Lab Setup Guide

A single comprehensive lab build supporting every AYSEC track.

AYSEC Lab Setup Guide

A single comprehensive lab build supporting every AYSEC track. Follow this once and you'll have what each module needs.

---

Hardware Recommendations

Component	Minimum	Recommended	Comfortable
CPU	4 cores	8 cores	12+ cores
RAM	16 GB	32 GB	64 GB
Disk	200 GB SSD	500 GB NVMe	1 TB NVMe
OS	any modern host	Linux preferred	Linux + spare disk for VMs

Cloud alternative: if local resources are limited, use a single AWS / Hetzner / Linode VPS with nested virtualization, or rely on TryHackMe / HackTheBox cloud lab subscriptions.

---

Hypervisor

Pick one:

• VirtualBox — free, cross-platform, simplest.
• VMware Workstation Player — free, slightly faster on Linux/Windows.
• VMware Fusion — free for personal on macOS.
• KVM/libvirt — free, native on Linux, what GOAD/Ludus use.
• Proxmox VE — for a dedicated home-lab box.

For this guide we'll use VirtualBox (most portable).

---

Network Topology

Create three host-only networks:

aysec-attacker     192.168.50.0/24    (Kali, REMnux, FlareVM)
aysec-victims      192.168.60.0/24    (vulnerable VMs)
aysec-internal     192.168.70.0/24    (AD lab — DC, member servers, workstations)

Optionally connect them through a pfSense VM acting as router/firewall.

---

VMs to Build

1. Kali Linux 2026.x

• Download: https://www.kali.org/get-kali/
• 4 GB RAM, 80 GB disk, 4 vCPU.
• Network: aysec-attacker.
• After install:

sudo apt update && sudo apt full-upgrade -y
sudo apt install -y kali-linux-large
pipx install netexec impacket arjun bloodhound-py trufflehog

2. Metasploitable 2

• Download: https://sourceforge.net/projects/metasploitable/
• 1 GB RAM, 8 GB disk.
• Network: aysec-victims.
• Used in AYSEC-101 modules 03–04.

3. Windows Server 2022 Evaluation (Domain Controller)

• Download: https://www.microsoft.com/en-us/evalcenter
• 4 GB RAM, 60 GB disk, 2 vCPU.
• Network: aysec-internal.
• Promote to DC; create domain corp.aysec.local.

4. Windows 10 / 11 Enterprise Evaluation (workstation)

• 4 GB RAM, 60 GB disk.
• Network: aysec-internal.
• Join domain.

5. Ubuntu Server 22.04 (Wazuh + Splunk Free)

• 4 GB RAM, 80 GB disk.
• Network: aysec-attacker (so you can also reach it from Kali).
• Used in AYSEC-102 + AYSEC-103.

6. REMnux

• Download: https://remnux.org/
• 4 GB RAM, 60 GB disk.
• Network: isolated (no internet by default).
• Used in AYSEC-103 modules 7–8 + AYSEC-102 module 10.

7. Vulnserver Host (Windows 10)

• For AYSEC-101 module 08 (buffer overflows).
• 2 GB RAM, 30 GB disk.

8. GOAD (Game of Active Directory)

• Project: https://github.com/Orange-Cyberdefense/GOAD
• Multiple AD VMs auto-deployed by Vagrant + Ansible.
• 32 GB RAM minimum recommended on host.
• Used in AYSEC-101 modules 11–12 and AYSEC-103 module 10.

9. DVWA, Juice Shop, crAPI

• Containerized. Run on Kali or a separate Docker host.
• Used across AYSEC-106 modules.

---

Snapshots

Take a clean snapshot of every VM immediately after first boot. Revert constantly. You will break things weekly.

Naming convention:

<vm-name>__clean
<vm-name>__post-tools
<vm-name>__module-XX-checkpoint

---

Cloud Sandboxes

For AYSEC-105:

• AWS Free Tier — 12 months free, then pay-as-you-go.
• Azure Free — $200 credit + always-free services.
• Google Cloud Free Trial — $300 credit.

Always:

• MFA on root.
• Lock root credentials.
• Set budget alerts.
• Use a dedicated email per cloud account.

---

Note-Taking Stack

~/aysec/
├── 00-course-notes/       (per module)
├── 01-engagements/        (per project / lab / engagement)
├── 02-cheatsheets/
├── 03-research/
└── 99-archive/

Tools:

• Obsidian — free, local, markdown.
• CherryTree — Linux-friendly hierarchy.
• Notion — cloud, friendlier.

Backup: weekly to a separate disk + a private GitHub repo.

---

Browser Setup

For testing:

• A separate Firefox profile ("aysec-test") configured to proxy through Burp.
• Burp CA certificate installed.
• No personal logins.

---

Maintenance Cadence

• Daily — snapshots before risky operations.
• Weekly — apt update && apt upgrade on Kali; commit notes to git.
• Monthly — VirtualBox / VMware updates; refresh extension packs.
• Quarterly — review snapshot count; delete obsolete VMs.

---

Common Pitfalls

• Too few snapshots. Take more.
• Bridged adapters by default. Use host-only first; bridge only when needed.
• Time skew on AD lab. Sync the DC to a reliable NTP source.
• Disk space. Linked clones save disk; thin-provisioned disks fragment over time.
• Notes in vendor-locked apps. Keep markdown so you can leave any tool.