Last semester, I had the opportunity to participate in two cybersecurity competitions. The first was a Capture-the-Flag competition hosted by the National Cyber League (NCL), which explored a range of security concepts including web vulnerabilities, OSINT, enumeration, and other areas of offensive and defensive security. The second was a social engineering competition focused primarily on OSINT, as well as the use of large language models (LLMs) and text-to-speech (TTS) systems to simulate vishing scenarios.
I thoroughly enjoyed both experiences and look forward to participating again this semester. However, I also want to explore these cybersecurity concepts more deeply outside of competition environments. In particular, I am interested in building controlled lab environments, finding effective ways to demonstrate security concepts, and studying how vulnerable systems can be protected using firewalls and other defensive controls.
To begin exploring these ideas, I am developing an intentionally vulnerable web application that can be hosted within an isolated lab environment. My current design consists of a Raspberry Pi hosting the vulnerable application, a Kali Linux virtual machine acting as the attacker, and a separate virtual machine running a firewall between the attacker and the target system.
The basic architecture looks something like this:
Kali Linux VM
|
| Attack traffic
v
Firewall VM
|
| Filtered traffic
v
Raspberry Pi
|
+-- Intentionally vulnerable web application
The goal is not simply to exploit the application, but to observe how different defensive controls affect those attacks. By establishing a vulnerable baseline first, I can test which attacks are stopped by network-level firewall rules, which attacks pass through because they appear to be legitimate HTTP traffic, and where additional application-layer defenses such as a Web Application Firewall (WAF) become necessary.