OSI Cyber Explorer — laboratorio interattivo e bilingue (IT/EN) per studiare il modello OSI, l'incapsulamento dei pacchetti e la cybersecurity di rete livello per livello.
A phase-based roadmap for backend engineers moving into FDE and AI Engineer roles — decoding the title chaos, the applied LLM stack, and the interview loop.
Hedy is a gradual programming language to teach children programming. Gradual languages use different language levels, where each level adds new concepts and syntactic complexity. At the end of the He
A collection of formalised mathematical conjectures in Lean 4, using Mathlib.
Translation pending
8h +1★ 1,339Education
Do you operate this project?
Owners of public repositories under a personal GitHub account can sign in to verify ownership and manage the introduction themselves. No administrator approval is needed.
Organization repository · verify with a repository file
Sign in, generate a verification file, and commit it to this repository’s default branch within 30 minutes. Files on other branches or forks do not count. Then check the file below to manage the project without administrator approval. Keep the file to retain your access.
If needed, you will go to sign-in. After signing in, return here and press your chosen verification button again.
Run /nomorevibe verify in your project folder to verify ownership and manage the introduction yourself.
Interactive bilingual laboratory for exploring the seven OSI layers, packet encapsulation, network attacks and their corresponding defenses.
Taken from the repository README
README
Loading the full README. The saved excerpt is shown below.
A bilingual networking and CCNA 200-301 lab for observing data flows, simulating attacks, and understanding the corresponding defenses.
Overview
OSI Cyber Explorer turns networking, encapsulation, and network security into a visual laboratory. It connects the six CCNA 200-301 v1.1 domains to attack families and their defenses, while distinguishing real protocol headers from conceptual upper-layer OSI functions. Everything is deterministic and client-side; there is no backend and no AI involved.
A bilingual networking and security lab for the CCNA 200-301 and eJPT paths: observe data flows, study attack methodology, and understand the corresponding defenses.
🇬🇧 English
Overview
OSI Cyber Explorer turns networking, encapsulation, and network security into a visual laboratory. It connects the six CCNA 200-301 v1.1 domains to attack families and their defenses, while distinguishing real protocol headers from conceptual upper-layer OSI functions. Everything is deterministic and client-side; there is no backend and no AI involved.
Attack content is a non-executing simulation for owned or explicitly authorised environments. Payloads are inert or redacted, every scenario is paired with defensive context, and the offensive-content review policy is enforced in CI.
Network examples use private, local, or documentation-reserved targets. A repository-wide CI gate prevents public IPv4/IPv6 addresses or unapproved domains from becoming copyable lab targets.
Ports, platform commands, deprecated protocols, cryptographic guidance, CCNA, and ATT&CK references follow an enforced six-month technical-content review. Every completed review is append-only, evidence-backed, and version-pinned; CI rejects expired records or source-version drift without a new decision.
Initial and lazy-route JavaScript are protected by versioned performance budgets. Size Limit and the Vite manifest block bundle regressions locally, while Lighthouse CI checks the real OSI and Ports routes; the bundle treemap keeps future optimisation evidence-based. The list-performance profile records the measured glossary improvement and why virtualisation was not introduced.
Features
Study manual — A bilingual handbook of the topics to study, aligned to CCNA 200-301 and CompTIA Security+ SY0-701. Each topic gives learning objectives, prerequisites, a step-by-step explanation, a worked example, the mistakes learners actually make, and references; it then hands off to guided labs — exercises with a concrete task, guided steps, an autonomous challenge, a revealable commented solution and self-check criteria — that open the matching interactive lab. Its chapters span the full CCNA 200-301 backbone (OSI and encapsulation, Ethernet/switching, IPv4 subnetting/VLSM, VLANs/802.1Q/Spanning Tree, routing with OSPF, IP services, security fundamentals, attacks and the kill chain, network defenses, components and architectures, IPv6, access/EtherChannel/wireless, extended IP services, CCNA security, automation), a Security+/advanced extension (cryptography/VPN/PKI/TLS, identity and AAA, hardening/detection/incident response, segmentation, routing and control-plane security, availability and DoS, management-plane and telemetry security, resilience and recovery, access-layer Layer 2 security), and a dedicated eJPT penetration-testing track (methodology, web application testing, exploitation and post-exploitation) taught authorization-first and paired with the defense that stops each technique. Its offline pivoting lab contrasts an authorized /32 route with single-port forwarding; its password and hash workbench compares online rate limiting, account lockout and spray detection against synthetic offline KDF cost and unique salts. Neither lab uses external targets or real credentials. A bilingual study path sequences the two certification tracks.
