Sefism is free for learners. We are here to help you grow, one step at a time.Join for free
Sefism.
Security

Isolated Security Training Lab with Professional Assessment Reports

A small, fully isolated lab of deliberately weak web services for a university security course, assessed the way a professional tester would: signed scope, methodology, a full report with severity and remediation, fixes with tests, and a retest. A cybersecurity final year project that teaches authorised testing and report writing with no exposure to real systems.

Topics
Difficulty

Intermediate

A small team, or one strong student willing to learn something new.
Effort

1 semester · 1 to 2 students

Deliverables

7 to ship

3 optional extras

Suggested stack

Docker Compose (internal network only)Python (Flask) or Node.js (Express)PostgreSQLOWASP ZAP and Burp Suite CommunityLoki or Elasticsearch for logsSysReptor or Markdown to PDFGitHub Actions
A suggestion, not a requirement. Swap anything for what you already know.

What you should ship

  • A Docker Compose lab on an internal network with no internet route and three to five small services (for example notes, file upload and an API)
  • One documented weakness class per service, mapped to the OWASP Top 10 or API Security Top 10, with a lecturer answer key kept out of the public repo
  • A reset script that restores every service to a clean state in under a minute
  • A signed scope and rules of engagement with the supervisor acting as the client, and a methodology based on the OWASP Web Security Testing Guide
  • A professional report with executive summary, findings, CVSS severity, redacted evidence and remediation advice
  • Fixed versions of each service with automated tests proving each weakness is gone, and a retest section in the report
  • Central logging and one detection rule per scenario, so each exercise also produces data a defender can investigate

If you have time left

  • A CI pipeline that runs Semgrep and a ZAP baseline scan against the fixed versions on every push
  • A short lecturer guide and a student worksheet for running the lab in a two-hour class
  • A scoreboard mode using self-hosted CTF software for class competitions

The problem: courses need safe practice and employers need report writers

University security courses teach vulnerabilities in lectures but rarely give students a safe, resettable place to practise, and practising on real systems is illegal and unethical. At the same time, security teams hire people who can test methodically and write reports that developers actually act on. Students graduate knowing what SQL injection is but having never scoped an engagement, written a finding with impact and remediation, or retested a fix.

What already exists and the gap

  • OWASP Juice Shop is a large, deliberately insecure web shop used for training and CTFs.
  • DVWA (Damn Vulnerable Web Application) is a classic PHP app with adjustable difficulty levels.
  • PortSwigger Web Security Academy and platforms like TryHackMe and Hack The Box offer hosted labs and guided rooms.
  • SysReptor is an open source pentest reporting platform that renders Markdown findings to PDF.

These are excellent for practising exploitation, but they end at "you found it". None of them walks a student through the full professional cycle: scope, rules of engagement, methodology, report, fix, test and retest, on services small enough to understand completely. Hosted platforms also need reliable internet, which is not a given in every university lab. The gap is a compact, offline, course-ready lab where the report and the fix are the deliverables.

What you build

  • Lecturer: starts the lab with one command, resets it between classes, uses the answer key and worksheet.
  • Student tester: receives a scope document, tests within it, writes findings.
  • Developer (you, later): fixes each service, writes tests, and the tester retests.
  • Defender: reads the central logs and detection alerts produced during the exercise.

The technically interesting part

Isolation and resettability as engineering. The lab must be impossible to expose by accident. Use an internal Docker network with no gateway, bind nothing to a public interface, and write a check script that fails if any container can reach the internet. Resets must be deterministic: rebuild containers, reseed databases and clear uploads.

Fixes proven by tests. For each weakness, write a test that demonstrates the unsafe behaviour at a high level (for example, that a user can read another user's note) and fails once the fix is in. This is the same regression discipline mature teams use after a security incident, and it gives examiners a direct link from finding to code.

Report quality. Each finding needs a clear title, affected component, severity with reasoning, impact in business terms, redacted evidence and specific remediation. Write it for a developer who was not in the room.

How to evaluate it

  • Isolation: the network check passes on three different machines.
  • Class trial: run the lab with at least 8 students; record setup time, completion rates and feedback from the lecturer.
  • Report review: ask a practising security professional or senior lecturer to grade the report against a rubric.
  • Fix coverage: every finding has a passing regression test and a retest entry.
  • Detection: each scenario triggers its detection rule during the class trial.

Suggested plan

  1. Weeks 1 to 2: ethics approval, scope and rules of engagement, choose weakness classes.
  2. Weeks 3 to 6: build the services, isolation check and reset script.
  3. Weeks 7 to 9: assess the lab following your methodology; write the report.
  4. Weeks 10 to 12: fixes, regression tests, logging and detection rules.
  5. Weeks 13 to 15: retest, class trial, final write-up.

Path to a product

Your first user is the security course at your own university. A polished lab with worksheets can be offered to other universities and training institutes as an open source kit with paid setup and new scenarios, or as a teaching package for corporate security awareness sessions for developers. For you, the report is also the best portfolio piece for a junior security role.

Scope warning

Never expose the lab to the internet or a shared campus network. Do not publish working exploit code; the public repository contains the lab, fixes, tests and report. Do not add more than five services, and do not build your own CTF platform.

Learn what you need on Sefism

Get help with this idea

This project depends on doing the ethics and isolation properly from day one. Tauseef can help you agree scope with your supervisor, pick weakness classes that teach well, and structure the report so it reads like professional work. If you are new here, create a free account first.

Ideas and guidance, not finished projects

These are project ideas and scoping guidance, published free for students to use as a starting point. I do not build, write, or sell final-year projects, and I do not complete coursework for anyone. Take an idea, make it yours, and build it.

Not sure this one fits you?

I help students pick an idea that matches their skills and their deadline, then scope it down until it is finishable. Guidance only, never done for you.

Discuss this idea
Work with me

Stuck on something specific?

Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.

Book a free sessionSee all services

Follow along

New writing, resources and project ideas land here first.