t0r3-security-lab

Personal security lab setup — scripts, tooling, and documentation for building and operating a home pentest environment. Everything is designed around one principle: tools do the work, AI interprets the output.

Built and maintained by T()R3. Documentation on this repo is in English; Swedish deep-dives on cybertore.se.

Windows 11 host with VMware Workstation 17. Two virtual networks: NAT (internet + Ollama access) and host-only (isolated lab targets). Kali VM is dual-homed and acts as the operator's foothold. Targets — Metasploitable and a full GOAD-Light Active Directory environment — live on the isolated network. Ollama runs natively on the host with an RTX 5080, serving qwen2.5:14b at ~76 tokens/s. Scripts on Kali reach the model at http://192.168.127.1:11434 for output summarization.

Detailed architecture: docs/lab-architecture.md

Tools know — AI interprets. Every script runs actual security tools (nmap, nxc, nuclei, Metasploit) and captures their raw output. The AI layer only summarizes what the tools found. Decisions about exploitability are rule-based (deterministic lookups), never AI-generated. This was learned the hard way with autonomous agent experiments — models hallucinate vulnerabilities but summarize deterministic output faithfully.

Print, run yourself. Guided-mode exploitation: scripts show you the commands to run in your own terminal. No "confirm and auto-execute." You learn the tools, see raw output, and make active choices. Matches CEH pedagogy — understanding the phases, not building an attack machine.

Reference, not automation. Persistence and anti-forensics are pure reference documents. Automatically dropping backdoors and clearing logs builds habits you don't want, even in a lab.

Scope guard always on. Scripts refuse to run against IPs outside ALLOWED_NETS. A guard against fingerslip that would have saved earlier autonomous-agent experiments.

Everything is designed to run on Kali (reaches host-Ollama via VMware NAT).

git clone https://github.com/Tore-82/t0r3-security-lab.git
cd t0r3-security-lab

# Install common dependencies
sudo apt install -y nmap nikto gobuster ldap-utils dnsutils fping jq curl whois
pipx install netexec

# Verify Ollama access from Kali (adjust IP if your host-only differs)
curl -s http://192.168.127.1:11434/api/tags | jq '.models[].name'

Then jump into whichever component interests you:

• Quick one-shot scan: scripts/scan-and-summarize.sh <ip>
• Structured recon: recon-toolkit/README.md
• Full engagement: pentest-framework/README.md

• Lab architecture — network topology, host setup, AI layer
• GOAD-Light on Windows + VMware, provisioned from Kali — every pitfall documented
• Memory forensics exercise — the defensive counterpart

• Host: Windows or Linux with a hypervisor supporting host-only networks
• VMs: at minimum a Kali VM with two NICs (NAT + host-only)
• AI (optional but recommended): Ollama or compatible endpoint serving a chat model — scripts default to qwen2.5:14b at 192.168.127.1:11434 but respect OLLAMA_URL and OLLAMA_MODEL env variables
• Targets: at least one intentionally vulnerable machine on the isolated network (Metasploitable 2 works out of the box; GOAD-Light for AD)

Everything in this repository is designed and tested only against own, isolated lab targets. Never point these tools at production systems, other people's infrastructure, or anything you don't have explicit written authorization to test. The scope-guard function in scripts is a safety net, not an excuse to relax your judgment.

The persistence and anti-forensics phases are educational references — read them to understand what attackers do and why detection tools look for what they look for. Practicing these techniques in your own lab is part of learning; running them anywhere else is not okay.

MIT — see LICENSE. Use it, fork it, learn from it, improve it.

• Website: cybertore.se (Swedish security content)
• Handle: T()R3

Issues and PRs welcome. If you're running the same lab setup and finding issues, especially around GOAD on Windows, please open an issue — the setup docs came from painful trial and error and I'd rather more people benefit from the fixes.