Category: Home Lab
Difficulty: Beginner
Reading Time: 13 minutes
Introduction: Why Build a Home Lab?
There comes a point in every cybersecurity professional's journey where they realise that reading about tools, techniques, and exploits is not the same as using them. You can watch a hundred YouTube videos on Wireshark packet analysis, but until you have captured live traffic from a compromised host and traced the C2 callback yourself, the knowledge remains stubbornly theoretical.
A home lab solves this. It provides a safe, legal, isolated environment where you can break things, build things, attack things, and defend things without risking your employer's infrastructure, your liberty, or your ISP's terms of service. It is the cybersecurity equivalent of a musician's practice room -- a place where mistakes are free, experimentation is encouraged, and nobody calls the incident response team when you accidentally crash the domain controller for the fifteenth time.
This article covers everything needed to get started: why a lab matters, what hardware to consider, which hypervisors to evaluate, essential virtual machines to deploy, and how to keep the whole thing properly isolated so your "malware analysis" does not become "malware incident."
Why Bother? The Case for a Home Lab
Certification Preparation
Nearly every worthwhile cybersecurity certification requires hands-on skills. OSCP demands practical exploitation. GIAC certifications benefit enormously from lab practice. CySA+ expects defensive analysis skills. Blue Team Level 1 and 2 require practical investigation capabilities. A lab provides the environment to develop these skills without purchasing expensive cloud-hosted lab time for every practice session.
Skill Development
Security tools are not intuitive. Splunk has a learning curve that resembles the north face of the Eiger. Volatility memory forensics requires practice. Writing YARA rules that actually match malware without flagging every legitimate executable requires refinement. A lab lets you build these skills iteratively, at your own pace, with the freedom to experiment.
Portfolio Building
"I have experience with SIEM deployment and log analysis" carries more weight when backed by documentation of a working Security Onion or Wazuh deployment. Blog posts, write-ups, and screenshots from a home lab demonstrate practical capability in a way that certificates alone cannot.
Testing and Research
A controlled environment for testing tools, scripts, and techniques is invaluable. Want to understand how Mimikatz extracts credentials? Test it in the lab. Need to evaluate a new EDR solution? Deploy it against known malware samples in isolation. Curious about what a particular ransomware strain does to a file system? Detonate it in a sandboxed VM and watch.
Hardware: Choosing Your Platform
The good news is that useful cybersecurity labs do not require enterprise-grade hardware. The bad news is that once you start building, "just one more VM" becomes an addiction that your wallet and your electricity meter will both notice.
Budget Tier: Repurposed Hardware
Old desktops and laptops make serviceable lab machines. A decommissioned office desktop with an i5 processor, 16GB RAM, and an SSD can run several VMs simultaneously. Check local recycling centres, eBay, and corporate surplus sales. The hardware does not need to be new -- it needs to be functional and have enough RAM.
Key considerations for repurposed hardware:
- RAM is king. 16GB is the bare minimum for a useful lab. 32GB is strongly preferred. 64GB opens up serious possibilities. Everything else is secondary.
- SSD is essential. Running VMs from a spinning hard drive is an exercise in frustration. Even a modest SATA SSD dramatically improves performance.
- CPU is less critical than you might think. Most lab workloads are memory-bound, not CPU-bound. A 4th-generation i5 with enough RAM will outperform a latest-generation i7 with 8GB.
Mid-Range: Mini PCs and Small Form Factor
Mini PCs hit a sweet spot of performance, power consumption, and physical footprint. Several options stand out:
Intel NUC (and successors): Compact, relatively quiet, and available with up to 64GB RAM in later models. NUC 12 and 13 models support DDR4/DDR5 and NVMe storage. They make excellent single-node lab machines and can be clustered for more ambitious setups.
HP EliteDesk Mini / Dell OptiPlex Micro / Lenovo ThinkCentre Tiny: These business-class mini desktops appear on the second-hand market in volume as companies refresh their fleets. Models from 2019 onwards typically support 32-64GB RAM, NVMe storage, and Intel vPro. They are engineered for reliability, have proper cooling, and are whisper-quiet.
