Scorpio: an Automated Penetration Testing Tool and Its Integration with a Cyber Range

Executing cyber attacks attribution experiments for training defenders is an important usage of cyber ranges. During the experiment, attack simulation process needs manual operation of highly skilled personnel, but the procedure is labor intensive and human could cause errors, an attack simulation tool for cyber ranges is needed. We propose Scorpio, an automated penetration testing tool to simulate an attacker's behavior with seamless scanning and automated exploit process. And for integrate with cyber ranges, we find a method for virtual machines in a cyber range to communicate with the manage server without breaking the network isolation, with this method, visualization mechanism is also supported. We conducted an experiment with Scorpio in a range for showing the whole automated attack simulation and visualization process. Result shows that, with Scorpio equipped, the manual operation of professional penetration testers for attack simulation could be replaced, that is cost-efficient and time-saving.