~/projects/home-lab

Offensive Security Home Lab

Break into my own network, then write the rules that catch it.

Deliberately vulnerable machines on my home network, attacked from Kali to learn each attack from start to finish. Cyber Sentinel's Wazuh agent then watched them.

Back to projects

Kali The attacking machine

Metasploitable The deliberately vulnerable targets

Metasploit The exploitation framework

Wazuh Rules and alerts for what I ran

~/lab/objective

Practice offensive security, then use it to defend.

The lab was built to run real attack techniques end to end against systems I own, and to turn what that taught me into Wazuh rules and alerts for Cyber Sentinel.

~/lab/environment

Vulnerable targets on a bridged network.

A Kali attacker and intentionally vulnerable targets: Metasploitable 2, Metasploitable 3 in its Windows and Ubuntu builds, and a spare Windows 10 laptop. The four virtual machines ran in VMware Workstation Pro, bridged onto my home LAN so the attacks crossed a real network, with no port forwarding.

~/lab/method

Scan, break in, escalate, stay quiet.

01

Reconnaissance

Finding the live hosts on the bridged LAN with Nmap.

02

Enumeration

Every open port, the service behind it and its exact version.

03

Vulnerability analysis

Matching those versions to known weaknesses and choosing the way in.

04

Exploitation

A first foothold through Metasploit modules, manual exploits or credential attacks.

05

Privilege escalation

From that foothold to root on Linux and SYSTEM on Windows.

06

Post-exploitation

Keeping access, and moving through the machine quietly.

07

Covering tracks

OPSEC throughout: as little trace as possible.

~/lab/detection

Then the machines got a Wazuh agent.

Agents on Windows 10 and both Metasploitable 3 builds, reporting to Cyber Sentinel's Wazuh Manager.
A Cowrie honeypot, and a script that blocked an alerted address from connecting again.
A second Kali, on the laptop, played the outside attacker, so I could practice detecting and responding to an attack as well as running one.

~/lab/outcome

Attacks run end to end, and rules written against them.

Every attack ran from Kali, and the Wazuh rules and alerts for Cyber Sentinel were built from what I had just done to those machines.