Watchtower internet attack simulation playbook

Use this playbook to run controlled internet-style attacks against a Watchtower node in a lab so you can validate that basic defenses are working.

Scope and goals

This guide focuses on high-frequency, low-complexity attacks that are often seen first on exposed services:

1. Reconnaissance and service enumeration.
2. Credential stuffing and brute-force logins.
3. HTTP flood and slow-client exhaustion.
4. Malformed API/WebSocket payloads.
5. TLS and header misconfiguration checks.

Success means attacks are blocked or throttled, logs are generated, and the node stays available for legitimate traffic.

The broader suite goal remains the same here as elsewhere: operators should rely on developed and tested defenses and integrations rather than recipe-like behaviors or custom wiring that force them into programming roles. SIGILS remain acceptable for straightforward defaults and basic templating where no control flow is required.