deadwood-sec 0.1.0__tar.gz

deadwood_sec-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,25 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12"]
+    steps:
+      - uses: actions/checkout@v5
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install
+        run: pip install -e ".[dev]"
+      - name: Test
+        run: pytest -q

deadwood_sec-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,30 @@
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: write
+  id-token: write   # lets PyPI Trusted Publishing mint a short-lived token (no secrets stored)
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment: pypi   # must match the environment set on the PyPI trusted publisher
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+      - name: Build sdist and wheel
+        run: |
+          python -m pip install --upgrade build
+          python -m build
+      - name: Publish GitHub release
+        uses: softprops/action-gh-release@v3
+        with:
+          generate_release_notes: true
+          files: dist/*
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

deadwood_sec-0.1.0/.gitignore

@@ -0,0 +1,7 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+build/
+dist/
+.venv/
+.pytest_cache/

deadwood_sec-0.1.0/CHANGELOG.md

@@ -0,0 +1,16 @@
+# Changelog
+
+All notable changes to this project are documented here. The format is loosely
+based on [Keep a Changelog](https://keepachangelog.com/).
+
+## [0.1.0]
+
+### Added
+- The range: a dependency-free, leveled web-security target that runs on
+  localhost only, with a town-map UI, per-level briefings, **progressive hints**,
+  a **view-the-vulnerable-source / how-to-fix** reveal, per-install flags
+  (`DEADWOOD{...}`) and a local scoreboard.
+- A realistic seeded world — the fictional *Deadwood Telegraph & Trust Co.*
+  (employees, customers, accounts, transactions, telegrams).
+- CLI: `serve`, `levels`, `learn <slug>`, `flag <slug> <value>`, `reset`.
+- **Level 1 — First Blood**: in-band UNION SQL injection in the staff directory.

deadwood_sec-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Gustavo Almeida
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

deadwood_sec-0.1.0/PKG-INFO

@@ -0,0 +1,116 @@
+Metadata-Version: 2.4
+Name: deadwood-sec
+Version: 0.1.0
+Summary: A self-hosted web-security range, leveled tutorial-to-impossible — the practice town for wraith and hickok.
+Project-URL: Homepage, https://github.com/gusta-ve/deadwood
+Project-URL: Source, https://github.com/gusta-ve/deadwood
+Project-URL: Changelog, https://github.com/gusta-ve/deadwood/blob/main/CHANGELOG.md
+Author: gusta-ve
+License-Expression: MIT
+License-File: LICENSE
+Keywords: appsec,command-injection,ctf,education,lab,pentest,range,security,sql-injection,training,vulnerable
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Web Environment
+Classifier: Intended Audience :: Information Technology
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Education
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Provides-Extra: dev
+Requires-Dist: pytest; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# deadwood
+
+A self-hosted **web-security range** that doubles as a tutorial — graded levels
