~/lab
The environment behind the CTF and penetration testing practice: an authorized home lab for offensive-security learning, plus the tooling that keeps it safe and documented.
Environment
This is a personal, authorized lab for offensive-security learning: Capture the Flag practice, penetration testing in environments I own or have explicit permission to test, GPU-assisted password-cracking exercises, and the note-taking that ties it together. Nothing here targets systems I do not control.
The write-up below is deliberately general. It describes the roles of each piece, not the specifics an attacker would want: no credentials, endpoints, private addresses, keys, or exact topology appear on this page or anywhere in the repo.
Inventory
The main workstation is a Windows 11 desktop built for local virtualization: an AMD Ryzen 7 9800X3D, 32 GB of RAM, an NVIDIA GeForce RTX 5070 (12 GB), and roughly 1.82 TB of SSD storage.
It runs the virtual machines used for Capture the Flag challenges and authorized penetration testing practice, and the GPU handles Hashcat password-cracking exercises against lab-generated hashes. Everything stays inside disposable VMs so the host stays clean.
A Claude Code and Claude Haiku workflow turns pasted study material for the Certified Penetration Testing Specialist (CPTS) into structured, Obsidian-ready notes: checklists, review artifacts, and organized references.
Everything is reviewed by hand for accuracy before it goes into the vault, and sensitive or copyrighted course material is kept out of any public or unsafe context. It is a study aid, not a substitute for the source material or hands-on practice.
A GL.iNet GL-SFT1200 (Opal) travel router is configured as a VPN gateway so multiple devices get a more consistent, safer default route on public Wi-Fi. Instead of trusting a coffee-shop network directly, devices connect to the travel router, which carries traffic over the tunnel.
This is a practical defensive-networking exercise covering DNS, VPN gateways, basic network segmentation, and router hardening. It reduces exposure on untrusted networks; it does not make public Wi-Fi perfectly safe, and it is not treated as if it does.
Tailscale links the Linux lab machines so they can be reached from the workstation and portable device without exposing services to the public internet. It keeps lab access private and avoids port-forwarding on any home router.
Parsec provides low-latency remote access to the Windows workstation from the portable Surface Pro 9, which is used mostly for notes, writing, and remote sessions rather than heavy local compute.
Parsec is intentionally kept off the VPN tunnel: routing its low-latency stream through the travel VPN would add latency and instability without a matching security benefit for this use case.
Lab work, CTF notes, and study material are captured in a structured Obsidian vault. Writing things down is part of the practice: it turns one-off solves into repeatable methodology and makes the CTF writeups on this site possible.
Boundaries
Related: the individual builds are documented as projects, running notes land in lab notes, and competition writeups are under CTF writeups.