Beelink / MinisForum / GMKtec: Budget mini PCs from these manufacturers offer impressive specifications for the price. Models with AMD Ryzen 7 or Intel N100/N305 processors, expandable RAM, and dual NVMe slots are available for surprisingly reasonable sums. Build quality varies, so read reviews carefully.
Approximate costs: Second-hand EliteDesk Minis with 32GB RAM and 256GB SSD can be found for 100-200 GBP. New mini PCs with similar specs start around 200-350 GBP.
Serious Business: Rack Servers
For those who want the full enterprise experience (and are on good terms with their household), rack-mounted servers offer unmatched capability. Dell PowerEdge, HP ProLiant, and Supermicro servers from the previous few generations are available for remarkably little money on the second-hand market.
A Dell PowerEdge R730 with dual Xeon E5 v4 processors, 128GB RAM, and a RAID controller can often be found for 200-400 GBP. The catch is threefold:
- Noise. Enterprise servers have fans designed for data centre environments. They sound like a jet engine warming up. Replacing fans or adjusting IPMI fan curves helps, but these machines will never be silent.
- Power consumption. A fully loaded rack server can draw 300-500 watts at idle. At current electricity prices, that is 50-80 GBP per month just to keep it running. Hence the title of this article.
- Space and weight. A 2U rack server weighs 25-30kg and needs adequate ventilation. Not all homes (or partnerships) can accommodate this.
- AWS Free Tier provides 750 hours per month of t2.micro instances for 12 months, plus always-free services
- Azure offers similar free-tier options with 750 hours of B1S VMs
- Google Cloud provides $300 in credits for new accounts
- Linode/Vultr/Digital Ocean offer low-cost VPS instances suitable for individual tool deployment
- Free. No licence fees, no feature restrictions. The paid subscription adds enterprise repository access and support but is not required.
- Full-featured web UI. VM creation, management, console access, snapshots, backups, and network configuration all from a browser.
- Supports both VMs and LXC containers. Run full virtual machines for Windows and specialised distributions, and lightweight containers for Linux services.
- Enterprise features included. Clustering, high availability, live migration, ZFS storage, software-defined networking -- all available without a paid licence.
- Excellent community. Extensive documentation, active forums, and a wealth of tutorials and guides.
- API access. Full REST API for automation, enabling Infrastructure as Code approaches.
- Metasploitable / DVWA / VulnHub VMs -- deliberately vulnerable systems for practising exploitation
- Active Directory lab -- a Windows Server domain controller with joined workstations for AD attack/defence practice
- pfSense or OPNsense -- firewall VM for practising network segmentation and firewall rule management
- Splunk Free -- limited to 500MB/day ingest but fully functional for learning SPL queries and building dashboards
- Choose your hardware. Start with whatever you have available. A desktop with 16GB RAM and an SSD is sufficient to begin. Upgrade later when you know what you need.
- Install your hypervisor. Proxmox on a dedicated machine, or VMware Workstation / VirtualBox on a shared machine. Get comfortable with creating VMs, managing storage, and configuring virtual networks.
- Set up network isolation. Before deploying any VMs, configure an isolated virtual network. Test isolation by verifying that VMs cannot ping your home network devices.
- Deploy Kali Linux. It is the most immediately useful VM and will serve as your primary tool platform. Install guest tools, take a snapshot.
- Deploy a vulnerable target. Metasploitable 2 or a VulnHub VM gives you something to practise against immediately.
- Add defensive tools. Deploy Wazuh or Security Onion to start learning defensive monitoring. Point them at your lab network.
- Build an Active Directory lab. When ready for more complexity, deploy a Windows Server domain controller with joined workstations. This opens up the entire world of Active Directory attack and defence.
- Document everything. Keep notes on your lab configuration, what you have learned, and what you have built. This documentation becomes portfolio material and future reference.
Cloud: The No-Hardware Option
Cloud platforms offer an alternative for those who cannot or do not want to run local hardware:
Cloud is excellent for specific use cases (CTF participation, temporary tool deployment, portfolio demonstrations) but has limitations: costs accumulate, bandwidth-intensive activities incur charges, and running offensive tools from cloud infrastructure requires careful attention to the provider's acceptable use policy.