+from the first trivial injection to the deliberately near-impossible. It's the
+practice town for the dead man's hand: scout each room with
+[**wraith**](https://github.com/gusta-ve/wraith), take it with
+[**hickok**](https://github.com/gusta-ve/hickok), capture the flag, then read the
+vulnerable source and the fix.
+
+Dependency-free (stdlib + SQLite). Runs on **127.0.0.1 only**.
+
+[![PyPI](https://img.shields.io/pypi/v/deadwood-sec?color=ffb946&label=pypi)](https://pypi.org/project/deadwood-sec/)
+![Python 3.10+](https://img.shields.io/badge/python-3.10%2B-blue)
+![MIT](https://img.shields.io/badge/license-MIT-green)
+
+> ⚠️ **deadwood is intentionally vulnerable, by design.** It refuses to bind
+> anything but loopback unless you force it. Never expose it to a network, a VM
+> bridge, or the internet. Attack only this app, on your own machine.
+
+- [Install](#install)
+- [Run it](#run-it)
+- [How a level works](#how-a-level-works)
+- [The levels](#the-levels)
+- [Pairing with wraith & hickok](#pairing-with-wraith--hickok)
+
+## Install
+
+```bash
+pipx install deadwood-sec      # gives you the `deadwood` command
+```
+
+Or from a clone: `pip install -e .` — or run it with no install:
+`PYTHONPATH=src python3 -m deadwood`.
+
+## Run it
+
+```bash
+deadwood serve                 # http://127.0.0.1:8666  (the town map)
+deadwood levels                # list the rooms and your progress
+deadwood learn first-blood     # a level's briefing: objective, hints, source, the fix
+deadwood flag first-blood 'DEADWOOD{...}'   # submit a captured flag
+```
+
+Open the map in a browser, pick a room, and point your tools at the app URL it
+gives you (e.g. `http://127.0.0.1:8666/l/first-blood/app?id=1`).
+
+## How a level works
+
+Every room is the same shape, easy to the hard:
+
+- a **realistic app** (the fictional *Deadwood Telegraph & Trust Co.* — employees,
+  customers, accounts, telegrams) with one real flaw;
+- a **flag** to capture (`DEADWOOD{...}`, unique to your install);
+- **progressive hints** — reveal them one at a time, only if you want them;
+- the **vulnerable source** and **how to fix it**, once you ask (spoilers).
+
+Play blind for the CTF, or lean on the hints and `learn` for the tutorial. Your
+captures are tracked locally.
+
+## The levels
+
+Tutorial → impossible. Each maps to a technique you can practise by hand or drive
+with hickok/wraith:
+
+| # | Room | Tier | Vector |
+|---|------|------|--------|
+| 1 | First Blood | Tutorial | SQL injection — UNION (in-band) |
+| 2 | Whispers | Easy | SQL injection — boolean-blind |
+| 3 | The Telegraph | Medium | SQL injection — time-based blind |
+| 4 | Back Door | Medium | OS command injection → shell |
+
+*(more rooms land as the range grows — auth bypass, filtered/WAF'd injection,
+SSTI, and the Vault.)*
+
+## Pairing with wraith & hickok
+
+deadwood is the range the tools grew up on. A typical run:
+
+```bash
+deadwood serve &                                   # the town
+hickok sql -u 'http://127.0.0.1:8666/l/first-blood/app?id=1' -p id --dump secrets
+```
+
+When a tool can't take a room, that's a bug to fix in the tool; when a room is
+too easy, that's a room to harden. They sharpen each other.
+
+## License
+
+MIT.
+
+---
+
+*Deadwood, 1876 — where the dead man's hand was dealt.*

