The document provides guidelines for establishing a low-cost hacklab covering hardware, software, VMware, VirtualBox, and pentesting tips. It includes recommendations on hardware options, acquiring operating systems and vulnerable applications, as well as specific technical tips for using VMware and VirtualBox effectively. Additionally, it emphasizes staying updated on vulnerabilities and suggests best practices for network design and defense measures.

1. Strategic Security, Inc. © http://www.strategicsec.com/
Building
A Low Cost HackLab
Presented By:
Joe McCray
joe@strategicsec.com
http://www.linkedin.com/in/joemccray
http://twitter.com/j0emccray

2. Strategic Security, Inc. © http://www.strategicsec.com/
Building A Low Cost HackLab
What we will be covering today:
• Hardware Tips
• Software Tips
• VMWare Tips
• VirtualBox Tips
• Pentester Tips

3. Strategic Security, Inc. © http://www.strategicsec.com/
Hardware Tips

4. Strategic Security, Inc. © http://www.strategicsec.com/
Hardware Tips
• Should you use an old machine/old laptop
• Should you build a whitebox for this
• What types of hardware should you buy

5. Strategic Security, Inc. © http://www.strategicsec.com/
Hardware Tips
• Should you use an old machine/old laptop
You can use an old laptop, but if you want to be able to run a few VMs at a time
you’d probably want something more robust.

6. Strategic Security, Inc. © http://www.strategicsec.com/
Hardware Tips
• Should you build a whitebox for this
• What types of hardware should you buy?
Check out a ShuttleBox
• http://www.amazon.com/exec/obidos/ASIN/B004UC4HCG/virtuinsan-20
Here is a good walk-through for building ESXi
• http://www.ryanbirk.com/the-perfect-vmware-vsphere-5-homelab/

7. Strategic Security, Inc. © http://www.strategicsec.com/
Software Tips

8. Strategic Security, Inc. © http://www.strategicsec.com/
Software Tips
• Where do you get all of the operating systems from?
• Where do you get all of the vulnerable applications from?

9. Strategic Security, Inc. © http://www.strategicsec.com/
Software Tips
• Where do you get all of the operating systems from?
• Expensive:
• http://msdn.microsoft.com/en-us/subscriptions/aa718661
• Cheap:
• http://books.half.ebay.com/
• Buy used books on Operating Systems with the CD/DVD still in them

10. Strategic Security, Inc. © http://www.strategicsec.com/
Software Tips
• Where do you get all of the vulnerable applications from
• http://www.oldapps.com/
• Common vulnerable Targets that people use:
• Metasploitable http://sourceforge.net/projects/metasploitable/files/Metasploitable2/
• Web Security Dojo http://sourceforge.net/projects/websecuritydojo/
• OWASP Hackademics http://code.google.com/p/owasp-hackademic-challenges/
• WebMaven https://www.mavensecurity.com/WebMaven/
• Moth http://www.bonsai-sec.com/en/research/moth.php
• DVWA http://www.dvwa.co.uk/
• De-ICE http://hackingdojo.com/pentest-media/

11. Strategic Security, Inc. © http://www.strategicsec.com/
VMWare Tips

12. Strategic Security, Inc. © http://www.strategicsec.com/
VMWware Tips
• Creating linked clones in ESXI
• Deploying Snort or Surricata in ESXI
• vSwitch features that you may want to use in your environment

13. Strategic Security, Inc. © http://www.strategicsec.com/
VMWware Tips
• Creating linked clones in ESXI
• https://github.com/kernelsmith/env-customization/blob/master/esxi/ghetto-esxi-linked-clones.sh
• http://nchrissos.wordpress.com/2013/04/22/cloning-a-vm-without-vcenter-in-esxi-5-1-free-edition/
• http://www.virtuallyghetto.com/2012/09/creating-se-sparse-linked-clones-using.html

14. Strategic Security, Inc. © http://www.strategicsec.com/
VMWware Tips
• Creating linked clones in ESXI
• Deploying Snort or Surricata in ESXI
• vSwitch features that you may want to use in your environment

15. Strategic Security, Inc. © http://www.strategicsec.com/
VMWware Tips
• Creating linked clones in ESXI on the cheap (FREE is good)
• https://communities.vmware.com/docs/DOC-9202?tstart=7450
• Deploying Snort or Surricata in ESXI
• https://isc.sans.edu/diary/Running+Snort+on+VMWare+ESXi/15899
• vSwitch features that you may want to use in your environment
• VLANs

16. Strategic Security, Inc. © http://www.strategicsec.com/
VMWware Tips
• What a vSwitch is and is not
• vSwitch features such as VLAN trunking, link bonding,
frame forwarding
• no STP, limited QoS, no SPAN or RSPAN, no NetFLOW /
sFLOW etc, no filtering, no VACL and so on
• Reference:
• http://etherealmind.com/vmware-vswitch-does-not-scale-design/
• vSwitch features that you may want to use in your environment
• Quick way to create VLANs

