The setup
Six virtual machines on an internal-only network with no route to the internet. A Kali box sits on both that lab network and my home network, so it's the only way in and out, exactly like a real jump box in an engagement.
Targets range from a decade-old Metasploitable to a Windows 11 domain machine, so I can practice everything from legacy service exploits to Active Directory attacks.
Snort 3 IDS
Detection, not just attack
A Snort sensor watches the whole subnet. I run an attack, then read the alerts it fired, then tune the rules and try to slip past them. Learning to evade detection and to catch evasion at the same time is the point.
Attack
Nmap, Metasploit, and manual exploitation from Kali
Detect
Snort 3 rules catch scans, then get tuned against stealthier ones
Document
Every exercise gets a writeup with evidence and lessons
The hard-won bits
I built Metasploitable 3 from source with Packer inside the Kali VM using nested virtualization, then traced a TLS failure through three Chef cookbooks because a 2014 Ubuntu can't talk to a modern package repo anymore.
Old targets have old rules: one needed legacy IDE disks because its kernel predates VirtIO, another needed legacy BIOS instead of UEFI. Both are documented so nobody has to rediscover them.
