VirtualBox
Cybersecurity Lab

Lab Setup

Three VMs communicate over a host-only network adapter (192.168.56.0/24) — isolated from the host machine's internet connection. A NAT adapter on Kali gives controlled internet access for tool updates only.

  HOST MACHINE (Windows 11)
  └── VirtualBox
       │
       ├── [Kali Linux]──────────────────────────────────────────┐
       │    192.168.56.101                                        │
       │                          HOST-ONLY NETWORK              │
       ├── [Ubuntu Server]   ◄──  192.168.56.0/24  ──►          │
       │    192.168.56.102                                        │
       │                                                          │
       └── [Windows 10]──────────────────────────────────────────┘
            192.168.56.103

  Tools on Kali: nmap, metasploit, hydra, nikto, wireshark, burpsuite
  Tools on Ubuntu: apache2, ssh, fail2ban, auditd, wazuh-agent
  Tools on Windows: Sysmon, winlogbeat, Wireshark

Build Process

1. 1
   Installed VirtualBox 7.0 on host. Created host-only network adapter at 192.168.56.0/24 with DHCP disabled — static IPs assigned per VM for predictable addressing.
2. 2
   Installed Kali Linux from ISO. Updated repos, installed full toolset (kali-linux-everything). Configured SSH keys for passwordless access to Ubuntu target.
3. 3
   Built Ubuntu Server target: installed Apache2, OpenSSH, MySQL, and a deliberately vulnerable web app (DVWA) for exploitation practice. Enabled auditd and configured logging to /var/log/audit.
4. 4
   Set up Windows 10 endpoint with Sysmon (SwiftOnSecurity config) for rich event logging. Installed Winlogbeat to ship logs to Ubuntu Wazuh instance.
5. 5
   Deployed Wazuh on Ubuntu as SIEM — agent on all three VMs, manager on Ubuntu. Custom rules for SSH brute-force, privilege escalation, and web attacks.

What I Practised

Sample Commands

# Kali — initial host discovery
┌──(kali@kali)-[~]
└─$ nmap -sn 192.168.56.0/24
Starting Nmap 7.94 ( https://nmap.org )
Host: 192.168.56.102 () Status: Up
Host: 192.168.56.103 () Status: Up
Nmap done: 256 IP addresses, 2 hosts up

# Service version scan on Ubuntu target
└─$ nmap -sV -sC -p- 192.168.56.102
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu
80/tcp open  http    Apache httpd 2.4.52
3306/tcp open mysql  MySQL 8.0.35

# Brute-force SSH to trigger Wazuh alert
└─$ hydra -l testuser -P /usr/share/wordlists/rockyou.txt ssh://192.168.56.102

# Ubuntu — check Wazuh alerts after attack
sagar@ubuntu:~$ sudo tail -f /var/ossec/logs/alerts/alerts.json | python3 -m json.tool
{
  "rule": {
    "id": "5710",
    "description": "Multiple SSH login failures.",
    "level": 10,
    "mitre": {"id": ["T1110"]}
  },
  "agent": {"name": "kali"},
  "srcip": "192.168.56.101"
}

Skills Gained

This homelab is the foundation for all other projects — a safe sandbox to try anything. Key takeaways:

• ✓
  Hands-on understanding of how attackers enumerate and exploit services — directly applied when analysing detection logs
• ✓
  Practical Wazuh SIEM deployment — agent installation, rule writing, alert correlation
• ✓
  CIS Benchmark hardening — measurably reduced attack surface between iterations
• ✓
  Log analysis in raw format (JSON, syslog, Apache) — no SIEM training wheels
• ✓
  MITRE ATT&CK mapping for detected techniques — builds the language used in real SOC reports