Concept diagrams — Bilingual SVG explanations of perimeter/internal traffic, email delivery and penetration-test phases, with text alternatives and light/dark support.
eJPT Web Application Lab (EJPT-06) — Offline fixtures for HTTP reconnaissance, content discovery, login throttling, and BOLA/IDOR classification. It shows request-response evidence, server-side fixes, and regression checks; it sends no traffic, uses no credentials, and contacts no external endpoint.
Shareable lab URLs — Every view has a registry-derived #/<id> route, bilingual page title, native links and predictable refresh/Back/Forward behavior. Unknown routes return to the integrated learning map. See lab URL behavior.
Certification Map — The official CCNA and eJPT domains with weights, objectives, subobjectives, evidence levels, and real destinations. Its tracks 53 CCNA 200-301 v1.1 objectives and 58 subobjectives plus all 22 eJPT objectives, separating theory, guided exercises, interactive labs, and partial coverage. Tests reject stale destinations and operational objectives declared complete without an exercise. It is an exploratory guide with no quizzes, scores, or exam simulation.
The top menu has two entries: Manual and a single Labs dropdown, with labs organised under four area headings. Quick search (Ctrl/⌘ + K) filters labs by name, protocol or topic.
Every screen is available in Italian and English, switchable with one click. UI preferences (language, audio, speed) persist across reloads.
Open the global Guide in the header for application help. The manual has two study routes (CCNA and eJPT), collapsible CCNA domain sections on desktop and a compact chapter selector on mobile. Each topic also has a formative “studied” toggle that feeds a per-chapter topics-studied tally — a learner’s own record of what they have worked through, not a score, answer key or exam simulation. Once there is any progress, the chapter index shows a resume-studying summary that aggregates topics studied and links straight to the next chapter to pick back up. Chapter and topic progress stay in the current browser and share one reset. See manual help and persistence.
Studying for both certifications? The study path sequences the manual toward CCNA 200-301 and eJPT, with the explicit prerequisites that tie the offensive methodology back to the networking foundation.
Content (src/content/) is kept separate from logic (src/lib/) and UI, so adding an attack or a layer means editing data, not code. Each dataset is its own module, so a lab downloads only the content it actually uses.
Getting started
Requires Node.js 22.22.2+ or 24.15+ (24 LTS recommended, see .nvmrc) and npm.
npm ci # install the exact versions from package-lock.json
npm run dev # start on loopback only: http://127.0.0.1:3000
npm run dev:network # explicitly allow access from the local network
npm run build # production build
npm test # run the test suite (Vitest)
npm run test:coverage # test suite, logic coverage reports and blocking thresholds
npm run test:e2e # Playwright smoke tests on Chromium against the production build
npm run typecheck # TypeScript type-check
npm run format:check # verify the shared Prettier style without changing files
npm run verify # type-check, lint, tests with coverage and build, as in CI
npm run dev is the secure default and does not expose Vite to other devices. npm run dev:network binds the development server to every network interface; use it only when LAN access is required, on a trusted network and with an appropriate host firewall. The Vite development server is not intended for public or production exposure.
Verifiable releases
Tagged releases follow Semantic Versioning and include a deterministic application archive, CycloneDX SBOM, SHA-256 checksums, and GitHub/Sigstore provenance and SBOM attestations. See the changelog and the release verification procedure.
What this project demonstrates
Front-end engineering with React 19 + TypeScript, centralized state (Zustand) and a clean data/logic/UI separation.
A deterministic encapsulation/decapsulation state machine and testable, framework-free logic (src/lib).
Internationalization (IT/EN) without external libraries, plus accessibility (a skip link to the main content, an ARIA combobox quick search, a labelled glossary search with a live result count, OSI layer states exposed as localised text and aria-pressed (not colour alone), a copy-link control that shares the current lab, overflow scroll affordances for the navigation on narrow screens, focus states, aria labels, reduced-motion support).
Responsive layout verified at 390 px and 768 px: no horizontal page scrolling, comparison tables that become cards on narrow screens, and CLI output kept monospaced inside its own scroll area.
