Building a Home Lab for Cybersecurity Practice

Why You Need a Home Lab

Reading about attacks and defences is not the same as doing them. A home lab gives you a legal, isolated environment to practise every technique in this course — privilege escalation, Active Directory attacks, SIEM queries, incident response, malware analysis — without risk to real systems or legal consequences.

A home lab is also the most compelling portfolio item for entry-level interviews. "Tell me about your home lab" is a standard screening question. A candidate who can describe their AD environment, how they configured their SIEM, and what attacks they practised against it stands out from everyone who only has certifications.

Lab Tiers by Budget

Virtualisation Platform Setup

Virtualisation lets you run multiple operating systems simultaneously on one machine. Each VM is an isolated sandbox — malware, attack tools, and misconfigured systems cannot escape to your host machine or home network (when configured correctly).

Choosing a Hypervisor

Hypervisor comparison for home labs:

VMware Workstation Pro (Windows/Linux):
  - Best performance and features for home labs
  - Cost: $199 (permanent licence) — or free since 2024 for personal use
  - Supports: nested virtualisation, NAT/host-only/bridged networks, snapshots
  - Best for: Windows-heavy labs, AD environments

VirtualBox (Windows/macOS/Linux — free):
  - Free and open-source
  - Slightly lower performance than VMware
  - Excellent for beginners on any OS
  - Supports: all network modes, snapshots, guest additions
  - Download: virtualbox.org

Proxmox VE (dedicated server/PC):
  - Free, enterprise-grade hypervisor
  - Web UI — manage all VMs from browser
  - Supports: containers (LXC) AND full VMs side by side
  - Best for: dedicated lab machine, running 10+ VMs simultaneously
  - Install on bare metal: proxmox.com/downloads

UTM (macOS — free):
  - Native Apple Silicon support
  - Best choice for M1/M2/M3 Mac users
  - Runs x86 VMs via QEMU emulation (slower) or ARM natively
  - Download: mac.getutm.app

Recommendation by budget:
  - $0 laptop: VirtualBox
  - Windows workstation: VMware Workstation Pro (now free for personal use)
  - macOS M-series: UTM
  - Dedicated lab machine: Proxmox VE

VM Network Architecture

Home lab network design — CRITICAL: isolate lab from home network

Network mode types:
  Host-Only:   VMs can talk to each other and host — NOT to internet
               Use for: malware analysis, isolated AD labs, anything dangerous

  NAT:         VMs get outbound internet through host — cannot receive inbound
               Use for: downloading tools, internet-connected but isolated lab

  Bridged:     VM appears as real device on home network
               Use ONLY when you need real network interaction (usually don't)
               NEVER use for malware analysis or attack tools

  Internal:    VMs can only talk to each other — completely isolated
               Use for: maximum isolation malware labs

Recommended lab network topology:

  [Internet]
       |
  [Home Router] — home network (phones, personal laptops)
       |
  [Host Machine / Hypervisor]
       |
  ─────────────────────────────────────────────────────
  |                                                   |
  [Lab NAT Network - 192.168.100.0/24]    [Host-Only - 10.10.10.0/24]
  ├─ Kali Linux (attacker)                ├─ Malware analysis VMs
  ├─ Windows DC (domain controller)       └─ No internet access
  ├─ Windows 10 workstations
  └─ Ubuntu (web server target)

Rule: attack lab (offensive tools, vulnerable VMs) on NAT
      Malware / dangerous payloads on Host-Only only

Snapshot Strategy

Snapshot best practices:

ALWAYS take a snapshot:
  - After OS install + updates (clean baseline)
  - After installing tools (save configuration work)
  - Before running any attack (easy rollback)
  - Before any major configuration change

Snapshot naming convention:
  [VM Name] — [Date] — [State Description]
  "Win10-Workstation — 2026-05-10 — Clean, domain joined, no tools"
  "Kali — 2026-05-10 — Post-setup, all tools installed"
  "DC01 — 2026-05-10 — AD configured, 5 users, Kerberoasting target ready"

