haaukins is a Go-orchestrated virtualization platform from Aalborg University that spins up Docker- and VirtualBox-backed capture-the-flag environments for authorized security education and training labs.
| Tool | aau-network-security/haaukins — automated virtualization platform for security education built on Docker, VirtualBox and Go |
| Category | Training range / virtualization orchestration platform |
| Primary Use | Deploying self-contained, deliberately vulnerable CTF-style virtual environments for classroom exercises and individual practice, orchestrated by a Go daemon and gRPC client |
| Safe Use | Intended for authorized security education: universities, training organizations, and individual professionals running isolated lab environments with no real-world targets |
| Telemetry Note | Purely a lab-provisioning tool; it touches only its own containers and VMs, so from a defensive perspective its footprint is confined to the host running the Docker and VirtualBox workloads it manages |
haaukins is an open-source virtualization platform developed by the security group at Aalborg University (aau-network-security), designed to make capture-the-flag style security education broadly accessible. The project, presented in the BlackHat EU 2019 Arsenal, describes itself as highly accessible and automated, and its architecture reflects that ambition: three main components — Docker, VirtualBox, and Golang — with all communication and orchestration between them managed by Go code. The stated motivation for choosing Go as the control plane is its straightforward concurrency and parallelism model, which matters when you are provisioning many isolated lab instances for a classroom of students at once.
The educational framing is explicit in the README: the primary aim is to involve anyone who wants to learn the capture-the-flag concept, which the authors call a widely accepted approach for learning how to find vulnerabilities in a system. Unlike generic CTF portals that expect you to point your own tooling at remote infrastructure, haaukins provides its own virtualized environment complete with operating systems purpose-built for vulnerability discovery. That distinction is important from a policy standpoint as well — everything the platform spawns lives inside virtualization boundaries owned by the operator, so there is no attack surface aimed at third-party systems.
Architecturally, the platform splits into a client and a daemon. The daemon carries real prerequisites: a Linux host, Docker, and Go 1.13 or newer must be installed separately. The client, by contrast, has no prerequisites at all, which is a deliberate accessibility decision — students only need the thin client to interact with their lab. The client-daemon communication is implemented over gRPC, with the protocol defined in daemon/proto/daemon.proto. Contributors regenerate the Go bindings with protoc -I proto/ proto/daemon.proto --go_out=plugins=grpc:proto from within the daemon/ directory, which tells you the control plane is a proper RPC service rather than a pile of shell scripts.
Dependency management is clean: since version 1.6.4 the project uses go modules, so pulling everything is a single go mod download. The test story is similarly mature for an academic-origin project — the README instructs contributors to run go test -v --race ./... from the repository root under $GOPATH, and the --race flag signals that the team actually cares about the concurrency correctness of the orchestrator, a sensible concern given that Go concurrency is the whole reason the control plane exists. Builds and releases are automated through GoReleaser — tagging a commit produces a release — and continuous integration runs on Travis CI, which also handles deployment to the project's server.
One operational detail worth noting for anyone self-hosting: the deployment script pushes to GitHub using the ~/.ssh/id_rsa key by default, overridable via the HKN_RELEASE_PEMFILE environment variable. That is a small thing, but it tells you the project expects maintainers to run deployment from a machine with credentials available, so if you fork it for your own training infrastructure, review that path before wiring it into any automation. The documentation lives at docs.haaukins.com, and installation guidance is deliberately kept out of the README in favor of that documentation site.
The repository metadata reinforces the platform's scope. It carries 198 stars, is written almost entirely in Go, and is licensed under an open-source license, with the README crediting GNU licensing and the repo metadata showing Apache-2.0 in topics adjacent tooling. The topic list is unusually descriptive: ctfd, hackthebox, security-education, virtualbox, docker, daemon, cli, golang, and platform availability markers for linux, macos, and windows. The ctfd topic is a strong hint that haaukins integrates with or draws inspiration from the popular CTFd scoreboard software, positioning it as the lab-provisioning backend beneath a familiar CTF front-end experience.
The hackthebox topic similarly situates haaukins in the same pedagogical lineage as commercial training platforms — the difference being that haaukins is fully open source and self-hostable. For a university course, a corporate security team's internal onboarding, or a CTF organizer who wants every participant to get an identical, disposable vulnerable environment, this removes the operational pain of manually cloning VMs. The automation layer means environments are created per event and torn down afterward, which keeps lab hygiene manageable and prevents the accidental persistence of intentionally vulnerable machines on shared infrastructure.
The project also has an institutional support model: the AAU team offers organizations and users the ability to test the platform on a domain assigned by them, requesting contact in advance — essentially a hosted trial path for groups that want the pedagogy without the operational overhead of running Docker and VirtualBox themselves. Combined with a contribution guide at .github/CONTRIBUTING.md and an active issues tracker, this reads as a maintained community project rather than a one-off research artifact, even though the README itself is thin on end-user tutorials.
For defensive professionals, haaukins is best understood as a range builder rather than an attack tool. Its value in an authorized workflow is repeatability: every trainee gets the same deliberately vulnerable configuration, exercises are scoped inside virtualization boundaries, and nothing in the platform's design reaches outward at real targets. Blue teams can also use such environments to build detection content — running known-vulnerable lab images and observing what telemetry the exploitation of purely local exercises generates on their own monitoring stack.
Caveats are mostly practical. The hard dependency on Linux, Docker, and a Go 1.13+ toolchain for the daemon means the control plane is Linux-first, though the README notes Linux can itself run virtualized, and the client reportedly runs anywhere. The Go 1.13 floor is dated by modern standards, so operators building on a current distribution should verify module compatibility. The README's known-issues section defers to the issue tracker rather than enumerating problems inline, so a prospective deployer should skim it before committing to the platform for a live class.
Taken together, haaukins occupies a specific niche: where CTFd gives you the scoreboard and VirtualBox gives you the hypervisor, haaukins glues a gRPC-driven Go orchestrator across both to deliver automated, per-student vulnerable environments for capture-the-flag education. For anyone teaching vulnerability discovery in an authorized, lab-bounded setting — or studying how training platforms architect multi-tenant virtualization — it is a well-documented, BlackHat-Arsenal-vetted starting point, and its Go codebase with race-tested concurrency makes it genuinely readable for operators who want to extend it.
aau-network-security/haaukins.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.