in a fixed-size queue while it waits for the client to finish. That queue is a finite resource.

A SYN flood weaponizes this by firing a torrent of SYN packets — often with spoofed source IPs — and never completing the handshake. The queue fills with half-open connections that never resolve, and the server can no longer accept legitimate users. In 1996 this technique took Panix, one of the oldest ISPs, offline for days and forced the invention of SYN cookies.

In this lab you flood a legacy web service with SYN packets and verify that your flood has exhausted its connection queue.

DES (Data Encryption Standard) was a encryption algorithm developed by IBM in the 1970s and was overall used as an encryption standard up until the 1990s. Controversy arose with the NSA adopting a slightly modified version of the algorithm, and conspiracy theories arose whether the NSA could crack it.

The core issue with DES is the relatively short key size (56-bits) which can be brute-forced as computer hardware improved with time. By 1998, the Electronic Frontier Foundation (EFF) spent ~$250,000 on top of the line hardware and cracked a DES key by brute forcing the entire key space and decrypted a message in 3 days.

Of course, nowadays our modern hardware is even more powerful than this expensive machine. In this lab you will pretend to be a top-of-the-line encryption cracker, exposing an encrypted message by cracking DES!

Each lab runs inside an isolated Docker network with no internet access. The attack environment is a hardened Debian container with only the tools needed for the exercise. The chargen server runs on a separate container at a fixed IP, reachable only from within the lab network. Everything resets between sessions.

Currently in Alpha, access is only provisioned and provided to testers at the moment.