Free · no account · no download
Every hands-on lab in the SCOR 350-701 trainer, printed out in the open — with the first command you actually type. Eleven tools, all free, half of them already on your machine.
openssl · yara · suricata · zeek · nftables · strongswan · freeradius · hostapd · bpftrace · trivy · checkov · splunk free · docker · python
Create a root CA, sign a server certificate, inspect the chain, then watch TLS 1.3 negotiate against a public site and identify the AEAD cipher and key-exchange group.
mkdir -p ~/pki-lab && cd ~/pki-labRead a CVSS vector string, reproduce a base score in the FIRST calculator, then rank three findings using KEV membership and exposure rather than score alone.
open https://www.first.org/cvss/calculator/3.1Take one business flow (contractor to internal app), identify every PDP/PEP pair, and prove where implicit trust still exists.
Stand up a local mock security API, then write a script that authenticates, paginates, handles 401 and 429, and refuses to hardcode secrets.
pip install flask requestsCreate two isolated network namespaces, run StrongSwan on each, bring up an IKEv2 tunnel with certificates or PSK, and prove traffic is encrypted with ESP.
ip netns add siteA && ip netns add siteBBuild a three-zone segmentation policy with nftables in namespaces: default deny, explicit permits, logging, and a verified block.
ip netns add users && ip netns add srv && ip netns add routerInstall Suricata, write a custom rule, run it against a public sample capture, and read the fast.log alert to confirm the match.
curl -LO https://wiki.wireshark.org/uploads/__moin_import__/attachments/SampleCaptures/http.capConfigure port security, DHCP snooping, Dynamic ARP Inspection and BPDU Guard on an access switch, then attack your own lab and watch each counter fire.
ip dhcp snoopingStand up FreeRADIUS, add a test user, authenticate with radtest, then send a CoA disconnect and watch the session drop.
docker run -d --name radius -p 1812:1812/udp -p 1813:1813/udp freeradius/freeradius-server:latestReserve a free Secure Firewall environment, configure a site-to-site IKEv2 tunnel to a second FTD, and diagnose a deliberately broken phase 2.
show crypto ikev2 saRun Splunk Free, ingest sample firewall syslog, build an SPL search that answers a real question, and save it as an alert.
docker run -d --name splunk -p 8000:8000 -p 8088:8088 -e SPLUNK_START_ARGS=--accept-license -e SPLUNK_PASSWORD=LabPass123 splunk/splunk:latestFor IaaS, PaaS and SaaS, write down who owns patching, identity, data, logging and network controls — then find the three items people most often get wrong.
Write deliberately insecure Terraform, scan it with Checkov, read the finding, fix it, and prove the scan passes in CI.
resource "aws_s3_bucket" "bad" {Trace process execution inside a container from the host using eBPF, then identify a suspicious exec that a file-based agent would miss.
docker run -d --name ebpf-lab alpine sleep 3600Run secret scanning, dependency scanning, IaC scanning and container scanning against one repository, then wire them into a single make target.
gitleaks detect --source . --redact -vGiven four user groups and six applications, decide which traffic goes through internet access, private access, or neither — and write the policy in a table you could hand to an engineer.
Publish an internal web app through an authenticating reverse proxy with no inbound exposure on the app, then prove an unauthenticated request is refused.
docker network create ztRun Microsoft Presidio against sample text, tune it to catch customer records and API keys, and measure false positives — the actual work of a DLP rule.
python3 -c "from presidio_analyzer import AnalyzerEngine; print('ok')"Write a rule that detects the EICAR test string, verify it fires, then harden it against trivial modification.
printf 'X5O!P%%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > eicar.txtRun one Atomic Red Team test on a lab Windows VM, capture it with Sysmon, then write a Sigma rule that would have alerted.
sysmon64.exe -accepteula -i sysmonconfig-export.xmlQuery real SPF, DKIM and DMARC records, then send a test message through a local SMTP server and read the Authentication-Results header.
dig +short TXT example.comAnalyse a public malware-traffic capture, extract the infected host, the payload URL and the C2 channel, and write a one-page incident note.
zeek -r capture.pcapStand up a WPA2-Enterprise access point against FreeRADIUS, watch the EAP exchange, then fail authentication deliberately and read the reason.
client ap { ipaddr = 127.0.0.1Generate encoded DNS queries against a local resolver, then write a Zeek script that flags long high-entropy labels and verify it fires only on the tunnel.
dnsmasq --no-daemon --log-queries --address=/lab.test/127.0.0.1Generate and validate time-based one-time passwords, then test clock drift, replay and rate limiting — the three ways MFA implementations fail.
python3 -c "import pyotp; s=pyotp.random_base32(); print(s, pyotp.totp.TOTP(s).provisioning_uri('lab@example.com', issuer_name='Echelon'))"Load a public SOC dataset, form a hypothesis, and answer it with SPL — then map your finding to an ATT&CK technique.
git clone https://github.com/splunk/botsv3.gitI mapped these 26 labs and 40 modules onto a six-week schedule. It's free — I'll email it, along with an occasional new lab. One click to leave.
No card. No spam. No sequence of nine emails pretending to be a person.