A safe home lab

The setup for practising without hurting anyone: virtual machines, isolated networks, intentionally vulnerable apps, platform rules and notes.

Virtual machine

Also called VM, hypervisor, VirtualBox, VMware, Hyper-V

What: A complete computer running as software inside your own, managed by a hypervisor such as VirtualBox, VMware Workstation or Hyper-V.
Why: Anything you break or infect stays inside the VM, and you can run Linux, Windows and practice targets side by side.

Watch out

Running practice tools directly on your everyday computer.

Snapshot

What: A saved state of a virtual machine that you can return to in seconds.
Why: Take one before each exercise so mistakes become a quick rollback instead of a reinstall.

Watch out

Keeping dozens of old snapshots, which slows the VM and fills the disk.

Isolated lab network

Also called host-only, internal network, NAT, bridged

What: A hypervisor network mode, such as host-only or internal, that lets lab machines talk to each other but not to your home network or the internet.
Why: It keeps vulnerable machines unreachable from outside and stops your tools touching devices you do not own.

Watch out

Putting a vulnerable VM on a bridged network, where anyone on your Wi-Fi can reach it.

Intentionally vulnerable apps

Also called OWASP Juice Shop, practice target

What: Applications built with documented weaknesses so people can learn to find, fix and detect them legally, such as OWASP Juice Shop.
Why: They give every path a realistic target: defenders read its logs, AppSec learners fix its code, future testers practise reports.

Watch out

Deploying one to a public cloud server, exposing a deliberately broken app to the internet.

Practice platform rules

Also called terms of service, lab scope

What: Each platform's rules on what you may test (only the machines it gives you), what is banned (attacking the platform or other users) and what you may publish.
Why: Following them keeps your practice legal and your account open.

Watch out

Treating a platform VPN connection as permission to scan anything on it.

Running targets in containers

Also called Docker, localhost binding

What: Starting practice apps and tools as containers, with ports published only on 127.0.0.1 so only your own machine can reach them.
Why: Containers start in seconds, reset cleanly and keep your lab reproducible.

Shell

docker run --rm -p 127.0.0.1:3000:3000 \
  bkimminich/juice-shop
# open http://localhost:3000, Ctrl+C to stop

Watch out

Publishing a port on all interfaces by habit, exposing the app to your whole network.

Lab notes

Also called notebook, Obsidian, CherryTree

What: One page per exercise recording date, goal, steps, observations, meaning, and how the issue is prevented or detected, with captioned screenshots.
Why: Notes become your revision material, portfolio write-ups and practice for the reports every security role writes.

Watch out

Doing many labs and writing nothing down, so none of it sticks.

Scripting for security

Also called Python, Bash, PowerShell

What: Small scripts that read logs, filter and count events, or query a system, written in Python, Bash or PowerShell.
Why: They save hours of manual work and help you understand what tools are doing rather than trusting output blindly.

Python

from collections import Counter
import re

hits = Counter()
with open("auth.log") as f:
    for line in f:
        m = re.search(r"Failed password .* from (\S+)", line)
        if m:
            hits[m.group(1)] += 1
print(hits.most_common(5))

Watch out

Running scripts copied from the internet without reading them first.

Go deeper