Build cybersecurity projects in an isolated home lab you own: analyse packets, scan your own VMs, test OWASP Juice Shop, run a Wazuh SIEM with Atomic Red Team tests, write a log detector and report findings with evidence and fixes. Never test systems without written permission.
Only test systems you own or have written permission to test. Unauthorised access can be an offence under India's Information Technology Act, 2000 (see sections 43 and 66). Run every attack tool in the isolated lab described here, never against other people's networks or websites.
A strong beginner portfolio shows both sides: how attacks work and how defenders see them.
The 9 projects
Network traffic analysis with Wireshark
The question: What does normal DNS, HTTP and TLS traffic look like, and how do you spot something odd?
- Start with
- Capture your own traffic. For practice with real incident captures, use public exercise files on Malware-Traffic-Analysis.net and open them only inside an isolated VM.
- Steps
- Capture a page load and filter DNS, HTTP and TLS handshakes.
- Annotate each stage of the TCP handshake.
- Open an exercise capture and identify the victim host and suspicious domains.
- Write the findings as a short incident summary.
- Measure
- Each claim cites a packet number or filter you used.
- Ship
- Annotated screenshots and a one-page summary.
- Why it counts
- Packet reading underpins nearly every security role.
Analysed packet captures in Wireshark to reconstruct [event]; documented indicators and the filters used.
Scan your own lab with Nmap
The question: What ports and services does each machine in my lab expose, and which are risky?
- Start with
- Your own lab VMs and the containers from project #3.
- Steps
- Build a host-only network and note every IP.
- Run a host-discovery scan, then a service and version scan.
- Record open ports, services and versions in a table.
- Rank risks and write one recommendation per exposure.
- Measure
- The asset inventory matches the machines you created.
- Ship
- Asset and exposure table.
- Why it counts
- Asset discovery is the first step of testing and of defence.
Built an isolated lab and produced a scanned asset inventory with ranked exposures and remediation notes.
Test OWASP Juice Shop and map to the OWASP Top 10:2025
The question: Which weaknesses can you find in a deliberately vulnerable web app, and how would you fix each?
- Start with
- OWASP Juice Shop running locally. Learn the concepts first in the free PortSwigger Web Security Academy.
- Steps
- Run Juice Shop locally in Docker.
- Find five issues (for example broken access control, injection, security misconfiguration).
- Capture the request and response as evidence for each.
- Map each to a category in the OWASP Top 10:2025 (A01 Broken Access Control through A10 Mishandling of Exceptional Conditions).
- Write the fix for each.
- Measure
- Each finding has severity, evidence, reproduction steps and a fix.
- Ship
- A penetration-test style report (template below).
- Why it counts
- Report writing is as important as finding bugs in professional testing.
Assessed OWASP Juice Shop and documented [n] findings mapped to OWASP Top 10:2025 with evidence and remediation.
Wazuh SIEM lab with Atomic Red Team
The question: Which attacker techniques does my monitoring catch, and which does it miss?
- Start with
- Your lab. Tests come from Atomic Red Team, mapped to MITRE ATT&CK.
- Steps
- Deploy the Wazuh manager and enrol a Windows endpoint with the Wazuh agent.
- Install Invoke-Atomic and run five techniques (for example credential dumping, scheduled task, PowerShell).
- Record which tests produce alerts and which do not.
- Tune or write one custom rule for a missed technique and rerun.
- Measure
- A table of technique, expected telemetry, alert fired (yes or no) and rule ID.
- Ship
- Detection gap report and the custom rule.
- Why it counts
- Detection engineering is among the fastest-growing entry paths. Follow the Wazuh documentation for current install steps.
Built a Wazuh SIEM lab and tested [n] ATT&CK techniques; documented detection gaps and wrote a custom rule that closed [k] of them.
SSH brute-force detection and response playbook
The question: How quickly can the lab detect a password-guessing attack, and what should an analyst do next?
- Start with
- Attack your own Ubuntu VM inside the isolated network with a short, made-up password list.
- Steps
- Generate failed SSH logins from the attacker VM.
- Confirm the alerts or fail2ban bans.
- Map the activity to the ATT&CK technique for brute force.
- Write a playbook: triage, contain, investigate, recover.
- Measure
- Time to first alert, and a playbook another analyst could follow.
- Ship
- Playbook document and screenshots.
- Why it counts
- Mirrors daily SOC work.
Simulated SSH brute force in a lab, verified detection and authored an incident-response playbook mapped to MITRE ATT&CK.
Python log analyser and detector
The question: Can a script find suspicious login patterns in an authentication log?
- Start with
- Your Ubuntu VM's
auth.logfrom project #5 or a log you generate. - Steps
- Parse log lines into fields (time, user, IP, result).
- Flag IPs with more than a threshold of failures per minute.
- Output a CSV and a chart of attempts over time.
- Add unit tests with sample lines, including bad input.
- Measure
- Tests pass; false positives noted with an example.
- Ship
- Repo with README and tests.
- Why it counts
- Scripting for security is requested in most analyst job posts.
Wrote a Python detector for brute-force patterns in auth logs with unit tests; flagged [n] simulated attacks with [x] false positives.
Cloud misconfiguration scan with Infrastructure as Code
The question: Which insecure settings exist in my infrastructure code and how do I fix them before deployment?
- Start with
- A sample Terraform file you write with deliberately insecure choices (public storage bucket, open security group, no encryption). Do not deploy it to a real account.
- Steps
- Write the insecure Terraform.
- Scan with Checkov and Trivy.
- Fix each finding and rescan.
- Record the before and after report.
- Measure
- Count of findings before and after, with each fix explained.