deadwood_sec-0.1.0/README.md

@@ -0,0 +1,93 @@
+# deadwood
+
+A self-hosted **web-security range** that doubles as a tutorial — graded levels
+from the first trivial injection to the deliberately near-impossible. It's the
+practice town for the dead man's hand: scout each room with
+[**wraith**](https://github.com/gusta-ve/wraith), take it with
+[**hickok**](https://github.com/gusta-ve/hickok), capture the flag, then read the
+vulnerable source and the fix.
+
+Dependency-free (stdlib + SQLite). Runs on **127.0.0.1 only**.
+
+[![PyPI](https://img.shields.io/pypi/v/deadwood-sec?color=ffb946&label=pypi)](https://pypi.org/project/deadwood-sec/)
+![Python 3.10+](https://img.shields.io/badge/python-3.10%2B-blue)
+![MIT](https://img.shields.io/badge/license-MIT-green)
+
+> ⚠️ **deadwood is intentionally vulnerable, by design.** It refuses to bind
+> anything but loopback unless you force it. Never expose it to a network, a VM
+> bridge, or the internet. Attack only this app, on your own machine.
+
+- [Install](#install)
+- [Run it](#run-it)
+- [How a level works](#how-a-level-works)
+- [The levels](#the-levels)
+- [Pairing with wraith & hickok](#pairing-with-wraith--hickok)
+
+## Install
+
+```bash
+pipx install deadwood-sec      # gives you the `deadwood` command
+```
+
+Or from a clone: `pip install -e .` — or run it with no install:
+`PYTHONPATH=src python3 -m deadwood`.
+
+## Run it
+
+```bash
+deadwood serve                 # http://127.0.0.1:8666  (the town map)
+deadwood levels                # list the rooms and your progress
+deadwood learn first-blood     # a level's briefing: objective, hints, source, the fix
+deadwood flag first-blood 'DEADWOOD{...}'   # submit a captured flag
+```
+
+Open the map in a browser, pick a room, and point your tools at the app URL it
+gives you (e.g. `http://127.0.0.1:8666/l/first-blood/app?id=1`).
+
+## How a level works
+
+Every room is the same shape, easy to the hard:
+
+- a **realistic app** (the fictional *Deadwood Telegraph & Trust Co.* — employees,
+  customers, accounts, telegrams) with one real flaw;
+- a **flag** to capture (`DEADWOOD{...}`, unique to your install);
+- **progressive hints** — reveal them one at a time, only if you want them;
+- the **vulnerable source** and **how to fix it**, once you ask (spoilers).
+
+Play blind for the CTF, or lean on the hints and `learn` for the tutorial. Your
+captures are tracked locally.
+
+## The levels
+
+Tutorial → impossible. Each maps to a technique you can practise by hand or drive
+with hickok/wraith:
+
+| # | Room | Tier | Vector |
+|---|------|------|--------|
+| 1 | First Blood | Tutorial | SQL injection — UNION (in-band) |
+| 2 | Whispers | Easy | SQL injection — boolean-blind |
+| 3 | The Telegraph | Medium | SQL injection — time-based blind |
+| 4 | Back Door | Medium | OS command injection → shell |
+
+*(more rooms land as the range grows — auth bypass, filtered/WAF'd injection,
+SSTI, and the Vault.)*
+
+## Pairing with wraith & hickok
+
+deadwood is the range the tools grew up on. A typical run:
+
+```bash
+deadwood serve &                                   # the town
+hickok sql -u 'http://127.0.0.1:8666/l/first-blood/app?id=1' -p id --dump secrets
+```
+
+When a tool can't take a room, that's a bug to fix in the tool; when a room is
+too easy, that's a room to harden. They sharpen each other.
+
+## License
+
+MIT.
+
+---
+
+*Deadwood, 1876 — where the dead man's hand was dealt.*

deadwood_sec-0.1.0/pyproject.toml

@@ -0,0 +1,42 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "deadwood-sec"
+dynamic = ["version"]
+description = "A self-hosted web-security range, leveled tutorial-to-impossible — the practice town for wraith and hickok."
+readme = "README.md"
+requires-python = ">=3.10"
+license = "MIT"
+authors = [{ name = "gusta-ve" }]
+keywords = [
+    "security", "ctf", "training", "education", "pentest", "appsec",
+    "sql-injection", "command-injection", "vulnerable", "range", "lab",
+]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Environment :: Web Environment",
+    "Intended Audience :: Information Technology",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3 :: Only",
+    "Topic :: Security",
+    "Topic :: Education",
+]
+
+[project.optional-dependencies]
+dev = ["pytest"]
+
+[project.scripts]
+deadwood = "deadwood.cli:main"
+
+[project.urls]
+Homepage = "https://github.com/gusta-ve/deadwood"
+Source = "https://github.com/gusta-ve/deadwood"
+Changelog = "https://github.com/gusta-ve/deadwood/blob/main/CHANGELOG.md"
+
+[tool.hatch.version]
+path = "src/deadwood/__init__.py"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/deadwood"]

deadwood_sec-0.1.0/src/deadwood/__init__.py

@@ -0,0 +1,10 @@
+"""deadwood — a self-hosted web-security range, leveled tutorial-to-impossible.
+
+The practice town for the dead man's hand: bring wraith to scout it and hickok to
+take it. Every saloon and back room is a level — a real-looking flaw with a flag,
+a lesson, and the source laid bare once you've earned it.
+
+Intentionally vulnerable. Runs on 127.0.0.1 only. Never expose it.
+"""
+
+__version__ = "0.1.0"

deadwood_sec-0.1.0/src/deadwood/__main__.py

@@ -0,0 +1,4 @@
+from deadwood.cli import main
+
+if __name__ == "__main__":
+    main()

