0.4 The advanced lab

You need more than a laptop now. Do not use anything shared with real work or real data.

Cloud sandboxes. A dedicated account per provider you care about, with hard spending limits.

   AWS   a standalone account (NOT in your company org). Set an AWS Budgets
         alert at $5 and an actions-enabled budget that stops resources at
         $20. Consider `aws-nuke` (carefully) to tear everything down nightly.
   GCP   a fresh project under a personal billing account with a budget
         alert + a Cloud Function that disables billing at a cap.
   Azure  a Pay-As-You-Go subscription with a Spending Limit or a Cost
         Management budget + alert.
   FREE / no-card options for parts of this:
     localstack (AWS APIs locally), cloud provider free tiers,
     Google Cloud Skills Boost / AWS Skill Builder sandboxes (time-boxed),
     and the deliberately-vulnerable targets below.

Deliberately vulnerable cloud targets (safe, designed for this):

   CloudGoat (Rhino Security Labs)   -- scripted vulnerable AWS scenarios
   IAM Vulnerable (BishopFox)        -- 30+ IAM privesc paths, Terraform
   flaws.cloud / flaws2.cloud        -- hosted AWS challenges, no account needed
   TerraGoat / CfnGoat / KubernetesGoat (Bridgecrew)  -- vulnerable IaC / k8s
   sadcloud, cdk-goat, AWSGoat, GCPGoat, AzureGoat

Local Kubernetes. kind (Kubernetes in Docker) or k3d/k3s or minikube. Add: kube-bench, kubectl, helm, krew + plugins (kubectl-who-can, rakkess, access-matrix), kubeaudit, Falco (or Tetragon/Tracee), OPA/conftest, Kyverno, Cilium. Plus Kubernetes Goat and Kubernetes CTF (kctf) for practice.

Web-exploitation targets (Part 6): PortSwigger Web Security Academy (the advanced labs — smuggling, deserialization, race conditions, OAuth, SAML are all there), plus Gin & Juice Shop, and vulnerable apps you deploy yourself so you can also fix them.

Attack tooling (lab / authorised use only):

   Cloud:      pacu, ScoutSuite, Prowler, CloudFox, enumerate-iam, PMapper,
               cloudsplaining, Stratus Red Team, leonidas, aws-nuke
   K8s:        kube-hunter, peirates, kdigger, bad-pod recipes, studious?,
               kubeletctl, KubiScan
   Web:        Burp Suite Pro (Repeater, Turbo Intruder, HTTP Request
               Smuggler, Param Miner, Collaborator), ysoserial /
               ysoserial.net, marshalsec, PPScan / ppmap, sqlmap, tplmap
   Detection:  Atomic Red Team, CALDERA, Stratus Red Team, Falco,
               Sigma + sigma-cli, Elastic/OpenSearch, Wazuh, Security Onion
   Identity:   samling / SAMLRaider (Burp), oidc-attack tooling

A lab notebook. ~/sec-lab/adv/ with reports/ — one write-up per Part's hands-on, in the MODEL/ATTACK/DETECT/DEFEND format. These become your portfolio (Ch 70).