BOARD 01W01-04
Infrastructure & telemetry
Stand up a hardened, loopback-only estate and the first telemetry pipeline.
- Linux hardening & isolation
- Loopback lab in CI
- Wazuh agents + log pipeline
A verifiable cyber range
Defense you can verify.
Rangers run the full operation: black-box recon, red-team exploitation, blue-team detection. Every result is re-measured by the program and sealed with a cryptographic signature anyone can verify in the browser.
T1190 → T1078 → T1021.001 → T1098
↓ detected, remediated, and signed
RangerAmina Okafor
Program progress86.2%
signature valided25519:9f2a4c…e71b
The tools rangers run, from black-box recon to signed response.
What a ranger proves
Capability that is signed, not self-reported.
Defend anywhere
Stand up a monitored estate on Wazuh, Suricata and Zeek. Build detections with positive and negative fixtures and cut mean time to detect.
Learn moreStrike anywhere
Run adversary actions from Kali against your own lab, each mapped to a MITRE ATT&CK technique and paired with the detection meant to catch it.
Learn moreEngineer anywhere
Ship fixes through a protected pull request. A CI gate runs pytest, ownership checks and a secret guard. Red blocks merge.
Learn more
The program
26 weeks. 6 boards. 130 graded days.
A ranger clears one board every four to five weeks. Each board is a signed release tag, and the final board holds a 95% bar enforced by the pipeline. No board is credited on a screenshot.
95%
final board bar
BOARD 02W05-08
SOC & detection engineering
Build detections that fire on fixtures and cut mean time to detect.
- SIEM design & ingestion
- Sigma rules + Suricata/Zeek
- Cases, triage & response
BOARD 03W09-12
Ethical hacking
Reproduce real attacks against your own estate and report like a pro.
- Recon & web exploitation
- Auth / access-control abuse
- Pen-test methodology & report
BOARD 04W13-16
Secure pipeline
Ship fixes through a gate that enforces supply-chain integrity.
- Secure SDLC & CI gate
- Detection-as-code
- Signing with Sigstore / cosign
BOARD 05W17-20
Security architecture
Design resilient systems and run the operation like a lead.
- Reference architecture
- IaC & resilience
- Security operations mgmt
BOARD 06W21-26
Capstone & qualification
Blind qualification simulations, final board, and the hiring narrative.
- Integrated capstone
- Blind qualification sims
- Final board + remediation
How it works
No ranger scores themselves. The program does, and signs it.
- Program CI re-runs the same evidence scan on every repository. Editing a local status changes nothing.
- The cohort is signed with an Ed25519 key held only as a CI secret; the public key ships with the site.
- Your browser verifies the signature with WebCrypto before a single number renders.
git clone --depth=1 $repo6 repos
aggregate_cohort.pyre-measured
sign_cohort.py (CI secret)Ed25519
crypto.subtle.verify (browser)valid
cohort.json exact served bytes163,976 B
The work
What a ranger does, end to end.
One continuous operation, run on the same infrastructure a ranger is asked to protect. Black box to red, red to blue, blue to signed proof.
qw-range // loopback lab
Reproduce the attack in an isolated lab.
Black box to compromise.
The day starts on a loopback-only estate. A ranger reproduces the exploit by hand with nmap, Burp Suite and Metasploit, maps each step to a MITRE ATT&CK technique, captures a negative control, and commits the evidence before anything is credited.
Learn more
The attack surface
Every surface a ranger learns to attack, then defend.
One loop across the real estate: external exposure, identity, endpoints and the network, mapped to MITRE ATT&CK and paired with the detection that catches each.
External recon
nmap · amass · OSINT
Attack surface
Web & APIA01 · BOLA · SSRF
IdentityT1078 · T1098
EndpointT1055 · T1059
NetworkT1021 · T1071
Supply chain
images · deps · CI
Detect
Respond
Contain
Sign & verify
Loopback-only lab
Signed evidence
Live threat feed
Known-exploited vulnerabilities, turned into patch actions.
A daily snapshot of the CISA Known Exploited Vulnerabilities catalog, mapped to the MITRE ATT&CK techniques the range teaches and to the lab components they hit. Each item becomes a graded task: reproduce it, patch it, write the detection, and prove it. The feed refreshes from a scheduled GitHub Action, so the curriculum tracks what is actually being exploited in the wild.
