Knowledge base / Labs
Safe, isolated exercises that turn security concepts into repeatable skills without targeting systems you do not own.
Turn a Raspberry Pi 5 into a practical Mini SOC with Wazuh. Monitor up to 25 Windows, Linux and macOS endpoints, detect vulnerabilities, watch file changes and centralize security alerts without buying an enterprise SIEM.
A practical cross-platform guide to choosing and deploying VPNs on MikroTik RouterOS 7, with working site-to-site and road-warrior configurations.
Clone Windows 11 safely with Rescuezilla, Clonezilla or Hasleo, prepare a bootable USB, size EFI and recovery partitions correctly, and recover a clone that will not boot.
A practical perimeter check you can run today: find the correct public address, scan it from a genuinely external network, understand every result, fix exposure, and prove the change.
Create a small virtual environment with clear trust boundaries, snapshots, controlled internet access, and a written reset plan.
Capture a small, authorised traffic sample and turn DNS, TCP, TLS, and timing into a defensible explanation.
Deploy a single-node learning environment, add one endpoint, verify log flow, and document the first useful alert.
Generate bounded failed logins against lab identities and build a detection that groups attempts by source, target count, and time.
Use a synthetic message to inspect headers, authentication results, URLs, and attachment metadata without contacting attacker infrastructure.
Turn a specific behaviour and log source into a portable rule with metadata, test cases, and known false positives.
Create a narrow file-identification rule from synthetic samples, then test for false positives and brittle strings.
Scan a tiny lab subnet, compare discovered services with the expected inventory, and document ownership before assessing risk.
Collect a small, documented set of endpoint artefacts from a disposable Windows VM and preserve provenance for review.
Measure recovery point, recovery time, dependencies, and data integrity by restoring a synthetic service into an isolated environment.