deadwood_sec-0.1.0/src/deadwood/cli.py

@@ -0,0 +1,138 @@
+"""deadwood command line — run the range, browse and learn the levels, grade flags."""
+
+from __future__ import annotations
+
+import argparse
+import sys
+
+import deadwood.levels  # noqa: F401  (importing registers every level)
+from deadwood import __version__, flags, progress, server
+from deadwood.level import all_levels, by_slug
+
+_BANNER = r"""
+   ___              _                 _
+  / _ \___ __ _  __| |_      _____   (_)__/ /
+ / // / -_) _` |/ _` \ \ /\ / / _ \ / / _  /
+/____/\__/\__,_|\__,_/\_\/\_/\___//_/\_,_/   a vulnerable range · tutorial → impossible
+"""
+
+
+def _print_banner():
+    print(_BANNER.rstrip("\n"))
+    print(f"  v{__version__} · the practice town for wraith & hickok\n")
+
+
+def cmd_serve(args):
+    _print_banner()
+    sv = progress.solved()
+    print(f"  map      http://{args.host}:{args.port}/")
+    print(f"  levels   {len(all_levels())} loaded · {len(sv)} taken")
+    print(f"  warning  intentionally vulnerable — keep it on localhost, never expose it")
+    print("\n  Ctrl-C to stop the range.\n")
+    try:
+        server.serve(args.host, args.port, allow_unsafe=args.unsafe)
+    except PermissionError as exc:
+        print(f"  [-] {exc}", file=sys.stderr)
+        raise SystemExit(2)
+    except OSError as exc:
+        print(f"  [-] cannot bind {args.host}:{args.port} — {exc}", file=sys.stderr)
+        raise SystemExit(2)
+    except KeyboardInterrupt:
+        print("\n  range closed.")
+
+
+def cmd_levels(args):
+    sv = progress.solved()
+    print()
+    for lv in all_levels():
+        mark = "✓" if lv.slug in sv else " "
+        print(f"  [{mark}] {lv.num:02d}  {lv.title:<18} {lv.tier:<11} {lv.category}")
+        print(f"         {lv.slug:<18} {lv.brief}")
+    print(f"\n  {len(sv)}/{len(all_levels())} taken · learn a level with `deadwood learn <slug>`\n")
+
+
+def cmd_learn(args):
+    lv = by_slug(args.slug)
+    if lv is None:
+        print(f"  no level '{args.slug}'. see `deadwood levels`.", file=sys.stderr)
+        raise SystemExit(2)
+    bar = "─" * 60
+    print(f"\n  {lv.num:02d} · {lv.title}   [{lv.tier}]  {lv.category}\n  {bar}")
+    print(f"  objective\n    {lv.objective}\n")
+    print("  hints")
+    for i, h in enumerate(lv.hints, 1):
+        print(f"    {i}. {h}")
+    print(f"\n  the vulnerable source\n{_indent(lv.source)}")
+    print(f"\n  how to fix it\n    {lv.remediation}")
+    print(f"\n  capture the flag, then:  deadwood flag {lv.slug} 'DEADWOOD{{...}}'\n")
+
+
+def _indent(text, pad="    | "):
+    return "\n".join(pad + ln for ln in text.splitlines())
+
+
+def cmd_flag(args):
+    lv = by_slug(args.slug)
+    if lv is None:
+        print(f"  no level '{args.slug}'.", file=sys.stderr)
+        raise SystemExit(2)
+    if flags.check(lv.slug, args.value):
+        progress.mark(lv.slug)
+        print(f"  ✓ {lv.title} — taken. that's the hand.")
+    else:
+        print("  ✗ not it. keep working the room.")
+        raise SystemExit(1)
+
+
+def cmd_reset(args):
+    progress.reset()
+    print("  progress reset — every room is open again.")
+
+
+def build_parser() -> argparse.ArgumentParser:
+    p = argparse.ArgumentParser(prog="deadwood",
+                                description="A self-hosted, leveled web-security range "
+                                            "(tutorial → impossible). Intentionally vulnerable; "
+                                            "runs on localhost only.")
+    p.add_argument("--version", action="version", version=f"deadwood {__version__}")
+    sub = p.add_subparsers(dest="command", metavar="<command>")
+
+    s = sub.add_parser("serve", help="run the range")
+    s.add_argument("-H", "--host", default="127.0.0.1", help="bind host (default: 127.0.0.1)")
+    s.add_argument("-p", "--port", type=int, default=8666, help="bind port (default: 8666)")
+    s.add_argument("--unsafe", action="store_true",
+                   help="allow binding a non-loopback host (dangerous — it's vulnerable)")
+    s.set_defaults(func=cmd_serve)
+
+    ls = sub.add_parser("levels", help="list the levels and your progress")
+    ls.set_defaults(func=cmd_levels)
+
+    lr = sub.add_parser("learn", help="the briefing for a level (objective, hints, source, fix)")
+    lr.add_argument("slug")
+    lr.set_defaults(func=cmd_learn)
+
+    fl = sub.add_parser("flag", help="submit a captured flag")
+    fl.add_argument("slug")
+    fl.add_argument("value")
+    fl.set_defaults(func=cmd_flag)
+
+    rs = sub.add_parser("reset", help="clear your captured-flag progress")
+    rs.set_defaults(func=cmd_reset)
+    return p
+
+
+def main(argv=None):
+    argv = sys.argv[1:] if argv is None else list(argv)
+    args = build_parser().parse_args(argv)
+    if not getattr(args, "func", None):
+        _print_banner()
+        print("  deadwood serve            run the range (http://127.0.0.1:8666)")
+        print("  deadwood levels           list the levels")
+        print("  deadwood learn <slug>     a level's briefing + how to fix it")
+        print("  deadwood flag <slug> ...  submit a captured flag\n")
+        return
+    args.func(args)
+
+
+if __name__ == "__main__":
+    main()

