Stage 2 of 8 · 7 lessons · ~4 weeks

A safe home lab

Build a place to practise that cannot hurt anyone: virtual machines, an isolated network, intentionally vulnerable apps and practice platforms used by their own rules, with notes you keep from the first day.

Start: Virtual machines and snapshots

Lessons· one lesson for each topic, in this order

Do this

Install a hypervisor and create a Linux virtual machine with a snapshot.
Set up a host-only or internal network and draw it with addresses.
Run OWASP Juice Shop in a container bound to localhost or on the isolated network.
Sign up for one practice platform for your path and read its rules page.
Complete three beginner exercises and write one notes page for each.
Write a small script that reads a log file and counts matching lines.

Start with

GuideFree
Docker Docs: Get Started
Docker · Beginner
Enough Docker to run, reset and remove practice targets and tools cleanly

Practise

OWASP Juice Shop
The standard intentionally vulnerable web app: run it locally and use it throughout your path
Web Security Academy
Free web security labs with clear explanations of each weakness and its prevention

Keep handy

Wireshark User's Guide
Capture and read your own lab traffic to see what normal and unusual look like

Also worth your time

Linux Upskill ChallengeGo deeper
A month of daily tasks on a real Linux server if you want your Linux administration to be solid

Before moving on: A documented home lab: a network diagram, a Linux virtual machine with snapshots, OWASP Juice Shop running locally from source or a container so you can read its code, a Web Security Academy account, and your first three lab-note pages.

Tauseef's advice

A lab does not need expensive hardware. If your laptop is weak, use the browser-based machines on the practice platforms and one small virtual machine. What matters is the habit: isolate, snapshot, take notes. And read the rules of each platform before you start; people do get banned for attacking the platform itself.