Cybersecurity
Practical application security, monitoring and continuous learning.
My Cybersecurity Laboratory
Beginner's Private Cybersecurity Lab v1 · isolated from production, used only for authorized testing against deliberately vulnerable machines
I designed a segmented VMware lab with isolated Windows and Linux systems and vulnerable applications including DVWA, OWASP Mutillidae, Juice Shop and WebGoat. I use Kali Linux, Burp Suite, Nmap, Netcat and Metasploit for authorized testing of injection, file inclusion, authentication, permissions and input validation.
Wazuh, Sysmon and endpoint agents support investigation of suspicious processes, authentication events and network activity. I document weaknesses, root causes and remediation options, connecting offensive testing with defensive monitoring.
My learning includes OWASP-focused study, PortSwigger training and OffSec course material. The guides below are study resources.
High-level architecture
| Component | Role | Known configuration |
|---|---|---|
| VMware Workstation | Hypervisor | Version 17.5.2 used on a Windows 11 Pro host |
| pfSense | Firewall and router | LAN gateway 192.168.10.1/24; WAN connected through VMware NAT |
| Kali Linux | Authorized attack workstation | Connected to 192.168.10.0/24; historical examples include 192.168.10.120 and 192.168.10.133 |
| Metasploitable | Deliberately vulnerable target | Hosts DVWA, Mutillidae, TIKIWIKI and legacy services at 192.168.20.10 |
| Windows Server 2022 | Identity and infrastructure | Active Directory Domain Services, DNS, centralized users and access; Wazuh agent name Win-Server |
| Windows workstation | Domain member and monitored endpoint | Domain authentication, Wazuh Agent, and Sysmon telemetry |
| Ubuntu server/member | Linux endpoint and/or application host | Joined to the Windows domain so authorized domain users can sign in |
| Wazuh | SIEM/XDR platform | Manager reachable at 192.168.10.30:1514/tcp; AES-protected agent communication |
| Ubuntu — Suricata | Network and endpoint monitoring | ens33 at 192.168.10.20/24; Suricata and Sysmon for Linux |
| Nessus | Network scanner | Scans operating systems, services, and ports to find weaknesses |
| OWASP Juice Shop | Modern insecure web application | Used for security trainings, awareness demos and CTFs |
| OWASP WebGoat | Deliberately insecure Java application | Exercises vulnerabilities common in Java-based components |
Kali Linux is a dedicated authorized testing workstation (a customized Z Security image chosen for its tooling against Mutillidae and DVWA). Tools used or planned:
- Burp Suite for intercepting and modifying web traffic
- Nmap for host, port, and service discovery
- Metasploit for controlled exploitation
- Netcat for listeners and connectivity tests
- Wireshark for packet capture and protocol analysis
- Weevely for controlled web-shell exercises
- BloodHound for future Active Directory security analysis
Nessus provides vulnerability assessment separate from Kali/Metasploit testing and Wazuh monitoring:
- Define an explicit allowlist of owned lab assets and take recoverable snapshots
- Record the scanner host, edition, plugin-feed date, policy, and assessment date
- Use non-disruptive assessment settings appropriate for fragile legacy targets; record credentialed coverage where authorized
- Review findings for relevance and false positives, including plugin ID, CVE, affected service, severity, and evidence
- Prioritize remediation and compare timestamps with endpoint/network telemetry where available — no automatic Nessus-to-Wazuh integration
- Rescan after remediation and retain before/after evidence; never include credentials in exported documentation
| Target | Learning objective |
|---|---|
| DVWA | SQL injection, file inclusion, command execution, upload handling, and authentication weaknesses |
| OWASP Mutillidae | OWASP-style web vulnerabilities, SQL injection, input validation, file access, and permissions |
| Metasploitable | Network discovery, legacy-service analysis, controlled exploitation, and post-exploitation observation |
| OWASP Juice Shop | Modern web application and API security testing |
| WebGoat | Guided OWASP vulnerability lessons |
Ubuntu is a domain member (authentication via Windows Server) that also hosts two distinct monitoring components: Suricata for network intrusion detection, and the Wazuh Agent, which collects Ubuntu logs and host telemetry and can forward Suricata events when configured.
