PhantomWave Cyber Range

Enormous-Air, a major airline, has migrated its infrastructure to the Google Cloud Platform for scalability and stability.

Its cloud environment has never been tested. The job is to assess it end to end: exploit web-facing vulnerabilities to gain an initial foothold, then chain misconfigurations to move deeper and escalate across the GCP estate without destabilizing production.

Pwned Labs runs the engagement in a private Google Cloud and Google Workspace instance for your team, with scoring, checkpoints and an after-action review.

• Working knowledge of GCP and the Linux CLI
• Knowledge of web vulnerabilities (OWASP Top 10)
• Experience assessing cloud infrastructure
• Ability to undertake independent research

Practice this at Pwned Labs

Pwned Labs teaches the Google Cloud storage, service account and web-to-cloud skills that PhantomWave draws on in individual labs. The first lab below is free.

• Reveal Hidden Files in Google Storage (Free, Beginner): enumerate a Google Cloud Storage bucket that will not list its contents, discover hidden objects with ffuf, and crack an encrypted 7-Zip archive with Hashcat.
• Impersonate GCP Service Account for Privileged Access (Premium, Beginner): recover a service account key from an exposed .git directory, escalate through service account impersonation, and read a Cloud Source repository to reach a Cloud SQL database.
• Infiltrate GCP via WebApp Exploitation (Premium, Intermediate): turn a SQL injection into command execution, find service account credentials in instance metadata, and abuse dangerous GCP permissions to move laterally.

As organizations migrate to Google Cloud, it is critical that they thoroughly examine and lock down their services.

A single misconfiguration or overly permissive service account can be the foothold a threat actor needs to gain access and move laterally across the environment.

Pwned Labs teaches identity-driven attack paths across GCP IAM, service accounts and Google Workspace in its Google Cloud Attack and Defense bootcamp, which leads to the hands-on GCRTP (Google Cloud Red Team Professional) certification.

Frequently asked questions

What is the PhantomWave scenario?

Enormous-Air, a fictional major airline, has migrated its infrastructure to Google Cloud for scalability and stability, and its cloud environment has never been tested. You assess it end to end, exploiting web-facing vulnerabilities for an initial foothold and then chaining misconfigurations to move deeper across the GCP estate.

Is PhantomWave a red team or a blue team range?

PhantomWave is a red team range in the Pwned Labs SkyFall Enterprise Cyber Range Collection, built for red teamers, penetration testers, cloud security engineers and CI/CD security specialists. Red and blue teams can run side by side in it with role-based access controls.

Which platforms does PhantomWave cover?

Google Cloud and Google Workspace. The attack path runs from a web application into a Google Cloud project, through storage buckets and source repositories, metadata tokens, IAM and a CI/CD pipeline, and into data held in Google Workspace.

What skills do I need before starting PhantomWave?

Working knowledge of GCP and the Linux command line, knowledge of web vulnerabilities (OWASP Top 10), experience assessing cloud infrastructure and the ability to undertake independent research. The labs above are a starting point.

How do teams get access to PhantomWave?

Pwned Labs delivers PhantomWave as a private instance for your team, with scoring, checkpoints and an after-action review. Teams can see it in action and request pricing through a demo request.

Can PhantomWave be matched to our own environment?

Custom scenarios matched to your own stack are available from Pwned Labs on request.