Build a cybersecurity home lab.
Every cybersecurity job posting wants hands-on experience. Every certification rewards practical skill. The cheapest way to build both — for less than the cost of a single exam — is a home lab. This guide walks you through what to buy, what to install, and what to do with it once it's running.
Three things a home lab does that nothing else can.
Reading about security and watching videos teaches you concepts. A home lab teaches you what those concepts feel like in practice — and gives you something concrete to put on a resume. Most successful career-changers in cybersecurity built one. Most failed candidates didn't.
A home lab is for learning, not for attacking real targets.
Every offensive technique in this guide is for use only against systems you own or have explicit written permission to test. Running scans, exploits, or attacks against systems you don't own is illegal in most jurisdictions and can cost you your career and freedom. Isolate your lab on its own network segment, never bridge it to your employer's VPN, and never test against production systems — yours or anyone else's.
Three hardware tiers, by budget.
You don't need expensive hardware to learn cybersecurity. You need RAM and the discipline to use it. Pick the tier that matches your budget and learn what it teaches before upgrading.
Cloud-only lab
Use cloud free tiers and browser-based ranges to practice without any local hardware. The fastest way to start tonight, the easiest to abandon.
- AWS / Azure / GCP free tiers
- TryHackMe free rooms
- Hack The Box Starting Point
- OverTheWire wargames
- PortSwigger Web Security Academy
Repurposed laptop / desktop
A used business-class laptop or desktop with 32GB RAM is the sweet spot. Run 5–6 VMs simultaneously, build a small network, simulate real attack scenarios.
- Used ThinkPad / Dell Latitude / EliteBook
- 32GB RAM (non-negotiable)
- 500GB+ SSD
- i5 / Ryzen 5 or better
- VMware Workstation Pro (free) or VirtualBox
Dedicated mini PC / NUC
A dedicated machine running Proxmox or ESXi as a hypervisor, with enough RAM to run a real lab — domain controller, multiple endpoints, attacker box, SIEM, all simultaneously.
- Mini PC (Beelink, Minisforum) or NUC
- 64GB RAM minimum
- 1TB NVMe SSD
- Proxmox VE (free) or ESXi
- Optional: pfSense for network segmentation
Four stages, in order.
Build your lab in four stages. Don't skip ahead — each stage teaches something the next one assumes you know. The whole progression takes most people 6–12 weeks alongside other commitments.
Get a single VM running.
Install VMware Workstation Pro (free for personal use as of 2024) or VirtualBox. Download a Kali Linux ISO and create your first VM with 4GB RAM, 2 CPU cores, and a 40GB disk. Boot it. Take a snapshot. Break things. Restore the snapshot. Repeat.
This stage isn't about cybersecurity — it's about getting comfortable with the underlying platform. Most home labs fail at stage 2 because the builder didn't truly understand stage 1.
- Install a hypervisor (VMware Workstation Pro or VirtualBox)
- Create a Kali Linux VM with networking set to NAT
- Practice taking snapshots before risky operations and reverting
- Update the system, install one tool from APT, run it
- Configure a host-only network for future isolation
Add a victim, isolate the network.
Add a vulnerable target — Metasploitable 2, OWASP Juice Shop, or DVWA. Put both VMs on the same host-only network so they can talk to each other but not to the internet. This is your safe playground.
Practice the basics: run nmap against the target, identify open ports, manually verify what each service is, look up known vulnerabilities. The point isn't to "win" — it's to learn how reconnaissance and enumeration actually feel.
- Deploy Metasploitable 2 or OWASP Juice Shop as a victim VM
- Configure both VMs on a host-only network (isolated from internet)
- Run nmap against the victim and document what you find
- Exploit at least one identified vulnerability manually
- Document your steps in a personal blog or GitHub README
Add visibility — build the blue team side.
Add a Wazuh server VM. Install Wazuh agents on your other VMs. Install Sysmon on a Windows victim VM with the SwiftOnSecurity config. Now run an attack from Stage 02 again and watch what shows up in Wazuh.
This single experience — attacking your own machine and seeing the alerts fire — teaches more about how SOC work feels than weeks of reading. It's also the moment when "blue team" stops being abstract.
- Deploy Wazuh manager on a dedicated VM (4GB RAM minimum)
- Install Wazuh agents on all other VMs
- Add a Windows 10/11 VM with Sysmon and SwiftOnSecurity config
- Generate attack telemetry by running scans and exploits against your own VMs
- Investigate the resulting alerts and correlate them to your actions
- Write up one detection scenario as a portfolio piece
Build a small AD environment.
Most enterprise networks run on Active Directory, and most enterprise attacks pivot through AD. Build a small domain: one Windows Server domain controller, one Windows 10 workstation joined to the domain, your Wazuh server collecting from both, and Kali for the attacker side.
The "Game of Active Directory" project (free GitHub repo) provides a ready-to-deploy vulnerable AD lab. From there, practice with BloodHound, Kerberoasting, and lateral movement — and watch every step in your SIEM.
- Deploy Windows Server 2022 as a domain controller (free 180-day eval)
- Join a Windows 10 client to the domain
- Use the Game of Active Directory repo for a pre-made vulnerable setup
- Run SharpHound and explore in BloodHound
- Practice Kerberoasting and ASREPRoasting attacks
- Detect the same attacks in Wazuh and Sysmon logs
What to install, by category.
Every tool below is genuinely free for personal use. The flagship in each category — highlighted in accent — is the one most worth your time if you have to choose.
Where your VMs run
The platform that hosts every other VM. Pick one, learn it, stick with it for at least the first six months.
Your offensive toolkit
Pre-loaded Linux distros with hundreds of security tools. Use one, customize it, take snapshots before experiments.
Things to attack legally
Deliberately vulnerable systems designed for practice. Each teaches different vulnerability classes safely.
Where you watch attacks land
Centralized log collection and analysis. The blue team's main interface — every SOC analyst lives in one of these.
What your endpoints report
Sensors on your endpoints that generate the events your SIEM ingests. Without these, your SIEM is blind.
For real-world realism
Once basics are solid, AD adds the realism most enterprise attacks need. Use evaluation licenses or community projects.
Segmenting the lab
Once your lab grows past 3–4 VMs, dedicated network segmentation matters. Build the muscle memory now.
Modern attack surface
Most modern attacks involve containers or cloud. Add these once your VM-based lab is stable.
Eight things to do this month.
Once your lab is running, these are the practical exercises worth doing first. Each one teaches something specific that maps to real interview questions or job tasks.
Five mistakes that derail home labs.
Most home labs fail for the same reasons. Recognize the patterns early and you'll keep yours running.
Not sure which path your lab should focus on?
Take the 2-minute career fit quiz — find your track first, then build the lab that matches it. A focused lab beats a broad one every time.