Cybersecurity June 3, 2025 1 min read
Building a Cybersecurity Home Lab from Scratch
Everything you need to spin up a safe, isolated lab for practicing detection, incident response, and offensive techniques.
The fastest way to learn security is to break and defend things in an environment you own. Here is how I build a home lab that is realistic, isolated, and cheap.
The core components
- A hypervisor: VirtualBox or Proxmox
- A monitoring stack: Security Onion for full packet capture and alerts
- A victim network: a couple of Windows and Linux VMs
- An attacker box: Kali Linux
Keep it isolated
Put the entire lab on a dedicated host-only or internal network so nothing can escape to your production LAN. Snapshots are your friend — take one before every experiment so you can roll back instantly.
A first exercise
- Generate suspicious traffic from Kali (a port scan is enough).
- Watch it appear in Security Onion's alerts.
- Pivot from the alert to the raw packets and write up what you saw.
# Simple scan to trigger detections
nmap -sS -p- 10.0.0.0/24
That loop — generate, detect, analyze — is the heartbeat of blue-team practice. Do it a hundred times and detection becomes second nature.