Engineering hygiene: unit tests, CI (type-check + test + build), no dead dependencies.
Solid networking & security domain knowledge across all 7 OSI layers.
License & terms of use
Released under the GNU GPL-3.0 License. You may use, study, modify and
redistribute the project while preserving the copyright and licence notice.
Path Trace Lab — Follow one packet across the whole topology and watch each decision in the order it happens: the host's local-or-remote test, ARP or the default gateway, the switch's CAM lookup, the trunk's allowed list and native VLAN, the SVI, the ACL in the direction it is actually applied, the routing decision, and NAT overload. Both directions are traced, so a stateless ACL applied inbound on a single SVI is visibly filtering one direction and not the other.
Network Fundamentals Lab — IPv4 and subnetting explorer with network, broadcast, hosts, subnet mask, wildcard mask, and binary representation; IPv6 explorer that also accepts IPv4-embedded mixed notation; TCP/UDP comparison, interface diagnostics, network components with the decision each one makes and the boundary it creates, topology architectures from two- and three-tier to spine-leaf, WAN and cloud, copper and fibre cabling with T568A/B pinouts and autonegotiation, switching concepts (learning, forwarding, flooding, aging), virtualization fundamentals (hypervisors, containers, VRFs), client-side IP verification per operating system, and attack-defense links. A VLSM planner turns one block and a list of host requirements into an addressing plan: it allocates from the largest requirement down — the ordering rule that makes the arithmetic fit — and reports the addresses each subnet wastes, the share of the block consumed, and the first address still free. An MTU and fragmentation exercise computes what a tunnel really leaves for the inner packet (GRE, IPsec, GRE over IPsec, VXLAN, PPPoE), splits an oversized packet into fragments whose payloads are multiples of 8 bytes because the fragment offset counts in 8-byte units, and shows the two ways a router refuses instead: ICMP type 3 code 4 when DF is set, ICMPv6 Packet Too Big in IPv6, where routers never fragment at all.
Network Access Lab — VLAN, 802.1Q trunking, STP/RSTP with both short and long path-cost methods, EtherChannel, radio and 802.11 principles, device/AP/WLC management access, and a described WLC GUI walkthrough for a WPA2 PSK WLAN, with deterministic simulations and a bilingual Layer 2 attack-defense matrix. STP convergence then runs the real algorithm on a four-switch mesh holding three physical loops: root election on the Bridge ID, cumulative path cost, one root port per non-root switch and one designated port per segment, with the criterion that actually decided each port named explicitly — cost, Bridge ID, or Port ID — and the per-VLAN trees of PVST+ visible by switching VLAN. A CAM table exercise replays a frame sequence and labels each decision — forwarding, flooding, filtering — with the reason behind it, covering unknown unicast (flooded, yet not a broadcast), the frame filtered because its destination sits on the ingress port, MAC moves, aging on 300 seconds of inactivity, and the VLAN keying that keeps an address known in one VLAN unknown in another. A Port Security exercise then shows why the three violation modes are not interchangeable: protect drops in complete silence, without even incrementing the violation counter; restrict drops, counts and reports; shutdown — the default — err-disables the port and takes the legitimate host down with it.
IP Connectivity Lab — Annotated show ip route output, interactive routing-table lookup, longest-prefix match, static routes, OSPFv2 cost and adjacencies, a non-preemptive DR/BDR election you can observe, first-hop redundancy (HSRP/VRRP), and control-plane protection. An SPF exercise runs Dijkstra over a five-router single-area topology, keeping a set of equal-cost predecessors so equal-cost multipath is visible rather than arbitrary: two paths tie at the default reference bandwidth, one of them is ten times faster, and raising auto-cost reference-bandwidth removes the tie and picks the fast link. Links can be failed to watch the tree reconverge and routers fall out of reach.
IP Services Lab — DHCP/relay and DNS from the client's point of view, NAT/PAT with range-accurate port allocation, NTP, SNMPv3, Syslog, QoS, and SSH with interactive calculations, IOS configurations, and an attack-defense matrix. A DORA exercise walks the exchange message by message with addresses, UDP ports and the giaddr field, explaining why the REQUEST is broadcast again after the client has already chosen its server, and reproducing the ways the exchange fails while looking configured: a missing ip helper-address, an exhausted pool, DHCP snooping dropping a server message on an untrusted port, and Option 82 arriving with giaddr at zero.
