<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: building-security-testing-lab
description: >-
  Design and build isolated security testing lab environments using
  virtualization, containerization, and network segmentation for safe
  vulnerability research, exploit development, and tool evaluation.
domain: cybersecurity
subdomain: security-testing
tags:
  - lab-environment
  - virtualization
  - network-segmentation
  - vulnerable-targets
  - tool-evaluation
  - sandboxing
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1583", "T1588"]
  tools: ["python3", "vagrant", "docker", "proxmox", "pfsense", "terraform"]
---

# Building Security Testing Lab

## Overview

A security testing lab provides a safe, isolated environment for vulnerability
research, exploit development, malware analysis, and security tool evaluation.
Proper lab design prevents accidental impact on production systems while
providing realistic target environments.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Hypervisor (Proxmox/VMware) | Virtual machine management |
| Sufficient hardware | CPU, RAM, storage for multiple VMs |
| Network isolation capability | Prevent lab traffic from reaching production |
| Vulnerable target images | DVWA, Metasploitable, HackTheBox |

## Key Concepts

- **Network isolation**: Air-gapped or heavily firewalled lab segments
- **Snapshot management**: Restore targets to known-good state quickly
- **Infrastructure as code**: Reproducible lab builds via Terraform/Vagrant
- **Target diversity**: Mix of OS, services, and vulnerability types
- **Evidence preservation**: Capture and log all lab activity

## Workflow

### Step 1: Design Lab Architecture

```python
LAB_ARCHITECTURE = {
    "networks": {
        "attacker": {"subnet": "10.10.10.0/24", "vlan": 100},
        "targets": {"subnet": "10.10.20.0/24", "vlan": 200},
        "management": {"subnet": "10.10.30.0/24", "vlan": 300},
        "monitoring": {"subnet": "10.10.40.0/24", "vlan": 400},
    },
    "firewall_rules": [
        {"src": "attacker", "dst": "targets", "action": "allow"},
        {"src": "targets", "dst": "attacker", "action": "allow"},
        {"src": "any", "dst": "internet", "action": "deny"},
        {"src": "management", "dst": "any", "action": "allow"},
    ],
}
```

### Step 2: Deploy Target Environments

```bash
# Vagrant multi-machine lab
cat > Vagrantfile << 'EOF'
Vagrant.configure("2") do |config|
  config.vm.define "kali" do |kali|
    kali.vm.box = "kalilinux/rolling"
    kali.vm.network "private_network", ip: "10.10.10.10"
    kali.vm.provider "virtualbox" do |v|
      v.memory = 4096
      v.cpus = 2
    end
  end

  config.vm.define "metasploitable" do |target|
    target.vm.box = "rapid7/metasploitable3-ub1404"
    target.vm.network "private_network", ip: "10.10.20.10"
  end

  config.vm.define "dvwa" do |dvwa|
    dvwa.vm.box = "ubuntu/focal64"
    dvwa.vm.network "private_network", ip: "10.10.20.20"
    dvwa.vm.provision "docker" do |d|
      d.run "vulnerables/web-dvwa", args: "-p 80:80"
    end
  end
end
EOF
vagrant up
```

### Step 3: Configure Monitoring

```bash
# Deploy Security Onion or Zeek for network monitoring
docker run -d --name zeek --network lab_targets \
  -v /opt/lab/pcaps:/pcaps zeek/zeek

# ELK stack for log aggregation
docker compose -f elk-stack.yml up -d
```

### Step 4: Validate Lab Isolation

```bash
node agent.js build --config lab_config.json --provider vagrant
node agent.js verify --check-isolation --check-targets
node agent.js snapshot --action create --name baseline
```

## Detection

```yaml
title: Security Testing Lab Detection
id: b834767f-2909-4682-a004-a12e50bfdcbb
status: experimental
description: Detects suspicious activity related to building security testing lab techniques in security testing context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*building*security*"
  condition: selection
level: medium
tags:
  - attack.t1583
  - attack.t1588
  - attack.discovery
falsepositives:
  - Authorized security testing tools during scheduled assessment windows
```

## Verification

| Check | Method |
|---|---|
| Network isolation verified | No traffic reaches production |
| All targets accessible | Attacker can reach target subnet |
| Snapshots working | Restore to baseline completes |
| Monitoring active | Network capture and log collection running |

## References

- [Building Virtual Security Labs — SANS](https://www.sans.org/)
- [Proxmox VE Documentation](https://pve.proxmox.com/wiki/Main_Page)
- [Vagrant Documentation](https://www.vagrantup.com/docs)
