Lab
Where I break things
Not a homelab tour. The point is that testing happens somewhere isolated, on purpose, with the reasoning written down.
Everything I test runs here, on hardware I own, on a network that cannot reach anything that matters. That is not paranoia — it is the difference between practising and causing an incident.
The design goal is disposability. Any machine in here can be destroyed and rebuilt without losing anything, because nothing of value lives in the lab. If a target escapes its box, it lands somewhere with no credentials, no route out and nothing to pivot into.
Network
Three segments, one rule
Nothing in the target segment can reach anything that matters. That is enforced at the network, not by remembering to be careful.
Management
10.10.0.0/24
Hypervisor, storage and the machine I actually work from. Reachable from the LAN, reachable by nothing in the lab.
Full outbound, no inbound from lab segments
Attack
10.10.10.0/24
Where the tooling lives. Can reach the target segment and the internet — some tooling genuinely needs updates and wordlists.
Outbound allowed, reaches targets
Targets
10.10.20.0/24
Deliberately vulnerable machines and applications. Assume every host here is compromised, because that is the point of them.
No outbound. No route to management. Nothing.
Machines
What runs where
Hypervisor
Virtualisation host
Linux
Runs everything. Snapshots before each session so a target can be reverted in seconds instead of rebuilt in an hour.
ManagementAttack box
Testing workstation
Kali Linux
Where the tooling lives. Rebuilt from a base snapshot regularly, because a tooling VM accumulates state that quietly changes results.
AttackWeb targets
Vulnerable applications
Linux + Docker
Deliberately vulnerable web applications in containers — a fresh instance per exercise so findings are never contaminated by the last one.
TargetsWindows target
Domain practice
Windows Server
A small Active Directory setup for practising the parts of the OSCP that are not web.
TargetsDevelopment
Application development
Linux
Where Hackuten, Orbyte and Batelys actually get built and staged before anything reaches production.
ManagementTooling
Containers and scripts
Containerised targets
OWASP Juice Shop
The reference vulnerable application. Good for calibrating, less good once you know it.
DVWA
Blunt and useful for isolating one vulnerability class at a time.
Custom targets
Applications I write specifically to contain one bug, to check I can find it from the outside.
Local registry
Images cached locally so the target segment never needs outbound access.
Scripts
lab-up / lab-down
BashBrings the target segment up and tears it down. Nothing in the lab runs when I am not using it — idle vulnerable services are just risk.
snapshot-revert
BashReverts every target to its clean snapshot. Run before each session, so results are never inherited from the last one.
recon
PythonWraps the enumeration I run every time — scans, service detection, content discovery — into one command with consistent output.
notes
PythonScaffolds a note file per target with the methodology checklist pre-filled. Reduces the friction that makes people skip documentation.
Principles
Why it is built this way
Isolated by default
The target segment has no route to anything I care about and no outbound access. Isolation is enforced at the network, not by remembering to be careful.
Disposable, always
Every machine can be destroyed and rebuilt from a snapshot. Nothing irreplaceable lives in the lab, which means nothing in the lab needs protecting.
Reproducible
Targets are defined as configuration, not hand-configured. A finding I cannot reproduce from a clean state is a finding I do not trust.
Off when unused
The lab is not running right now. Deliberately vulnerable services with an uptime counter are a liability, not a portfolio.