VMware snapshot command (CLI):
  vmrun snapshot "path/to/vm.vmx" "snapshot-name"
  vmrun revertToSnapshot "path/to/vm.vmx" "snapshot-name"

Proxmox snapshot (CLI):
  qm snapshot 100 clean-baseline --description "Clean OS, no config"
  qm rollback 100 clean-baseline

Building an Active Directory Lab

Active Directory is the authentication and authorisation backbone of most enterprise environments. The majority of major breaches involve AD compromise. Building an AD lab lets you practise every attack covered in Modules 26 and beyond — Kerberoasting, Pass-the-Hash, DCSync, BloodHound — safely.

Required VMs

Minimum AD lab VMs:

VM 1 — Windows Server 2019/2022 (Domain Controller)
  RAM: 2 GB minimum (4 GB recommended)
  Storage: 60 GB
  Role: DC, DNS, DHCP
  Cost: Free evaluation (180 days) from Microsoft evaluation centre

VM 2 — Windows 10/11 Pro (Workstation 1)
  RAM: 2 GB minimum
  Storage: 50 GB
  Role: domain-joined workstation, simulated user
  Cost: Free from Microsoft (without activation key — watermark only)

VM 3 — Windows 10/11 Pro (Workstation 2 — optional but recommended)
  RAM: 2 GB minimum
  Storage: 50 GB
  Role: second workstation for lateral movement practise

VM 4 — Kali Linux (Attacker)
  RAM: 2 GB minimum (4 GB recommended)
  Storage: 50 GB
  Cost: Free (kali.org/downloads)

Total RAM: 8-12 GB for a functional AD lab
Download free evaluations: microsoft.com/en-us/evalcenter/

Domain Controller Setup

# Step-by-step DC setup (Windows Server 2019/2022)

# 1. Set static IP on the DC
# Network adapter: Host-Only adapter (192.168.100.x range)
# IP: 192.168.100.10
# Subnet: 255.255.255.0
# Gateway: 192.168.100.1
# DNS: 127.0.0.1 (itself)

# 2. Set hostname before promoting to DC
Rename-Computer -NewName "DC01" -Restart

# 3. Install AD Domain Services role
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

# 4. Promote to domain controller (creates new forest)
# Run as a single command (line breaks shown for readability):
Install-ADDSForest -DomainName "corp.local" -DomainNetbiosName "CORP" -SafeModeAdministratorPassword (ConvertTo-SecureString "Lab@Password1" -AsPlainText -Force) -InstallDns:$true -Force:$true
# System will restart automatically

# 5. Post-restart: verify AD is running
Get-ADDomain
Get-ADForest

# 6. Create a realistic user population
# Create OUs (Organisational Units)
New-ADOrganizationalUnit -Name "IT" -Path "DC=corp,DC=local"
New-ADOrganizationalUnit -Name "HR" -Path "DC=corp,DC=local"
New-ADOrganizationalUnit -Name "Finance" -Path "DC=corp,DC=local"

# Create users (one command per user for lab simplicity)
New-ADUser -Name "Alice Smith" -SamAccountName "asmith" -Path "OU=IT,DC=corp,DC=local" -AccountPassword (ConvertTo-SecureString "Password123!" -AsPlainText -Force) -Enabled $true -PasswordNeverExpires $true
New-ADUser -Name "Bob Jones"   -SamAccountName "bjones" -Path "OU=HR,DC=corp,DC=local" -AccountPassword (ConvertTo-SecureString "Summer2024!" -AsPlainText -Force)  -Enabled $true -PasswordNeverExpires $true
New-ADUser -Name "Carol White" -SamAccountName "cwhite" -Path "OU=Finance,DC=corp,DC=local" -AccountPassword (ConvertTo-SecureString "Winter2024!" -AsPlainText -Force)  -Enabled $true -PasswordNeverExpires $true
New-ADUser -Name "Dave Brown"  -SamAccountName "dbrown" -Path "OU=IT,DC=corp,DC=local" -AccountPassword (ConvertTo-SecureString "Spring2024!" -AsPlainText -Force)  -Enabled $true -PasswordNeverExpires $true