17. Strategic Security, Inc. © http://www.strategicsec.com/
VirtualBox Tips

18. Strategic Security, Inc. © http://www.strategicsec.com/
VirtualBox Tips
• Building and running VirtualBox Headless with PHPVirtualbox
• Creating Backups and clones of running VMs in VirtualBox
• Using raw devices to create a Virtualbox VM
• Setting up a serial port between VirtualBox VMs
• Taking screenshots of VirtualBox VMs

19. Strategic Security, Inc. © http://www.strategicsec.com/
VirtualBox Tips
• Building and running VirtualBox Headless with PHPVirtualbox
• http://www.howtoforge.com/vboxheadless-running-virtual-machines-with-virtualbox-4.1-on-a-headless-ubuntu-
12.04-server
• Creating Backups and clones of running VMs in VirtualBox
• http://www.howtoforge.com/virtualbox-creating-backups-and-clones-of-running-virtual-machines-no-downtime-with-lvm-
snapshots

20. Strategic Security, Inc. © http://www.strategicsec.com/
VirtualBox Tips
• Using raw devices to create a Virtualbox VM
• http://www.howtoforge.com/using-raw-devices-in-virtualbox-vms
• Setting up a serial port between VirtualBox VMs
• http://www.howtoforge.com/how-to-set-up-a-serial-port-between-two-virtual-machines-in-virtualbox
• Taking screenshots of VirtualBox VMs
• http://www.howtoforge.com/how-to-take-screenshots-of-virtualbox-vms

21. Strategic Security, Inc. © http://www.strategicsec.com/
Pentester Tips

22. Strategic Security, Inc. © http://www.strategicsec.com/
Pentester Tips
• How to keep up with the latest vulnerabilities and exploits
• Deciding what types of vulnerabilities to put in the network
• Deciding how to design the network
• Deciding what defensive measures to put into the network

23. Strategic Security, Inc. © http://www.strategicsec.com/
Keeping Up With Vulns
• How to keep up with the latest vulnerabilities and exploits
• Download the latest exploits and tools each week
• Exploits
• http://www.exploit-db.com/
• http://packetstormsecurity.com/files/tags/exploit/
• Tools
• http://packetstormsecurity.com/files/tags/tool/
• http://www.securitytube-tools.net/
• http://sectools.org/

24. Strategic Security, Inc. © http://www.strategicsec.com/
Pentester Tips
Deciding what types of vulnerabilities to put in the network
• Focus on apps that you’ve heard of (popular apps)
• Adobe
• Apple
• Microsoft
• Oracle
• Try not to use software that isn’t often found in a corporate environment
• Know that a lot of the exploits on exploit-db and similar sites are people
learning exploit dev
Not all exploits in the frameworks are good
• Metasploit, Core Impact, Saint, Canvas all scrape exploit-db and
automatically port the exploits into the respective frameworks

25. Strategic Security, Inc. © http://www.strategicsec.com/
Pentester Tips
• Deciding how to design the network

26. Strategic Security, Inc. © http://www.strategicsec.com/
Pentester Tips
• Try for a simple flat architecture first
• Wait a minute on the DMZs, routers, and switches
• Most Cisco vulns are old
• Most firewall vulns are even older
• Focus on client-side apps and web apps

27. Strategic Security, Inc. © http://www.strategicsec.com/
Pentester Tips
• Deciding what defensive measures to put into the network
• I’d recommend Security Onion
• References:
• http://eatingsecurity.blogspot.com/2013/04/new-home-lab-configuration.html
• http://eatingsecurity.blogspot.com/2013/04/home-lab-part-2-vmware-esxi-security.html
• http://code.google.com/p/security-onion/wiki/Installation
• Be sure to set Promiscuous Mode to Accept (REALLY IMPORTANT):
• https://isc.sans.edu/diary/Running+Snort+on+VMWare+ESXi/15899

28. Strategic Security, Inc. © http://www.strategicsec.com/
Pentester Tips
• How do you build infrastructure stuff (routers/firewalls)?
• Pfsense
• https://doc.pfsense.org/index.php/PfSense_2_on_VMware_ESXi_5
• Vyatta
• http://www.vyatta.org/node/5958
• GNS3
• http://blog.davidvassallo.me/2010/11/18/creating-a-virtual-cisco-router-
vmware-esx-gns3-linux/

29. Strategic Security, Inc. © http://www.strategicsec.com/
Pentester Tips
• What are some good pentester lab resources
• How to set up a penetration testing lab
• http://information.rapid7.com/how-to-setup-a-pen-testing-lab.html?LS=615710
• How to setup a pentest lab and how to play CTF
• http://www.slideshare.net/null0x00/how-to-setup-a-pen-test-lab-and-how-to-play-ctf

30. Strategic Security, Inc. © http://www.strategicsec.com/
Questions??????

31. Strategic Security, Inc. © http://www.strategicsec.com/
Contact Me....
Toll Free: 1-844-458-1008
Email: joe@strategicsec.com
Twitter: http://twitter.com/j0emccray
LinkedIn: http://www.linkedin.com/in/joemccray