A hybrid approach works well: run core infrastructure locally and use cloud for specific temporary requirements.
Hypervisor: The Foundation of Your Lab
The hypervisor is the software that creates and manages virtual machines. The choice of hypervisor shapes the entire lab experience.
Proxmox VE (Recommended)
Proxmox Virtual Environment is a free, open-source Type 1 (bare-metal) hypervisor based on Debian Linux with KVM virtualisation and LXC containers. It is the recommendation here for several reasons:
VMware Workstation Pro
VMware Workstation Pro became free for personal use in late 2024. It is a Type 2 (hosted) hypervisor that runs on top of Windows or Linux. Strengths include excellent hardware compatibility, robust snapshot management, and polished virtual networking. It is a solid choice for those who want to run a lab on the same machine they use for daily work, though Type 2 hypervisors carry inherent performance overhead compared to bare-metal solutions.
VirtualBox
Oracle's VirtualBox is free, open-source, and cross-platform. It is the entry point for many people's lab journey and remains useful for simple setups. However, it has limitations in performance, snapshot management, and advanced networking that become apparent as lab complexity grows. It is adequate for running a few VMs; it is not ideal for running a dozen.
Hyper-V
Built into Windows 10/11 Pro and Enterprise editions, Hyper-V is a Type 1 hypervisor that operates alongside Windows. It offers good performance, integration with Windows management tools, and no additional cost. The downside is limited Linux guest support compared to KVM-based solutions and a less intuitive management interface for complex lab environments.
Essential Virtual Machines: The Starting Lineup
With hardware and hypervisor sorted, the next question is what to actually run. The following VMs form a solid foundation for a cybersecurity lab.
Kali Linux -- The Swiss Army Knife
Kali Linux needs little introduction. It is the de facto standard Linux distribution for penetration testing and security assessment, pre-loaded with hundreds of tools: Nmap, Burp Suite, Metasploit, Wireshark, John the Ripper, Hashcat, and many more.
Resource allocation: 2-4 vCPUs, 4-8GB RAM, 80GB disk.
Tips: Install the QEMU guest agent (or VMware Tools / VirtualBox Guest Additions) for clipboard sharing and dynamic resolution. Take a clean snapshot after initial setup -- you will want it when something inevitably breaks.
Windows Analysis VM
A Windows 10 or 11 VM is essential for malware analysis, Active Directory testing, and understanding Windows security. Microsoft provides free evaluation VMs (90-day licence) for exactly this purpose.
Resource allocation: 2-4 vCPUs, 4-8GB RAM, 60GB disk.
Tips: Install Sysinternals Suite, Wireshark, and common analysis tools. Disable Windows Defender and automatic updates (this is a lab -- you want to see the malware, not have it quarantined). Take a snapshot before each analysis session.
SIFT Workstation -- Digital Forensics
The SANS Investigative Forensic Toolkit (SIFT) is an Ubuntu-based distribution loaded with forensic tools: Autopsy, Volatility, Sleuth Kit, log2timeline/Plaso, and dozens more. It is the standard platform for DFIR work and SANS forensics courses.
Resource allocation: 2-4 vCPUs, 8-16GB RAM (memory forensics with Volatility is RAM-hungry), 120GB disk.
REMnux -- Malware Analysis
REMnux is a Ubuntu-based distribution focused on reverse engineering and malware analysis. It includes tools for static and dynamic analysis: Ghidra, Radare2, YARA, PEframe, oledump, and network analysis tools for capturing and analysing malware communications.
Resource allocation: 2-4 vCPUs, 4-8GB RAM, 60GB disk.
SOF-ELK -- Log Analysis and SIEM
SOF-ELK is a pre-configured Elastic Stack (Elasticsearch, Logstash, Kibana) virtual appliance designed for DFIR and security operations. It ingests various log formats (Sysmon, Windows Event Logs, Apache/Nginx, NetFlow) and provides pre-built dashboards for analysis.
