# kosa8 lab

Detonate malware on a simulated internet and produce signed reports

The Forensics and Malware Lab. A sample runs in a sandbox whose only network is
fakenet: every DNS name resolves, every connection is answered — HTTP, TLS
(from a lab CA), SMTP, anything — by a simulated internet on the host that
records what the sample said and forwards nothing. The run is captured to
pcapng, the infected machine is snapshotted and sealed, and the result is a
signed report package anyone can verify offline.

  kosa8 lab detonate SAMPLE --image alpine:3.20   run a sample, write a report
  kosa8 lab verify REPORT.tar --pubkey KEY        check a report
  kosa8 lab diff A.tar B.tar                      compare two reports
  kosa8 lab net SANDBOX                           a fakenet sandbox's record
  kosa8 lab ca [--out FILE]                       the lab CA, to install in images

Only Linux samples run: the guest is Linux. See docs/design/malware-lab.md for
what is simulated, what a sample can still detect, and why nothing can leave.

## Subcommands

- [`kosa8 lab ca`](https://docs.kosa8.com/reference/lab-ca.md): Print the lab CA certificate, to install in images that should trust fakenet's HTTPS
- [`kosa8 lab detonate`](https://docs.kosa8.com/reference/lab-detonate.md): Run a sample in a fakenet sandbox and write a signed report
- [`kosa8 lab diff`](https://docs.kosa8.com/reference/lab-diff.md): Compare two detonation reports: files, network indicators, processes
- [`kosa8 lab net`](https://docs.kosa8.com/reference/lab-net.md): Show what a fakenet sandbox has done on the simulated internet
- [`kosa8 lab verify`](https://docs.kosa8.com/reference/lab-verify.md): Check a detonation report package, offline

---
Source: https://docs.kosa8.com/reference/lab/