deadwood_sec-0.1.0/src/deadwood/data.py

@@ -0,0 +1,127 @@
+"""The world: a believable frontier company seeded into SQLite.
+
+Deadwood Telegraph & Trust Co. — a bank and telegraph office. Employees, customers,
+accounts, transactions and internal telegrams, all generated by a small seeded
+faker (stdlib only) so the data looks real and is the same every time. Levels read
+from this shared world and seed their own secrets on top.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import random
+import sqlite3
+import time as _time
+
+_FIRST = [
+    "Wyatt", "Martha", "Calamity", "Seth", "Al", "Sol", "Jane", "Charlie", "Doc",
+    "Ellis", "Nora", "Sage", "Hattie", "Cyrus", "Mabel", "Otis", "Pearl", "Gus",
+    "Ada", "Levi", "Ruth", "Silas", "Della", "Amos", "Iris", "Roy", "Etta", "Hank",
+    "Cora", "Jeb", "Lula", "Virgil", "Tess", "Boone", "Winnie", "Clay", "Goldie",
+]
+_LAST = [
+    "Earp", "Bullock", "Hickok", "Canary", "Swearengen", "Star", "Utter", "Holliday",
+    "Tilghman", "Masterson", "Garrett", "Cody", "Oakley", "Ringo", "Younger", "Dalton",
+    "Plummer", "Slade", "Boot", "Hardin", "Doolin", "Starr", "Bass", "Reeves",
+]
+_TOWNS = [
+    "Deadwood", "Tombstone", "Dodge City", "Abilene", "Cheyenne", "Laramie", "Yuma",
+    "Silverton", "Leadville", "Virginia City", "Bisbee", "Tascosa",
+]
+_ROLES = [
+    "Teller", "Head Teller", "Clerk", "Telegraph Operator", "Bookkeeper", "Vault Manager",
+    "Loan Officer", "Branch Manager", "Stagecoach Agent", "Auditor",
+]
+_MEMOS = [
+    "deposit, gold dust", "withdrawal, cash", "wire transfer", "loan repayment",
+    "stagecoach freight", "saloon takings", "claim payout", "cattle sale",
+    "telegraph fee", "vault audit adjustment",
+]
+_DOMAIN = "deadwood-trust.example"
+
+
+def _slugify(name: str) -> str:
+    return name.lower().replace(" ", "")
+
+
+def _sleep(n):
+    """A SQLite `sleep()` — real engines have one natively; SQLite doesn't, so the
+    time-based level (The Telegraph) needs it provided. Capped, so an injection
+    can't hang the range."""
+    try:
+        _time.sleep(min(float(n), 5))
+    except (TypeError, ValueError):
+        pass
+    return 0
+
+
+def build(db: sqlite3.Connection, seed: int = 1876) -> None:
+    """(Re)build the company world into `db`. Deterministic for a given seed."""
+    db.create_function("sleep", 1, _sleep)
+    rng = random.Random(seed)
+    db.executescript("""
+        DROP TABLE IF EXISTS employees;
+        DROP TABLE IF EXISTS customers;
+        DROP TABLE IF EXISTS accounts;
+        DROP TABLE IF EXISTS transactions;
+        DROP TABLE IF EXISTS telegrams;
+        DROP TABLE IF EXISTS secrets;
+        CREATE TABLE employees (id INTEGER PRIMARY KEY, name TEXT, role TEXT, town TEXT,
+                                username TEXT, pw_md5 TEXT, email TEXT);
+        CREATE TABLE customers (id INTEGER PRIMARY KEY, name TEXT, town TEXT, email TEXT, joined TEXT);
