Free & Open Source Lab Blueprint

This blueprint outlines how to build an enterprise-grade security testing and defensive analysis laboratory using 100% free, open-source software. No paid licenses, subscriptions, or proprietary software are required.

---

Architecture Overview

An isolated host-only network topology ensures that testing traffic, scanner activity, and payload executions cannot leak outside your virtualized environment.

                    [ HOST COMPUTER (Linux / Windows / macOS) ]
                                         │
                   ┌─────────────────────┴──────────────────────┐
                   │   VirtualBox Host-Only Adapter / Bridge    │
                   │               192.168.56.0/24              │
                   └─────────────────────┬──────────────────────┘
                                         │
        ┌────────────────────────────────┼──────────────────────────────┐
        │                                │                              │
        ▼                                ▼                              ▼
┌──────────────┐                 ┌──────────────┐               ┌──────────────┐
│  Attacker VM │                 │ Target Stack │               │Defensive SIEM│
│  Kali Linux  │                 │Docker/Linux  │               │ Wazuh Server │
│192.168.56.10 │                 │192.168.56.20 │               │192.168.56.30 │
└──────────────┘                 └──────────────┘               └──────────────┘

---

Prerequisites & Hypervisor

VirtualBox (Free, Open-Source GPLv2)

Download the VirtualBox installer and Extension Pack from virtualbox.org.

1. Open VirtualBox → File → Tools → Network Manager.
2. Select Host-only Networks and click Create (vboxnet0).
3. Set the configuration:
   • IPv4 Address: 192.168.56.1
   • IPv4 Network Mask: 255.255.255.0
   • DHCP Server: Disabled (or configure static IPs manually).

---

Component 1: Attacker Machine (Kali Linux)

Download the official pre-built virtual machine image from kali.org:

1. Import the .ova image into VirtualBox.
2. Configure network adapters:
   • Adapter 1: NAT (Internet access for downloading updates).
   • Adapter 2: Host-Only Adapter (vboxnet0 on 192.168.56.0/24).
3. Start the VM, open a terminal, and install the base security tools:

   sudo apt update && sudo apt install -y \
     git curl python3-pip nmap wireshark tcpdump tshark \
     feroxbuster nikto sqlmap impacket-scripts seclists

---

Component 2: Target Environment (Docker & Vulhub)

Instead of manually building fragile operating systems, run isolated vulnerability environments using Docker on a clean Debian or Ubuntu Server VM (192.168.56.20).

1. Install Docker & Docker Compose:

sudo apt update && sudo apt install -y ca-certificates curl gnupg
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

sudo apt update && sudo apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin

2. Launch Open-Source Targets:

Target A: OWASP Juice Shop (Modern Web Applications)

docker run -d --name juiceshop -p 3000:3000 bkimminich/juice-shop

Access from Kali at http://192.168.56.20:3000 to practice modern XSS, SQLi, broken access control, and JWT manipulation.

Target B: Damn Vulnerable Web Application (DVWA)

docker run -d --name dvwa -p 80:80 vulnerables/web-dvwa

Access from Kali at http://192.168.56.20:80 (default credentials: admin / password).

Target C: Vulhub (Real-World CVE Reproductions)

Clone the open-source Vulhub repository containing over 400 pre-configured Docker environments for real-world historical CVEs (Log4j, Spring4Shell, Apache Struts, etc.):

git clone https://github.com/vulhub/vulhub.git
cd vulhub/log4j/CVE-2021-44228
docker compose up -d

---

Component 3: Defensive Monitoring (Wazuh Open-Source SIEM / XDR)

Wazuh is a free, 100% open-source security monitoring and threat detection platform that includes log analysis, integrity monitoring, rootkit detection, and compliance auditing.

1. Deploy Wazuh All-in-One via Docker:

On a dedicated Ubuntu/Debian VM (192.168.56.30) with at least 4 GB RAM:

git clone https://github.com/wazuh/wazuh-docker.git -b v4.9.0 --depth=1
cd wazuh-docker/single-node
docker compose up -d

2. Access the Wazuh Dashboard:

Open your browser on Kali or your host and navigate to: https://192.168.56.30 (Default credentials: admin / SecretPassword).

3. Deploy Wazuh Agent to Your Target VM:

In the Wazuh dashboard, click Add Agent, select Debian/Ubuntu, copy the generated one-line command, and execute it on the Target VM:

wget https://packages.wazuh.com/4.x/apt/pool/main/w/wazuh-agent/wazuh-agent_4.9.0-1_amd64.deb
sudo WAZUH_MANAGER='192.168.56.30' dpkg -i wazuh-agent_4.9.0-1_amd64.deb
sudo systemctl daemon-reload
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agent

---

Component 4: Open-Source Active Directory Testing (GOAD)

If you need to practice Active Directory exploitation and defense without Windows Server licenses, use Game of Active Directory (GOAD):

• Open-source project by Mayfly (github.com/Orange-Cyberdefense/GOAD).
• Fully scripted deployment using Vagrant and Ansible.
• Automates the configuration of domain controllers, member servers, and workstations with realistic misconfigurations (Kerberoasting, AS-REP roasting, ACL abuse, NTLM relaying, and AD CS vulnerabilities).

---

Verification Drill

1. Scan Target: From Kali, scan the target server:

   nmap -sC -sV 192.168.56.20 -p 80,3000

2. Review Telemetry: Open the Wazuh dashboard at https://192.168.56.30. Inspect the Security Events log to view the port scan detection alerts generated by the Wazuh agent in real time.