secnull
systems nominal feed · live 23:01 UTC
8
audits
open cve
projectsdirsim
active project · last updated apr 22
— project · simulation

dirsim — Active Directory you can break safely.

A high-fidelity behavioral simulator of AD environments. Model forests, OUs, GPOs, and Kerberos-like tickets through a REST API and a web console — without standing up real domain controllers.

~10s loop · creating a user, assigning a group, watching a GPO apply

What it is

dirsim is a behavioral simulator of the AD logical plane. It models the things a security practitioner usually needs to reason about — forests, domains, OUs, users, groups, computers, GPOs, trusts, and Kerberos-style tickets — and exposes them through a REST/WebSocket API and a Next.js admin console.

It is not a wire-protocol AD reimplementation. It does not speak LDAP or Kerberos on the wire. It implements the concepts and enforcement semantics so you can practice attack paths, train operators, and demo controls without standing up real domain controllers and exposing real ports.

It exists because every "AD lab" tutorial assumes you'll spin up two Windows VMs, join them to a domain, and pretend that's a low-friction starting point. It isn't. dirsim is the lab you can spin up in 30 seconds, reset on a cron, and demo to a class of twenty without anyone needing a Microsoft license.

Architecture

Architecture diagram: a browser arrow into a Next.js UI box, which arrows into a Fastify API box, which contains an in-memory store
two services in one repo · web tier holds no state · API tier holds the simulated forest in memory · reset = restart

In the console

dirsim user directory view
users in the forest, grouped by OU · click an entry for detail · bulk actions for training scenarios
dirsim GPO inspector view
GPO inspector — see which users a policy actually reaches after group nesting and OU inheritance resolve
dirsim ticket trace view
ticket trace — Kerberos-shaped events without the wire protocol · useful for teaching detection

Launch dirsim

Three ways to run it. The hosted demo lights up when secnull's deploy target stands up an instance — not yet.

live demo

Try it in your browser

Hosted instance with auto-reset. No install, no auth ceremony — drop in, break things, refresh.

coming soon
self-host

Run it yourself

One container compose. Persistent state if you want it; ephemeral if you don't.

docker compose up
source

Read the code

Fastify + Next.js, no exotic deps. Open issues are the roadmap; PRs are welcome.

github →