# 7. Create a service account with SPN (Kerberoasting target)
New-ADUser -Name "svc-sql" -SamAccountName "svc-sql" -Path "DC=corp,DC=local" -AccountPassword (ConvertTo-SecureString "Sqlserver1!" -AsPlainText -Force) -Enabled $true -PasswordNeverExpires $true

# Set SPN (makes this account Kerberoastable)
setspn -s MSSQLSvc/sql01.corp.local:1433 svc-sql

# 8. Add a domain admin (misconfiguration — realistic)
Add-ADGroupMember -Identity "Domain Admins" -Members "asmith"
# Now asmith is a domain admin — a common real-world misconfiguration

Joining Workstations to the Domain

# On each Windows workstation VM:

# 1. Set DNS to point to DC IP
# Network Settings > IPv4 > DNS: 192.168.100.10

# 2. Verify connectivity to DC
ping DC01.corp.local

# 3. Join the domain
# GUI: System Properties > Computer Name > Change > Domain: corp.local
# PowerShell (single command):
Add-Computer -DomainName "corp.local" -Credential (Get-Credential) -OUPath "OU=IT,DC=corp,DC=local" -Restart

# 4. Log in with domain user
# Username: CORPasmith
# Password: Password123!

# 5. Verify domain membership
whoami            # CORPasmith
whoami /groups    # shows domain group membership
nltest /dsgetdc:corp.local  # verify DC connectivity

Intentional Misconfigurations (Lab Realism)

Add these intentional weaknesses to make the lab realistic for attack practice:

# Weak Kerberoastable service account (already done above — svc-sql)

# AS-REP Roasting target (account with pre-auth disabled)
Set-ADAccountControl -Identity bjones -DoesNotRequirePreAuth $true

# Local admin password reuse (common real-world weakness)
# Set same local admin password on all workstations
# This enables Pass-the-Hash lateral movement

# Excessive ACL permissions (Attack Path for BloodHound)
# Give asmith GenericAll on dbrown (can reset their password)
# Run in PowerShell on the DC:
$asmith = Get-ADUser "asmith"
$dbrown = Get-ADUser "dbrown"
$dnPath = "AD:" + $dbrown.DistinguishedName
$acl = Get-Acl $dnPath
$ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule($asmith.SID, "GenericAll", "Allow")
$acl.AddAccessRule($ace)
Set-Acl $dnPath $acl

# Unconstrained delegation (allows Kerberos ticket theft)
Set-ADComputer -Identity "WS01" -TrustedForDelegation $true

# SMB signing disabled (enables relay attacks)
# Group Policy: Computer Config > Windows Settings > Security Settings >
# Local Policies > Security Options > Microsoft network server: Digitally sign communications: Disabled

Attack Lab — Vulnerable Targets

Vulnerable-by-Design Machines

Ready-made vulnerable environments for practice:

DVWA (Damn Vulnerable Web Application):
  - PHP web app with every OWASP Top 10 vulnerability
  - Docker: docker run -d -p 80:80 vulnerables/web-dvwa
  - Login: admin / password
  - Difficulty levels: Low / Medium / High / Impossible

Metasploitable 2 (Linux VM):
  - Intentionally vulnerable Linux system
  - Services: FTP with anonymous login, SSH, Samba, DVWA, tikiwiki
  - Download: sourceforge.net/projects/metasploitable/
  - Set to Host-Only network — never expose to internet

VulnHub (collection of vulnerable VMs):
  - Free download: vulnhub.com
  - Thousands of vulnerable VMs, all levels
  - Set to Host-Only network
  - Recommended starters: Kioptrix 1, Mr-Robot, DC-1

TryHackMe (cloud labs — no local hardware needed):
  - Browser-based; no VM setup required
  - Free tier gives access to many rooms
  - tryhackme.com