The teams
Three teams, one operator.
A ranger rotates through every seat: the black-box adversary, the red team that breaks in, and the blue team that catches it. The program measures and signs the result.
Teams · Cohort 2026-A
Red team
AO@ranger-amina
DM@ranger-diego
3 operators
Blue team
PN@ranger-priya
SW@ranger-sam
3 operators
Program
QCqw-cohort CI
EDed25519 signer
signs cohort
Red team
Offense. From black-box recon to compromise and lateral movement, each step mapped to MITRE ATT&CK.
Blue team
Defense. Detect, triage, respond and contain, with detections the ranger engineered and proved on fixtures.
Program
The program re-measures every repository, signs the cohort with Ed25519, and verifies it in the browser.
Live exploit proof
Every exploit, caught and signed.
Rangers run the real attack. The blue side catches it on a fixture, the program measures time to detect, and the pair is sealed with one Ed25519 signature your browser re-verifies.
- Real ATT&CK techniques, reproduced in a loopback lab
- Detection fires on a fixture, time to detect measured
- Exploit and its detection sealed as one signed pair
qw-range // live engagementLIVET1190
$ nmap -sV 10.10.14.7
80/tcp open http Apache 2.4.41
$ curl -s -H 'authorization: Bearer $T' \
https://target/api/orders/1004
200 {"id":1004,"owner":"victim","total":"4210.00"}
red T1190 · broken object-level auth · access
$
blue wazuh 100210 · T1190 · level 12
alert IDOR read on /api/orders/* · @ranger-amina
MTTD 0.8sCONTAINED
signature valided25519 · 9f2a4c…e71b
Fix and prove
Every fix clears a gate the ranger cannot grade.
A ranger works the full loop: black-box recon, red-team exploitation, then blue-team detection and remediation. The fix ships as a pull request, and a CI gate enforces the controls. Red blocks merge, so the only way forward is working, reviewed, recorded code.
Black box
Red team
Blue team
Program signs
Rebuild api-gateway on a hardened base image
Opened by ranger-amina for finding 0482 SI-2
qwalora/ranger-amina
Dockerfile
3 # runtime base
4- FROM node:20.11.0
4+ FROM registry1.dso.mil/…/nodejs20:20.11.1
5 WORKDIR /app
6 COPY --chown=node:node . .
Why this fix
Rebuilds on a hardened, signed base image from Iron Bank. No application code changes.
Approval gate
Prepared byProgram
ReviewerMRMaya Reyes
Merged14:21
EnforcedAC-5 · 4-eyes reviewCM-3 · change recorded
Who it's for
Built for the people who actually run the ops.
Rangers finish the range qualified for a role, with a signed record a hiring manager can verify. The same evidence maps to the controls a security leader reports against.
SOC Analyst
Triage and respond at L2 speed, with detections you tuned yourself.
- SIEM queries & tuning
- Sigma detections + fixtures
- Case & response workflow
GRADUATES PROVING
ATT&CK detection coverage
ATT&CK detection coverage
Red Teamer
Run an intrusion end to end, from first recon to domain admin.
- Recon & web exploitation
- Lateral movement & privesc
- Operator-grade reporting
GRADUATES PROVING
TA0043 → TA0008 chain
TA0043 → TA0008 chain
Detection Engineer
Ship detections as code, each proven by a positive and negative fixture.
- Sigma / YARA authoring
- Positive + negative fixtures
- Detection in the CI gate
GRADUATES PROVING
fixture-backed detections
fixture-backed detections
Incident Responder
Contain and remediate under signature, with evidence that holds up.
- Velociraptor live hunts
- Containment & eradication
- Signed response evidence
GRADUATES PROVING
MTTD & containment proof
MTTD & containment proof
Resources
Your range, documented end to end.
Everything a ranger needs to start today: the full curriculum, the lab kit, board diagrams, and the integrity model, with easy access through one place.
Documentation
Browse the full 26-week curriculum, board rubric, and the submission and integrity model.
View docsRange kit
The complete lab, CI gate, evidence templates and scripts. Clone and bring it up offline.
DownloadBoard diagrams
Architecture and attack-path diagrams for every one of the six boards.
BrowseReady to prove it?
Clone the range and submit your first signed day today, or bring Qwalora to your workforce as a measured, auditable cohort.