Resource allocation: 2-4 vCPUs, 8-16GB RAM (Elasticsearch is a memory enthusiast), 100GB+ disk.
Security Onion or Wazuh -- Network and Host Monitoring
Security Onion is a Linux distribution for network security monitoring, intrusion detection, and log management. It integrates Suricata, Zeek (formerly Bro), Elasticsearch, and a web interface for analysis. It is particularly useful for learning NSM concepts and practising alert triage.
Wazuh is an open-source security monitoring platform providing host-based intrusion detection, log analysis, file integrity monitoring, and vulnerability detection. It deploys agents on monitored hosts and centralises analysis in a manager/dashboard architecture.
Either (or both) provides hands-on experience with the defensive monitoring tools used in professional SOC environments.
Resource allocation: Security Onion requires 4+ vCPUs, 16GB+ RAM, and 200GB+ disk for even a minimal deployment. Wazuh manager is more modest at 2-4 vCPUs, 4-8GB RAM, 50GB disk.
Additional VMs Worth Considering
Network Isolation: The Most Important Part You Will Be Tempted to Skip
This section is not optional. It is the most important consideration in the entire lab setup, and it is the one most frequently ignored by people who are eager to get to the interesting bits.
A cybersecurity lab, by definition, contains dangerous things: malware samples, exploitation tools, deliberately vulnerable systems, and active attacks. If any of this reaches your home network, you have gone from "learning about security incidents" to "experiencing a security incident."
The Golden Rule
Your lab network should be completely isolated from your home network. VMs in the lab should be able to communicate with each other but should not be able to reach your home devices, your NAS, your smart home equipment, or anything else you care about.
How to Achieve Isolation
Virtual network isolation: Create a dedicated virtual network (host-only or internal network) within your hypervisor. VMs on this network can communicate with each other but have no route to the physical network. This is the simplest and most effective approach for most lab setups.
NAT with firewall rules: If lab VMs need internet access (for updates, tool downloads, or testing), create a NAT network with strict firewall rules that allow outbound internet access but block all traffic to your home LAN subnets. Use a dedicated virtual switch/bridge with its own subnet (e.g., 10.10.10.0/24).
VLAN segmentation: If running on a managed switch, create a dedicated VLAN for lab traffic and ensure no routing exists between the lab VLAN and home VLANs. This requires managed network hardware but provides hardware-level isolation.
Physical isolation: The ultimate approach -- a completely separate physical network for the lab, with its own switch and internet connection (or no internet connection at all). Overkill for most home labs but appropriate for malware analysis work.
Specific Scenarios
Malware analysis: Use a fully isolated network with no internet access. The malware analysis VM and any monitoring tools should be on an internal-only virtual network. If the malware needs to "phone home" to exhibit its full behaviour, use tools like INetSim or FakeDNS to simulate internet services locally.
Penetration testing practice: An isolated network is fine. The attacking machine (Kali) and target machines (Metasploitable, VulnHub VMs) should be on the same isolated subnet with no route to the outside.
Defensive monitoring practice: A NAT network with internet access is acceptable, as the tools need to download signatures, updates, and threat intelligence feeds. Ensure the NAT configuration blocks traffic to your home LAN.
Getting Started: A Practical Sequence
For those ready to begin, here is a suggested sequence that builds capability incrementally:
Conclusion: Start Small, Think Big
The perfect is the enemy of the good, and this is especially true of home labs. The best lab is the one you actually build and use, not the theoretical 42U rack with a 10Gb backbone that you keep planning but never start.
Begin with what you have. A single machine running a hypervisor with Kali and a vulnerable target is enough to start learning. As skills develop, the lab will grow naturally -- another VM here, a monitoring tool there, eventually an Active Directory domain, and before long an electricity bill that prompts awkward questions from housemates.
The investment is worth it. In a field where practical skills matter more than theoretical knowledge, a home lab is the difference between "I have read about this" and "I have done this." The former gets you through an interview question. The latter gets you through an actual incident.
Now go forth and virtualise. Your electricity provider will be delighted.
Tech Corsair -- navigating the digital seas so you don't have to.