HackTheBox (cloud labs):
  - More realistic; more challenging
  - Requires active VPN connection
  - hackthebox.com

GOAD (Game of Active Directory):
  - Multi-domain AD lab (5 VMs, 3 domains) for advanced AD attack practice
  - Automated setup with Vagrant + Ansible
  - github.com/Orange-Cyberdefense/GOAD
  - Requires: 16+ GB RAM for full deployment (mini version: 8 GB)

Detection Lab:
  - Full SIEM lab: Windows AD + Splunk + Fleet + osquery
  - github.com/clong/DetectionLab
  - Requires: 16+ GB RAM, Vagrant + VMware/VirtualBox

Kali Linux Setup

# Kali Linux — your attacker machine

# Download: kali.org/downloads (Installer, VirtualBox, or VMware image)
# Pre-built VM images save setup time — download .ova for VirtualBox

# First boot: update everything
sudo apt update && sudo apt upgrade -y

# Install additional tools not in default Kali
sudo apt install -y   bloodhound   neo4j   impacket-scripts   evil-winrm   crackmapexec   responder   ligolo-ng   seclists   wordlists   feroxbuster   gobuster   nuclei   amass   subfinder   httpx-toolkit

# Install tools from GitHub
# PowerSploit (AD attack scripts)
git clone https://github.com/PowerShellMafia/PowerSploit /opt/PowerSploit

# Impacket (already in Kali, but update to latest)
pip3 install impacket --upgrade

# BloodHound setup (graph-based AD attack path visualisation)
sudo neo4j start
# Visit http://localhost:7474 — change password from neo4j/neo4j
bloodhound &
# In BloodHound: connect to neo4j with your new password

# Collect AD data for BloodHound (run from domain-joined Windows)
# SharpHound (C# collector — run on Windows)
# Or from Kali with valid creds:
bloodhound-python -u asmith -p 'Password123!' -d corp.local -ns 192.168.100.10 --zip

Defensive Lab — SIEM and Detection

Setting Up a Free SIEM

Option 1: Elastic Stack (ELK) — free, most common in industry

# Deploy with Docker Compose (easiest setup)
# docker-compose.yml for Elasticsearch + Kibana + Logstash

version: '3'
services:
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:8.13.0
    environment:
      - discovery.type=single-node
      - xpack.security.enabled=true
      - ELASTIC_PASSWORD=LabPassword1
      - ES_JAVA_OPTS=-Xms1g -Xmx1g
    ports: ["9200:9200"]
    volumes: ["elastic-data:/usr/share/elasticsearch/data"]

  kibana:
    image: docker.elastic.co/kibana/kibana:8.13.0
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
      - ELASTICSEARCH_USERNAME=kibana_system
      - ELASTICSEARCH_PASSWORD=LabPassword1
    ports: ["5601:5601"]
    depends_on: [elasticsearch]

volumes:
  elastic-data:

# Start: docker compose up -d
# Kibana UI: http://localhost:5601 (admin / LabPassword1)

# Ship Windows logs to Elastic with Winlogbeat
# On Windows VM, install Winlogbeat:
# https://www.elastic.co/downloads/beats/winlogbeat
# Edit winlogbeat.yml:
#   output.elasticsearch.hosts: ["http://192.168.100.1:9200"]
#   output.elasticsearch.username: "elastic"
#   output.elasticsearch.password: "LabPassword1"
winlogbeat setup -e
Start-Service winlogbeat

Option 2: Splunk Free (limited — 500 MB/day ingestion)

# Download: splunk.com/en_us/download/splunk-enterprise.html
# Free licence: up to 500 MB/day — sufficient for a home lab

# Install on Ubuntu/Kali:
tar xvzf splunk-*.tgz -C /opt
/opt/splunk/bin/splunk start --accept-license --gen-and-print-passwd
# Note the generated password from output

# Splunk Universal Forwarder (ship logs from Windows VMs)
# Download: splunk.com/en_us/download/universal-forwarder.html
# Install on Windows workstations and DC