- Ship
- Repo with before and after reports.
- Why it counts
- Shift-left cloud security is a common requirement.
Scanned Terraform with Checkov and Trivy; remediated [n] misconfigurations and documented the secure baseline.
Security-test an LLM app for prompt injection
The question: Can instructions hidden in a document make an LLM app leak data or ignore its rules?
- Start with
- A toy chatbot you build over harmless documents, with a fake secret in its system prompt.
- Steps
- Build the chatbot and note its tools and data access.
- Write 20 attack prompts: direct injection, injection inside a retrieved document, attempts to reveal the system prompt.
- Run them and record outcomes.
- Add mitigations (treat retrieved text as untrusted, filter output, least-privilege tools) and rerun.
- Measure
- Attack success rate before and after mitigations.
- Ship
- Test suite and a short report mapped to the OWASP Top 10 for LLM Applications: LLM01 prompt injection, LLM02 sensitive information disclosure, LLM07 system prompt leakage.
- Why it counts
- A current, scarce skill that sets a portfolio apart.
Built an LLM app and a 20-case prompt-injection test suite; reduced attack success from [x]% to [y]% with input and output controls.
DPDP-style data inventory and risk register
The question: What personal data does a fictional app collect, where does it flow and what must the company do under India's data protection law?
- Start with
- A fictional food-delivery or fintech app you define.
- Steps
- List data items, purpose, storage location, processors and retention.
- Draw the data flow.
- Map duties from the Digital Personal Data Protection Act, 2023 such as notice, consent and breach handling, checking the official text and the phased dates of the 2025 Rules.
- Build a risk register: likelihood, impact, control, owner.
- Measure
- Each duty is linked to a control in your register.
- Ship
- Inventory, data-flow diagram and risk register.
- Why it counts
- GRC and privacy roles need this skill and few beginners show it.
Produced a personal-data inventory and risk register for a fictional app mapped to DPDP Act duties and controls.
12 more project ideas
Shorter briefs for when you want a different angle. Apply the same rules: a real source, a baseline, a number and a README.
Phishing email classifier
BeginnerPython, scikit-learn
DataPublic phishing email datasets
Stand-outFalse-positive rate on real newsletters
Password strength and breach checker
BeginnerPython, k-anonymity API
DataHave I Been Pwned range API
Stand-outNever sends the full hash; explains why
Vulnerable app fix-athon
IntermediateDocker, Juice Shop source
DataOWASP Juice Shop
Stand-outPatch three issues and prove with tests
Log forwarding and alerting pipeline
IntermediateWazuh or ELK, Sysmon
DataYour lab
Stand-outMean time to alert measured for 5 techniques
Secure coding review of a student project
BeginnerSemgrep, Bandit
DataAny repo you own
Stand-outFindings triaged with fixes merged
Docker image hardening
IntermediateTrivy, Dockerfile best practices
DataAny project image
Stand-outVulnerability count before and after
Network segmentation lab
IntermediateVirtualBox, pfSense
DataYour lab
Stand-outProof that the attacker VM cannot reach the SIEM
Incident report writing exercise
BeginnerDocs
DataA public breach post-mortem
Stand-outTimeline, root cause and controls in two pages
OSINT footprint of a willing volunteer
BeginnerPublic sources only
DataA friend who consents in writing
Stand-outA removal checklist and consent record
2FA and SSO implementation
IntermediateNode.js or Django, TOTP
DataYour own app
Stand-outA threat model of the auth flow
Mobile app traffic inspection
AdvancedBurp Suite, an emulator, your own app
DataAn app you build
Stand-outFindings mapped to OWASP Mobile Top 10
DPDP consent flow prototype
BeginnerWeb form, logs
DataA fictional app
Stand-outConsent records that can be exported and withdrawn
What each project maps to
| Role | Projects to show |
|---|---|
| SOC analyst | #1, #4, #5, #6 |
| Penetration tester | #2, #3, #8 |
| Cloud security engineer | #7, #4 |
| GRC or privacy analyst | #9, #7 |
Report template
- Scope, authorisation and dates (your own lab).
- Method and tools.
- Findings: title, severity, evidence, reproduction steps, fix.
- Executive summary a manager could act on.
- What was out of scope or not tested.
Free practice platforms
- PortSwigger Web Security Academy: free labs.
- OWASP Juice Shop and DVWA: local vulnerable apps.
- TryHackMe and Hack The Box: guided rooms with free and paid tiers.
Frequently asked questions
What are good cybersecurity projects for beginners?
Packet analysis with Wireshark, scanning your own lab with Nmap, a Juice Shop report, a Wazuh SIEM lab and a Python log detector are all beginner-friendly and portfolio-ready.
How do I build a home cybersecurity lab?
Use VirtualBox or VMware on a laptop with 8 GB RAM minimum (16 GB recommended). Create a host-only network with Kali, a Windows or Ubuntu endpoint and a Wazuh manager.
Is it legal to practise hacking at home?
Yes, on systems you own or on platforms built for it. Unauthorised access can be an offence under India's Information Technology Act, 2000.
Which cybersecurity projects get SOC analyst interviews?
A Wazuh lab with Atomic Red Team tests, an SSH brute-force playbook and a log detector, each with evidence, ATT&CK mapping and gap notes.
Do I need to know coding for cybersecurity projects?
Basic Python or Bash helps in almost every role. Several projects above need only configuration and documentation.
What is the OWASP Top 10 for LLM applications?
A list of the main security risks for LLM-based apps, including prompt injection, sensitive information disclosure and excessive agency. Project 8 tests several of them.
Learn this with mentors
Cybersecurity programmes with admissions open: live classes, mentors and project work.