Suricata inspects traffic reaching its capture interface (ens33 at 192.168.10.20/24) and applies detection rules against activity aimed at the vulnerable applications. Its documentation still needs to confirm the capture method — hosting Suricata on Ubuntu does not automatically make it see traffic between Kali and Metasploitable, and a missing alert does not prove nothing suspicious happened.
Wazuh centralizes security events from monitored Windows and Linux systems:
- Wazuh Agent — collects configured endpoint events and sends them to the server
- Wazuh server/manager — decodes received events and evaluates detection rules
- Wazuh indexer — stores and indexes forwarded security data
- Wazuh dashboard — interface for searching events, reviewing alerts, and investigating findings
Sysmon records selected Windows endpoint activity (e.g. process creation) into the Event Log, which the Wazuh Agent collects — giving a host-level perspective that complements Suricata's network view. A practical validation workflow:
- Confirm the relevant agents and sensor are running
- Generate a benign, recognizable event (e.g. opening Notepad on a monitored Windows endpoint)
- Verify it locally, then verify its arrival in Wazuh
- Separately confirm that Suricata receives the intended network traffic
- Validate a known detection and follow its alert through to Wazuh
- Record timestamps, affected hosts, evidence, and any visibility gaps
alert http any any -> $HOME_NET any (msg:"LAB SQLi BODY - UNION SELECT detected"; flow:established,to_server; http.request_body; content:"union"; nocase; content:"select"; nocase; sid:9000101; rev:1;)
alert http any any -> $HOME_NET any (msg:"LAB SQLi BODY - MySQL SLEEP detected"; flow:established,to_server; http.request_body; content:"sleep("; nocase; sid:9000103; rev:1;)
alert http any any -> $HOME_NET any (msg:"LAB SQLi BODY - MySQL BENCHMARK detected"; flow:established,to_server; http.request_body; content:"benchmark("; nocase; sid:9000104; rev:1;)
alert http any any -> $HOME_NET any (msg:"LAB SQLi BODY - information_schema enumeration"; flow:established,to_server; http.request_body; content:"information_schema"; nocase; sid:9000105; rev:1;)
alert http any any -> $HOME_NET any (msg:"LAB SQLi BODY - PostgreSQL pg_sleep detected"; flow:established,to_server; http.request_body; content:"pg_sleep("; nocase; sid:9000106; rev:1;)
alert http any any -> $HOME_NET any (msg:"LAB SQLi BODY - MySQL INTO OUTFILE file write attempt"; flow:established,to_server; http.request_body; content:"into"; nocase; content:"outfile"; nocase; distance:0; within:30; sid:9000110; rev:1;)
alert http any any -> $HOME_NET any (msg:"LAB SQLi BODY - MySQL INTO DUMPFILE file write attempt"; flow:established,to_server; http.request_body; content:"into"; nocase; content:"dumpfile"; nocase; distance:0; within:30; sid:9000111; rev:1;)
alert http any any -> $HOME_NET any (msg:"LAB SQLi BODY - MySQL LOAD_FILE filesystem read attempt"; flow:established,to_server; http.request_body; content:"load_file("; nocase; sid:9000112; rev:1;)
alert http any any -> $HOME_NET any (msg:"LAB SQLi - MySQL LOAD_FILE attempt"; flow:established,to_server; http.uri; content:"load_file("; nocase; sid:9000012; rev:1;)
alert tcp 192.168.20.10 any -> 192.168.10.133 8080 (msg:"LAB Possible Reverse Shell Callback to Kali"; flow:established,to_server; sid:9000020; rev:1;)