# Configure forwarder to send to your Splunk instance:
# $SPLUNK_HOME/etc/system/local/outputs.conf
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
server = 192.168.100.1:9997

# Enable inputs (Windows Event Logs):
# $SPLUNK_HOME/etc/system/local/inputs.conf
[WinEventLog://Security]
disabled = 0
[WinEventLog://System]
disabled = 0
[WinEventLog://Application]
disabled = 0

Sysmon — Enhanced Windows Telemetry

# Sysmon captures process creation, network connections, file creation,
# registry modification — far richer than default Windows event logs

# Download Sysmon from Sysinternals
Invoke-WebRequest -Uri https://download.sysinternals.com/files/Sysmon.zip -OutFile Sysmon.zip
Expand-Archive Sysmon.zip -DestinationPath C:ToolsSysmon
# Download SwiftOnSecurity Sysmon config (excellent baseline ruleset)
Invoke-WebRequest -Uri https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/master/sysmonconfig-export.xml -OutFile C:ToolsSysmonsysmonconfig.xml

# Install Sysmon with the config
C:ToolsSysmonSysmon64.exe -accepteula -i C:ToolsSysmonsysmonconfig.xml

# Verify it is running
Get-Service sysmon64

# Key Sysmon Event IDs to watch:
# Event 1:  Process creation (with full command line and parent)
# Event 3:  Network connection (process → IP:port)
# Event 7:  Image loaded (DLL injection detection)
# Event 8:  CreateRemoteThread (code injection indicator)
# Event 10: Process access (LSASS access — credential dumping)
# Event 11: File creation
# Event 13: Registry value set
# Event 22: DNS query (detect C2 beaconing by domain)

# Search in Splunk for Sysmon events:
# index=windows source="WinEventLog:Microsoft-Windows-Sysmon/Operational"

Suricata IDS on Your Lab Network

# Suricata — network-based IDS/IPS
# Install on your lab host or a dedicated VM that monitors traffic

# Install on Ubuntu
sudo apt update && sudo apt install -y suricata

# Download Emerging Threats rules (free)
sudo suricata-update

# Configure interface to monitor
# /etc/suricata/suricata.yaml
af-packet:
  - interface: eth0    # your lab network interface

# Enable logging to SIEM-friendly format
outputs:
  - eve-log:
      enabled: yes
      filetype: regular
      filename: /var/log/suricata/eve.json
      types:
        - alert:
        - dns:
        - http:
        - tls:
        - ssh:
        - smtp:

# Start Suricata
sudo systemctl start suricata
sudo systemctl enable suricata

# Watch alerts in real time
tail -f /var/log/suricata/fast.log

# Ship eve.json to Splunk:
# Install Splunk Universal Forwarder on the Suricata VM
# Configure inputs.conf to monitor /var/log/suricata/eve.json

Practice Scenarios — Making the Most of Your Lab

Lab practice scenarios (work through these sequentially):

BEGINNER (week 1-2):
  □ Run nmap against your lab network — identify all hosts and services
  □ Enumerate DVWA manually — find all OWASP Top 10 vulnerabilities
  □ Exploit Metasploitable 2 with Metasploit — get a Meterpreter shell
  □ View the attacks in your SIEM — search for the nmap scans in logs

INTERMEDIATE (week 3-6):
  □ Enumerate the AD environment with nmap, enum4linux, CrackMapExec
  □ Run BloodHound collection and visualise attack paths
  □ Kerberoast the svc-sql account and crack the hash with hashcat
  □ AS-REP Roast bjones (pre-auth disabled)
  □ Pass-the-Hash lateral movement between workstations
  □ Collect Windows Event Logs and Sysmon events for each attack
  □ Write a SIEM detection rule for each attack technique

ADVANCED (week 7+):
  □ Full AD compromise: from unprivileged user to domain admin
  □ DCSync attack with secretsdump.py
  □ Golden Ticket creation and use
  □ Build a detection rule in Splunk for each technique you ran
  □ Write a incident report for the simulated breach
  □ Set up Responder and capture NTLMv2 hashes from network

Cloud Lab — Free Tier Options

No hardware at all? Use free cloud tiers to build a lab. AWS, Azure, and Google Cloud each offer free tier resources that can host a small but functional lab.