Security Fundamentals Lab — IPv4 ACL evaluator, AAA, VPN/IPsec, firewalls, IDS/IPS, PKI, NAC, WEP-to-WPA3 comparison with a WPA2 PSK deployment sequence, wireless and endpoint security with IOS hardening and defense limitations. A reverse wildcard builder works in the direction requirements actually arrive in: give it a range of addresses and it produces the ACE, saying whether one wildcard covers the range exactly or how many extra addresses it drags in. An ACL builder turns requirements into an ordered list and then performs the analysis nobody does by hand, comparing the bits each wildcard forces to match: it separates an active line from a dead one (covered by an earlier line that decides the opposite — the reason an apparently configured deny blocks nothing) and from a merely redundant one, proposes an order in which none is dead, and fires a test packet through the result.
Automation & Programmability Lab — Controller-based architecture, underlay/overlay/fabric, REST/CRUD, JSON, configuration management, and AI/ML with pipeline security and blast-radius controls.
Integrated Attack–Defense Catalog — A searchable, filterable cross-domain catalog of network and cybersecurity techniques. Each entry connects attack mechanics to prevention, detection, response/recovery, and operational verification in both languages; a domain × family matrix exposes coverage and links directly to the relevant lab. Eight evidence-first response playbooks cover Layer 2, wireless, routing, services, availability, credentials, PKI/VPN, and automation incidents.
Attack Paths Lab — Eight multi-stage paths connect reconnaissance, access, propagation, impact, observable signals, defensive controls, and validation across every attack family and the related CCNA domains.
Configuration Hardening Lab — Side-by-side Cisco IOS/IOS XE configurations expose insecure defaults and safer patterns for Layer 2, routing, IP services, management, security policy, and automation, including show verification, change warnings, and rollback commands.
Detection Engineering Lab — Twelve cross-domain use cases connect telemetry, behavioral logic, correlation, legitimate alternative causes, controlled validation, first response, and analytical limitations across every attack family.
Resilience & Recovery Lab — Twelve recovery procedures cover physical infrastructure, Layer 2, gateways, routing, IP services, wireless, capacity exhaustion, telemetry, AAA, PKI/VPN, automation, and ransomware, with dependencies, minimum continuity, stop conditions, validation, and residual risk.
IPv6 & Dual-Stack Security Lab — Eight operational scenarios cover rogue RA/ND and DHCPv6, Neighbor Cache exhaustion, ICMPv6/PMTUD, extension headers, fragmentation, transition tunnels, and IPv4/IPv6 policy parity, with evidence, controls, verification, and common pitfalls.
Segmentation & Trust Boundaries Lab — Eight packet-path scenarios explain where VLAN, ACL, VRF, management, guest/IoT, east–west, overlay, and shared-service boundaries actually enforce policy, including bidirectional verification and architectural limitations.
Identity, AAA & Trust Lab — Nine trust-flow scenarios connect TACACS+ device administration, RADIUS/802.1X/EAP-TLS, MAB, AAA fallback, PKI, remote-access VPN, privileged commands, session revocation, and identity lifecycle to evidence and operational verification.
Routing & Control-Plane Security Lab — Nine operational scenarios cover OSPF trust, redistribution, BGP/RPKI, FHRP, uRPF, CoPP, host routing, RIB/FIB consistency, and safe routing changes with control-plane and forwarding proof.
Wireless & RF Security Lab — Nine evidence-led scenarios cover interference and jamming, rogue AP classification, evil twins, PMF, WPA2-Personal, WPA3 transition mode, Enterprise/RADIUS policy, WLC/CAPWAP trust, and guest isolation without confusing association with authorization.
VPN, IPsec & PKI Security Lab — Nine scenarios trace IKEv2 negotiation, CHILD SAs and SPIs, peer authentication, NAT-T, traffic selectors, tunnel routing/failover, remote-access DNS, anti-replay/rekeying, and certificate revocation from control-plane state to protected forwarding.
Availability, DoS & Capacity Lab — Nine scenarios distinguish link saturation, TCP backlog, UDP reflection, control-plane CPU, Layer 2 tables/broadcasts, IPv6 neighbor/reassembly state, DNS capacity, NAT/firewall state, and QoS queues, matching each exhausted resource to local or upstream mitigation.
