"Systems implicitly trust unverifiable inputs. This lab proves what happens when they shouldn't."

Iron Gate is a detection engineering laboratory demonstrating how OWASP API Top 10 vulnerabilities create attack paths into adjacent OT/ICS networks. Built on Proxmox with four purpose-configured VMs, it generates, captures, and correlates adversarial telemetry across IT and OT layers — then tests whether purpose-built Loki alerting rules can actually catch it.

This lab is the technical foundation for Inputs Lie Part 4: Detecting Lies at the Signal Layer — the culminating installment of a research series examining how critical infrastructure fails when systems trust what they shouldn't.

All VMs operate on a flat, unsegmented 10.0.0.0/24 network — intentionally mirroring the IT/OT convergence architectures found in production critical infrastructure environments.

[Internet]
     |
[Home Router — 10.0.0.1]
     |
  [vmbr0 bridge — 10.0.0.0/24]
   +-----------+-----------+-----------+
   |           |           |           |
[API Target] [Attacker] [OT Honeypot] [Monitor]
 10.0.0.100  10.0.0.101  10.0.0.103  10.0.0.102

• BOLA attacks evade network-layer controls. Broken Object Level Authorization via predictable IDs exploits application logic, not network permissions — firewall rules are irrelevant. Detection requires application log correlation.
• A single API flaw crosses the IT/OT boundary. An SSRF vulnerability in crAPI creates a direct attack path to the Conpot honeypot's Modbus interface, showing how web API compromise translates to OT network access.
• Incomplete logging silently breaks detection rules. Loki alerting rules for timing-based evasion and broken authentication fail without warning when upstream log sources are misconfigured — a direct implication for SOC detection coverage assurance.
• Cross-layer correlation is the unsolved gap. No tool in this stack natively correlates API security events with OT protocol anomalies. This lab quantifies that blind spot with reproducible scenarios.

All rules are written in LogQL and deployed via Loki's ruler component. Alertmanager routes to Grafana for visualization.

iron-gate/
├── architecture/
│   ├── network-diagram.md     # VM topology and traffic flows
│   └── threat-model.md        # Attack scenarios and detection gaps
├── attacks/
│   ├── owasp-api-top10/       # Documented API attack scenarios
│   └── ot-targeting/          # ICS-specific attack chains
├── detection/
│   ├── grafana/               # Dashboards and Alertmanager config
│   └── loki/rules/            # LogQL detection rules (YAML)
├── lab-setup/
│   ├── ansible/               # Provisioning playbooks
│   └── proxmox/               # Hypervisor configuration
├── monitoring/promtail/       # Log shipping configuration
└── writeups/                  # Research drafts (Inputs Lie series)

This lab supports a four-part research series on how critical infrastructure fails when systems trust unverifiable inputs:

cornellsecurity.com — Read the full series.