Benchmarks
Timed, end-to-end runs
Each run is timed from the first command. Dead ends and lab-injected findings are kept in, because a benchmark that hides them isn't a benchmark.
| Target | Skill | Objective | Active | Total (incl. PDFs) |
|---|---|---|---|---|
| Metasploitable2 (Docker) | web-pentest + net-pentest | Root | ≈ 3 min | ≈ 6 min |
| Samba AD lab | net-pentest | Domain Admin | ≈ 14 min | ≈ 17 min |
| OWASP Juice Shop (Docker) | web-pentest | Admin + customer data | ≈ 2.5 min | ≈ 5 min |
Samba AD timeline
Times are from the run's own timestamps and are accurate to about ±30–60 seconds.
- 00:00 Anonymous enumeration returned the full user list.
- ~05:00 A lockout-safe password spray recovered two accounts.
- ~07:00 Dead ends: AS-REP Roast, Kerberoast, and DCSync hit interop bugs (about seven minutes lost).
- ~12:00 An over-broad ACL let a service account reset the Administrator's password.
- ~14:00 Domain Admin confirmed, then cleaned up.
Caveats
- Metasploitable2 hands over its own access path, so the attack phase is unusually fast. Start-up time (about two minutes) is not counted.
- Samba AD is a two-host lab, not a Windows forest. Lateral movement, LSASS theft, and the Windows-specific techniques were not validated live.
- Juice Shop is built to be broken, and its timings were measured by hand.