Stage 2 of 8 · 7 lessons · ~4 weeks

A safe home lab

Build a place to practise that cannot hurt anyone: virtual machines, an isolated network, intentionally vulnerable apps and practice platforms used by their own rules, with notes you keep from the first day.

Start: Virtual machines and snapshots

Lessons· one lesson for each topic, in this order

Do this

Install a hypervisor and create a Linux virtual machine with a snapshot.
Set up a host-only or internal network and draw it with addresses.
Run OWASP Juice Shop in a container bound to localhost or on the isolated network.
Sign up for one practice platform for your path and read its rules page.
Complete three beginner exercises and write one notes page for each.
Write a small script that reads a log file and counts matching lines.

Start with

GuideFree
Docker Docs: Get Started
Docker · Beginner
Enough Docker to run, reset and remove practice targets and tools cleanly

Practise

OWASP Juice Shop
The standard intentionally vulnerable web app: run it locally and use it throughout your path
TryHackMe
Browser-based machines if your laptop cannot run a full lab, with clear rules on what you may target

Keep handy

Kali Linux Documentation
Official guides for running Kali as a virtual machine, the usual testing workstation
Wireshark User's Guide
Capture and read your own lab traffic to see what normal and unusual look like

Also worth your time

Linux Upskill ChallengeGo deeper
A month of daily tasks on a real Linux server if you want your Linux administration to be solid

Before moving on: A documented home lab: a network diagram, at least two virtual machines on an isolated network with snapshots, an intentionally vulnerable app running only on localhost or a host-only network, one practice platform account, and your first three lab-note pages.

Tauseef's advice

A lab does not need expensive hardware. If your laptop is weak, use the browser-based machines on the practice platforms and one small virtual machine. What matters is the habit: isolate, snapshot, take notes. And read the rules of each platform before you start; people do get banned for attacking the platform itself.