0.4 Build your lab (30 minutes)

You need somewhere you are allowed to attack. That is the whole point of a lab.

Step 1 — Core tools

macOS:

# Homebrew first: https://brew.sh
brew install openssl@3 nmap wireshark jq wget gnupg
brew install --cask docker
# macOS ships LibreSSL as `openssl`. You want real OpenSSL 3.x:
echo 'export PATH="/opt/homebrew/opt/openssl@3/bin:$PATH"' >> ~/.zshrc
exec zsh

Linux (Debian/Ubuntu):

sudo apt update
sudo apt install -y openssl nmap tcpdump wireshark curl jq gnupg \
                    build-essential python3-pip docker.io git
sudo usermod -aG docker $USER   # log out and back in

Windows: use WSL2 with Ubuntu, then follow the Linux instructions.

Step 2 — Verify

openssl version            # want OpenSSL 3.x  (NOT LibreSSL)
nmap --version
docker --version
python3 --version

If openssl version says LibreSSL, stop and fix it. macOS's built-in version lacks features used throughout this guide. The PATH line above fixes it.

Step 3 — A safe target to attack

OWASP Juice Shop — a deliberately vulnerable web application, built for exactly this:

docker run --rm -d -p 3000:3000 --name juice bkimminich/juice-shop
# open http://localhost:3000
# stop it later with:  docker stop juice

This runs on your machine only. You own it. You may attack it freely.

Step 4 — A scratch directory

mkdir -p ~/sec-lab/{ca,keys,certs,scratch} && cd ~/sec-lab
echo "sec-lab" > notes.md

Everything in this guide happens in ~/sec-lab.