AWS Free Tier Lab

AWS Free Tier resources (12 months from account creation):
  - 750 hours/month EC2 t2.micro/t3.micro (Linux or Windows)
  - 30 GB EBS storage
  - 750 hours/month RDS t2.micro
  - 5 GB S3 storage

# Basic security lab on AWS free tier:

# 1. Create a VPC with public + private subnets
# Public subnet: attack machine (Kali)
# Private subnet: vulnerable target (no direct internet access)

# 2. Launch Kali Linux from AWS Marketplace (official Kali AMI)
aws ec2 run-instances   --image-id ami-KALI_IMAGE_ID   --instance-type t2.micro   --key-name my-lab-key   --security-group-ids sg-xxx   --subnet-id subnet-public-xxx

# 3. Launch Ubuntu vulnerable server in private subnet
aws ec2 run-instances   --image-id ami-UBUNTU_IMAGE_ID   --instance-type t2.micro   --key-name my-lab-key   --security-group-ids sg-private-xxx   --subnet-id subnet-private-xxx

# 4. Install DVWA on Ubuntu
sudo apt update
sudo docker run -d -p 80:80 vulnerables/web-dvwa

# AWS-specific security practice:
# - Misconfigure IAM roles and practice exploitation
# - Use Pacu (AWS pentesting framework): github.com/RhinoSecurityLabs/pacu
# - Practice IAM privilege escalation scenarios
# - Enable AWS GuardDuty (free 30-day trial) and generate findings

Azure Free Tier Lab

Azure Free Account:
  - $200 credit for 30 days (anything)
  - 12 months of popular free services
  - Always free: Azure AD free tier, Azure Functions (1M executions)

# Azure AD security lab (always free):
# Create an Azure AD tenant — practice IAM security
az ad user create --display-name "Test User" --user-principal-name testuser@yourtenant.onmicrosoft.com   --password "LabPassword123!" --force-change-password-next-login false

# Practice Azure AD security scenarios:
# - Conditional Access policies
# - Privileged Identity Management (PIM)
# - Service principal security
# - App registrations and OAuth consent phishing

# Microsoft Defender for Endpoint (free trial 30 days):
# Onboard a Windows VM and generate detections by running attack techniques
# Review alerts in the Security portal (security.microsoft.com)

# Azure Security Benchmark labs:
# docs.microsoft.com/security/benchmark/azure/ — free lab exercises

Lab Documentation and Portfolio

An undocumented lab is a missed opportunity. Your lab write-ups are your portfolio — evidence that you have hands-on skills that certificates cannot prove. Write-ups for your most interesting lab sessions belong on GitHub, LinkedIn, or a personal blog.

Write-Up Template

Lab session write-up template:

Title: [Attack Name] — [Lab Environment]
Date: YYYY-MM-DD
Duration: X hours
Objective: What were you trying to accomplish?

Environment:
  - DC01: Windows Server 2022 (192.168.100.10)
  - WS01: Windows 10 Pro (192.168.100.20) — domain joined
  - Kali: 192.168.100.5

Attack Path:
  1. Reconnaissance
     [Commands run, output observed]

  2. Initial Access
     [How you got the first foothold, credential or vulnerability]

  3. Privilege Escalation / Lateral Movement
     [Step-by-step with commands and screenshots]

  4. Objective Achieved
     [Evidence: flag, domain admin shell, DCSync output]

Detection Opportunity:
  SIEM query that would have caught this attack:
  [Paste SPL / KQL / EQL query]

  Windows Event IDs triggered: [list IDs]

  Why this technique might evade the query:
  [Evasion considerations]

Key Learnings:
  - What worked
  - What failed and why
  - What you would do differently
  - One new technique you discovered