+        CREATE TABLE accounts (id INTEGER PRIMARY KEY, customer_id INTEGER, number TEXT,
+                               kind TEXT, balance INTEGER);
+        CREATE TABLE transactions (id INTEGER PRIMARY KEY, account_id INTEGER, day TEXT,
+                                   amount INTEGER, memo TEXT);
+        CREATE TABLE telegrams (id INTEGER PRIMARY KEY, sender TEXT, recipient TEXT,
+                                subject TEXT, body TEXT);
+        CREATE TABLE secrets (id INTEGER PRIMARY KEY, label TEXT, value TEXT);
+    """)
+
+    def person():
+        return f"{rng.choice(_FIRST)} {rng.choice(_LAST)}"
+
+    # employees — note the weak MD5 password hashes (a lesson for later levels)
+    employees = []
+    used = set()
+    for i in range(1, 19):
+        name = person()
+        user = _slugify(name)
+        while user in used:
+            name = person()
+            user = _slugify(name)
+        used.add(user)
+        pw = rng.choice(["summer76", "letmein", "goldrush", "deadwood", "trotter",
+                         "marshal", "blackhills", "aceshigh", "wagon", "telegraph"])
+        employees.append((i, name, rng.choice(_ROLES), rng.choice(_TOWNS), user,
+                          hashlib.md5(pw.encode()).hexdigest(), f"{user}@{_DOMAIN}"))
+    db.executemany("INSERT INTO employees VALUES (?,?,?,?,?,?,?)", employees)
+
+    # customers + their accounts + a ledger of transactions
+    acc_id = tx_id = 0
+    for cid in range(1, 41):
+        name = person()
+        town = rng.choice(_TOWNS)
+        db.execute("INSERT INTO customers VALUES (?,?,?,?,?)",
+                   (cid, name, town, f"{_slugify(name)}@mail.example",
+                    f"187{rng.randint(2, 9)}-{rng.randint(1, 12):02d}-{rng.randint(1, 28):02d}"))
+        for _ in range(rng.randint(1, 2)):
+            acc_id += 1
+            kind = rng.choice(["checking", "savings", "gold deposit"])
+            bal = rng.randint(20, 9000) * (100 if kind == "gold deposit" else 1)
+            db.execute("INSERT INTO accounts VALUES (?,?,?,?,?)",
+                       (acc_id, cid, f"DW-{rng.randint(10000, 99999)}", kind, bal))
+            for _ in range(rng.randint(2, 6)):
+                tx_id += 1
+                db.execute("INSERT INTO transactions VALUES (?,?,?,?,?)",
+                           (tx_id, acc_id, f"187{rng.randint(2, 9)}-{rng.randint(1, 12):02d}-{rng.randint(1, 28):02d}",
+                            rng.randint(-2000, 5000), rng.choice(_MEMOS)))
+
+    # a few internal telegrams for colour (and a place to hide things)
+    for i in range(1, 9):
+        db.execute("INSERT INTO telegrams VALUES (?,?,?,?,?)",
+                   (i, person(), person(), rng.choice(
+                       ["VAULT COMBINATION CHANGED", "SHIPMENT DELAYED", "AUDIT NEXT WEEK",
+                        "NEW TELLER STARTS MONDAY", "WIRE CONFIRMED", "CLOSE EARLY FRIDAY"]),
+                    "STOP. " + rng.choice(_MEMOS).upper() + ". STOP."))
+    db.commit()