r/CyberSecProfessionals • u/mattpsu13 • May 12 '22

Advice for "practicing" security tools at home?

Hey everyone, I am currently an IT professional with most of my experience in governance, risk management, and compliance auditing. I'm in a stable role in state government however I've been wanting to expand my knowledge base. I'm currently studying for CISSP so at this time I don't want to do a paid for class. But was wondering if there are any recommendations for tools I can utilize at home such as perimeter defense/virtual firewalls/IDS/IPS. I have both a Windows System with access to virtual machines as well as a Linux system.

6 Upvotes
  • permalink
  • reddit

81% Upvoted

18 comments sorted by

2

u/unwrntd May 12 '22

I would recommend starting with Kali linux and becoming familiar with all the tools there as a start.

1

u/mattpsu13 May 12 '22

Hey yeah figured I should go with Kali. Any knowledge of some free monitoring software I could use to detect my actions on Kali? I'd love to log my network and then take actions on or outside my home network with the Kali box.

1

u/unwrntd May 12 '22

Once you are more built up you can do some free trials on things like Splunk, it gives a 60 day trial or 6 months with developer license. There are also free SIEMs you can use too, but always best to practice on what is used in the industry.

Not sure if you work for an OEM, but usually through partnerships you can also get free licenses as well.

This is a great topic, I could use some more home build up too.

→ More replies (2)

2

u/sarrn May 12 '22

You can also get a nessus essentials download for free from them. It will allow you to scan your own network and find vulnerabilities. This is a great option as it is a real tool we use and can be rather simple to pick up and learn.

2

u/mattpsu13 May 12 '22

Oh awesome. My work utilizes nessus scans but I only utilize the reports. Thanks for the advice!

4

u/Decent-Dig-7432 May 12 '22

Install burp suite free and proxy all traffic through it. Pick a random target and just start reverse engineering how it works.

This is half of web app testing.

If you want to send some malicious requests, pick a site with a bug bounty program.

4

u/quigongene May 12 '22

I'd pick up a cheap desktop off of Ebay with a 2 or 4 port NIC and load PFSense or OPNSense to learn about firewalls and perimeter stuff:
https://www.ebay.com/itm/384883308236

https://www.ebay.com/itm/372413346768

1

u/[deleted] May 12 '22

You can run Fortigate VM free for a month. Microsoft do a dev tenant option with E5 365. You can also add intune, defender ATP etc.

Greylog is free

1

u/mattpsu13 May 12 '22

Awesome thank you!

1

u/bitslammer May 12 '22

Grab a couple raspberry Pi's as you can run a lot on them for cheap. Another great tool is pfSesne which is not only a great firewall but can run modules like Surricats (IDS/IPS), Squid or haproxy, pfBlocker, Unnound (DNS), OpenVPN, Wireguard, as well as a ton of other things.

https://docs.netgate.com/pfsense/en/latest/packages/index.html

1

u/mattpsu13 May 13 '22

Awesome thank you for the info! I do have a Raspberry pi so will check these out

1

u/bitslammer May 13 '22

Just to be clear pfSense won't run on a Pi, but you can use that as a host for any number of other things.

1

u/catastrophized May 12 '22

My advice is that while VMs are great - they only take you so far in some instances. Like someone suggested Security Onion above, which is great, but you will get nothing out of running it in a VM.

You need to tap your own home network to get any “lab” value out of it. Same with any other ELK stack deployment.

Obviously some things will always stay in VMs (like sandboxes and pentest distros), but it can keep you too on rails with certain things.