Practical security engineering curriculum: Linux, Wireshark, Burp Suite, and Ghidra
This structured engineering curriculum unites four essential practitioner disciplines: Linux host administration and systemd service sandboxing, network packet dissection in Wireshark, differential web and API protocol auditing in Burp Suite, and zero-execution binary decompilation in Ghidra.
1. Four-layer diagnostic roadmap and instrument comparison matrix
Real-world security defects span multiple system layers simultaneously: an exposed socket on a Linux interface, an unexpected outbound frame on the wire, an unverified session claim in an HTTP/2 request, or an unsafe library import inside a compiled plugin. The schematic and table below map each module to its paired verification class on INDRA.
Linux and frame dissection in Wireshark to differential Repeater testing in Burp Suite, static decompilation in Ghidra, and automated gateway rule compilation.| Code | Course Module | Inspected System Layer | Primary Toolchain | Paired INDRA Class |
|---|---|---|---|---|
CRS-LNX-01 |
Linux Host Hardening | Host Kernel, Processes & Namespaces | Linux, systemd, OpenSSH, nftables |
CLD-K8S-06 |
CRS-WSH-02 |
Wireshark Packet Forensics | Network Frames, TCP & TLS 1.3 |
Wireshark, tshark, dumpcap |
SSRF-INT |
CRS-BRP-03 |
Burp Suite Protocol Audit | HTTP/2, REST, GraphQL & MCP |
Burp Suite (Proxy, Repeater, Comparer) |
AUTH-BOLA |
CRS-GHD-04 |
Ghidra Binary Analysis | ELF & PE Binaries, Decompiler |
Ghidra, readelf, sha256sum, strings |
AI-SUP-09 |
2. Interactive laboratory configuration and filter self-check console
Select any of the four modules below or edit the sample systemd unit drop-in, Wireshark display filter, Burp Suite Repeater request, or Ghidra symbol triage summary. The console evaluates baseline laboratory safety invariants deterministically inside the browser with zero network transmission.
{
"status": "PASS",
"course_module": "CRS-LNX-01",
"checks_failed": 0,
"findings": [
"All baseline laboratory invariants satisfied (0 issues found)."
],
"paired_indra_gate": "CLD-K8S-06 / DIR-TRV"
}INDRA Volumes I–V
3. Detailed engineering modules and reproducible lab practicums
Module 1: Linux administration, service sandboxing, and host hardening
Every web gateway, database engine, and model connector runs inside an operating system process governed by user identifiers, kernel capabilities, and socket bindings. Mastering defensive Linux administration gives an engineer direct visibility into listening ports, file permissions, and service boundaries before any application scanner is launched.
Module 2: Wireshark packet capture, protocol dissection, and network forensics
Application logs record only what software authors chose to print, whereas raw network frames show every actual byte leaving or entering a network interface. Wireshark and its command-line companion tshark enable an engineer to reconstruct transport sessions, verify negotiated cipher suites, and spot unauthorized outbound connections.
Module 3: Burp Suite proxy inspection, differential API testing, and session auditing
Client-side user interfaces hide dozens of background application requests, hidden object fields, and token exchanges behind visual forms. An intercepting proxy such as Burp Suite operates between a dedicated test browser and an authorized staging server. From that vantage point, the engineer inspects, edits, and compares individual HTTP/1.1, HTTP/2, and JSON-RPC messages accurately.
Module 4: Ghidra static binary analysis, decompilation, and backdoor triage
Compiled vendor agents, native library extensions, and proprietary command-line utilities arrive without source files, yet still execute with full access to process memory and network sockets. Ghidra provides an open-source disassembly and decompilation workbench covering x86-64, ARM64, and embedded instruction sets. It lifts raw machine bytes into intermediate P-code and readable C functions without ever executing the binary.
4. Frequently asked engineering questions about the course
Workstation requirements for completing the four laboratory modules
Every laboratory exercise runs inside a standard local Linux virtual machine without touching production networks, while the interactive artifact checker on this page evaluates configurations locally inside the browser with zero external requests.
Engineering rationale behind pairing Linux, Wireshark, Burp Suite, and Ghidra
Together these four instruments cover every execution layer of modern software: host processes and namespaces in Linux, transport and TLS frames in Wireshark, HTTP/2 and JSON-RPC messages in Burp Suite, and compiled machine code in Ghidra.
Legal and operational boundaries for protocol interception and binary analysis
Packet capture and intercepting proxy inspection must be performed strictly against self-hosted laboratory targets or explicitly authorized staging hosts under zero-damage read-only rules.
How manual practitioner tools connect to INDRA and the MITR action gateway
Manual inspection in Wireshark, Burp Suite, and Ghidra teaches first-principles root-cause diagnosis on single artifacts, whereas INDRA and MITR automate zero-false-positive witness proofs and pre-socket Z3 enforcement across continuous releases.
Enterprise pilot packages and air-gapped delivery
Perimeter posture, transport security & localization
Streebog-256 verification passport.Air-gapped interface verification (indra-core)
OpenAPI schemas and an isolated staging container as input, delivering a thirty-class paired decoy assessment with zero false positives, compiled mcp-sentinel contracts, and a full ledger passport.Autonomous agent runtime gate (MITR)
mcp.json manifests and tool schemas as input, delivering compiled satisfiability policies and pre-socket parameter enforcement.Request the offline kit or schedule a pilot
--no-index --find-links) and standalone verifier scripts are provided for isolated laboratory testing and enterprise pilot evaluations. Submit a work email below without page reload or write directly to af@isslab.ai.
Institutional developer and platform operator
OGRN 1267700083617, INN 9731161602, KPP 773101001, 18 Davydkovskaya Street, Suite VIII, Moscow, 121352). Under the Security 3.0 research and engineering program, the institute develops and operates the MITR runtime action gateway and the INDRA verification stand, publishes the monograph Proven Action, and maintains open Apache-2.0 software packages with zero outside subcontractors.