Firewall, IDS/IPS & Inspection Lab — Nine scenarios trace ordered policy, stateful/asymmetric flows, NAT processing, IDS versus inline IPS, signature tuning, encrypted-traffic visibility, parser evasion, HA failure modes, and logging from configured intent to proven enforcement.
Management Plane & Telemetry Lab — Nine trust-chain scenarios cover OOB versus management VRFs, SSH and AAA, SNMPv3, remote Syslog, trusted time, NETCONF/RESTCONF, CDP/LLDP exposure, protected configuration backups, and collector blind spots with end-to-end verification.
DNS, Web & Application Security Lab — Nine request-path scenarios cover DNS resolution and delegation, recursion/rebinding, tunneling and DoH, TLS identity, HTTP proxy parsing, server-side injection, browser origin/session controls, and API object authorization.
Email, Phishing & Human-Layer Security Lab — Nine delivery-chain scenarios cover SPF/DKIM/DMARC, lookalike domains, adversary-in-the-middle credential phishing, malicious attachments, links/QR redirects, BEC, OAuth consent, user reporting, and coordinated recovery.
Layer 2 & First-Hop Security Lab — Nine frame-path scenarios cover the physical port boundary, data/voice edge roles, CAM and Port Security, trunks/native VLANs, DHCP Snooping, DAI/IP Source Guard, STP protections, EtherChannel consistency, and controlled containment.
Operational Evidence Lab — Annotated IOS outputs, logs, route-monitoring data, and automation audits. It separates raw observations from interpretation, correlation sources, and the limits of each individual artifact.
Defensive Controls Lab — Defense-in-depth catalog organized by preventive, detective, containment, recovery, and compensating functions, including enforcement points, dependencies, verification, and operational limitations.
OSI Stack Lab — Pick a protocol (HTTP, HTTPS, DNS, BGP, SSH, FTP, SMTP) and run the simulation. A live Packet Inspector shows realistic fields (IP, ports, MAC addresses, flags, and sequence numbers) while distinguishing real headers from conceptual upper-layer OSI functions. Adjustable playback speed (0.5× / 1× / 2×) and audio cues.
Attack & Defense Lab — ~25 attacks across all 7 layers (ARP poisoning, MAC flooding, IP/BGP spoofing, SYN/UDP floods, session hijacking, padding oracle, SQL injection, XSS, DNS cache poisoning, and more). Each one plays out as a step-by-step kill chain; turn the defense on to see exactly where and how it is neutralized.
Ports & Protocols — Exploratory reference for IANA ranges, protocols, appliances, and security properties, without scores or assessment. The 20 protocol cards, 45 port/service cards and 31 device cards are reviewed in both languages and covered by translation-parity checks; security notes distinguish protocol capabilities from configuration guarantees. The AAA comparison includes bilingual illustrative RADIUS/TACACS+ traces, distinguishes legacy obfuscation from TLS transport, and explains device enforcement and accounting limits. Five EAP methods include bilingual conceptual sequences and explicit server-validation, provisioning and legacy-method limitations. VPN/IPsec/DTLS diagrams distinguish visible headers, encrypted data and integrity tags, with bilingual scope and configuration limits.
Port states (scanning) — A decoder for the eJPT scanning methodology: pick TCP or UDP and compare how a scan deduces an open, closed, or filtered port from the probe and the response, and what the defender observes. Exploratory, no scores.
Assessment & Exploit Workbenches — Offline, bilingual eJPT exercises built from documentation-only fixtures. The assessment workspace produces a provenance-aware triage report; the exploit workbench reviews a fictional module’s prerequisites and compatibility, simulates inert payload choices and a read-only mock session, surfaces defensive telemetry, and verifies rollback. No exploit code, commands, sockets, or external requests are generated.
Host & Network Audit Workbench — A bilingual Linux/Windows fixture inventory for interfaces, routes, listeners, system posture, synthetic accounts, and redacted credential-store metadata. It computes real SHA-256 integrity digests over minimized fixture records, records source and custody events, permits only allowlisted fixture transfers in either direction, and clears session state on teardown. No real files, passwords, hashes, hosts, commands, or network requests are used.
Cybersecurity (IDS/IPS) — Reference on defensive appliances (NIDS/NIPS/HIDS/HIPS/WIDS/WIPS/EDR) and the key difference between detecting (IDS) and blocking (IPS).
Network Glossary — Searchable dictionary of networking & security terms.
