A self-hosted, multi-tenant cyber range for offensive security training — isolated per-user labs, real-time IDS monitoring, and a defense-in-depth security architecture built from the ground up.
BrovanaRange is an open-source cyber range platform that lets users spin up isolated, containerized labs to practice offensive security — web exploitation, privilege escalation, and forensics — while every action is monitored by a real IDS stack (Suricata + Zeek). It's built like a production platform, not a toy: JWT auth with MFA, RBAC, rate limiting, audit logging, and an anti-cheat system that detects flag sharing and automated solving.
- 🔒 Per-user isolated lab environments — each session runs in its own Docker container with dedicated networking, auto-expiry, and resource limits
- 🛡️ Real IDS/network monitoring — Suricata + Zeek deployed to inspect lab traffic, with EVE JSON logging and custom detection rules
- 🔑 Hardened authentication — JWT + rotating refresh tokens, Argon2 password hashing, TOTP MFA, email OTP, account lockout
- 🚦 Anti-cheat system — detects fast-solve bursts, IP reuse, and cross-user flag sharing
- 📊 Full observability — audit logs, Prometheus metrics endpoint, admin dashboards for sessions/containers/anti-cheat events
- 🌐 Network segmentation — separate Docker networks for frontend/DMZ, backend, database, and per-user labs, all sitting behind an Nginx reverse proxy with TLS
Traffic flows through Nginx (TLS termination) into segmented Docker networks — frontend/DMZ, backend/internal, database, and per-user lab networks are all isolated from each other. Every lab session's traffic is mirrored to Suricata and Zeek for real-time detection, with alerts and logs feeding back into the backend for the admin dashboard and audit trail.
| Layer | Technology |
|---|---|
| Frontend | React |
| Backend | FastAPI |
| Database | PostgreSQL |
| Containerization | Docker, Docker Compose |
| Reverse Proxy | Nginx (TLS termination) |
| IDS / Monitoring | Suricata, Zeek |
| Auth | JWT, Argon2, TOTP MFA |
| Metrics | Prometheus-compatible /metrics |
BrovanaRange includes a standalone, low-interaction HTTP honeypot for capturing opportunistic scans and authentication attempts. It listens on host port 8081, returns decoy responses for common targets such as /admin and /phpmyadmin, and records JSON events to its Docker logs. It is isolated on a dedicated internal network with no access to the application, database, Docker socket, lab networks, or persistent data.
Admins can review captured honeypot hits from the Admin dashboard. The backend ingests recent honeypot container logs, stores deduplicated events, classifies sensitive-path probes, and can enrich public source IPs with VirusTotal reputation data.
To enable VirusTotal IP reputation checks, set this in .env:
VIRUSTOTAL_API_KEY=your_api_key_here
VIRUSTOTAL_MALICIOUS_THRESHOLD=1
VIRUSTOTAL_CACHE_HOURS=24When the API key is not configured, honeypot events still appear in the dashboard, but reputation fields show that VirusTotal enrichment is disabled.
Run and monitor it with:
docker compose up -d --build honeypot
docker compose logs -f honeypotDeployment and safety details are in honeypot/README.md.
| Lab | Focus | What the learner does |
|---|---|---|
| Linux Privilege Escalation | Linux | Enumerates a sudo misconfiguration and recovers a dynamic root flag. |
| Red Injection | Web exploitation | Exploits a vulnerable local service and recovers a dynamic flag. |
| Skeleton DFIR | Digital forensics | Investigates a compromised container and its evidence. |
BrovanaRange is designed with a defense-in-depth approach across every layer:
Network Security
- HTTPS/TLS via Nginx, HTTP→HTTPS redirect
- Backend, frontend, and database ports never exposed publicly
- Docker network segmentation: separate frontend/DMZ, backend, database, and per-user lab networks
- UFW firewall with default-deny inbound policy
- Attack surface verified via Nmap scans
Container Security
- Isolated Docker container per lab session, per user
- Auto-expiring sessions with automatic cleanup
no-new-privileges, dropped Linux capabilities by default- CPU/RAM/PID limits enforced per container
- gVisor (runsc) sandboxing support;
runconly where privilege-escalation labs require it - No host folders mounted into lab containers; Docker socket never mounted directly into backend
Authentication & Authorization
- JWT access tokens + rotating refresh tokens, logout/logout-all session revocation
- Argon2 password hashing (legacy bcrypt verification supported)
- TOTP MFA and email OTP challenge support
- Account lockout after repeated failed logins
- Role-based access control (RBAC), admin APIs restricted by role
- Session/terminal ownership verification — users can't touch each other's labs
Rate Limiting & Anti-Abuse
- Rate limiting on login, registration, lab start, and flag submission
- Mitigates brute-force, automated flag guessing, and resource exhaustion
Anti-Cheat System
- Detects fast-solve bursts, suspicious IP reuse, and cross-user flag reuse
- Flags are dynamic and per-session, hashed before validation, redacted in storage
- Admin dashboard for anti-cheat events
IDS & Network Monitoring
- Suricata deployed in Docker, monitoring lab network traffic with EVE JSON + fast.log alerting
- Custom detection rules (ICMP, HTTPS traffic)
- Zeek generating connection, DNS, DHCP, and anomaly logs
Monitoring & Observability
- Full audit logging: auth events, lab lifecycle, flag submissions, admin actions
- Honeypot event dashboard with optional VirusTotal IP reputation enrichment
- Automatic expired-lab cleanup with an admin override button
- Admin controls for stopping active lab sessions
- Blocked IP watchlist populated by VirusTotal reputation results
- Admin security summary report with 24h and 7d security metrics
- CSV exports for honeypot events, audit logs, anti-cheat events, and blocked IPs
- Admin Alert Center for high-priority honeypot, VirusTotal, auth, anti-cheat, and lab cleanup events
- Prometheus-compatible
/metricsendpoint - Admin dashboards for sessions, containers, and audit logs
Full security architecture writeup: docs/SECURITY.md
git clone https://github.com/Aymwvn/BrovanaRange.git
cd BrovanaRange
cp .env.example .env
# edit .env with your own secrets before starting
docker-compose up --buildFrontend will be available at https://localhost (self-signed cert on first run).
BrovanaRange/
├── backend/ # FastAPI app (auth, labs, API)
├── frontend/ # React dashboard
├── ids/ # Suricata + Zeek configs/rules
├── docs/
│ ├── SECURITY.md # Full security architecture doc
│ └── screenshots/
├── docker-compose.yml
├── .env.example
├── LICENSE
└── README.md
- Automatic IPS blocking (currently passive IDS)
- SIEM integration + centralized logging dashboards
- WAF deployment
- Kubernetes network policies / cloud security groups
- Firecracker/Kata microVM isolation for labs
- Trusted public TLS certificates for production deploys
MIT — see LICENSE
Aymane Boualam — github.com/Aymwvn