Lab4PurpleSec is a modular Purple Team homelab combining a vulnerable Active Directory environment (GOAD), a Docker-based web DMZ, pfSense + Suricata, and a Wazuh SIEM. It provides a realistic, open-source training environment for web exploitation, pivoting, Active Directory attacks, and Blue Team detection.
Note: This project was previously named "Lab4OffSec" and has been renamed to "Lab4PurpleSec" to better reflect its Purple Team focus.
Note: This is a V1. Feedback and contributions are welcome.
📜 License Notice: The use of this project (including for CTFs, commercial projects, training, or any other purpose) is subject to the terms and conditions of the MIT License. See
LICENSEfor full details. By using this project, you agree to comply with the license terms, including maintaining copyright notices and license information.
Table of Contents
Lab4PurpleSec is an evolving cybersecurity homelab designed for Red Team and Blue Team training in a near-enterprise environment, integrating network/web pentesting, Active Directory, detection, SIEM, and IDS/IPS.
Project intended for students and cybersecurity enthusiasts!
Lab4PurpleSec is designed to be flexible and can be deployed according to your needs and available resources. You don't need to run all VMs simultaneously - scenarios are designed to be executed step-by-step.
Note: These prerequisites are for a reference configuration. You can customize them to fit your needs. Of course, the RAM is the most important resource to consider (for virtualisation, CPU/GPU power is not as important as RAM).
Important Notes:
Vagrantfile to match your hardware (reduce RAM/CPU per VM if needed)For detailed hardware and software requirements, see docs/SETUP/prereqs.md.
docs/SETUP/prereqs.md for complete listLab4PurpleSec does not provide pre-built virtual machines (OVA/OVF). Installation is done entirely "from scratch" by following the detailed guides provided. This approach:
Lab4PurpleSec includes the following features:
Lab4PurpleSec is an environment dedicated to application and system vulnerability exploitation, hosting intentionally vulnerable machines (Metasploitable2/3), OWASP web applications in an isolated DMZ zone, as well as a vulnerable Active Directory environment (GOAD MINILAB).
GOAD-MINILAB replicates a simplified Active Directory environment with a domain controller and a Windows client workstation (multiple if needed), allowing simulation of various types of Active Directory-oriented attacks.
This section presents the organization of the Lab4PurpleSec repository and describes the role of each directory and main file. This structure enables clear navigation between installation guides, configurations, tests, and project resources.
Lab4PurpleSec/
├── README.md — General overview and quick start (EN)
├── README_FR.md — General overview and quick start (FR)
├── CONTRIBUTING.md — Contribution guidelines
├── LICENSE — License and usage information
├── .gitignore — Files/directories excluded from Git versioning
├── .github/
│ └── ISSUE_TEMPLATE/
│ ├── bug_report.md — Bug report template
│ ├── feature_request.md — Feature request template
│ └── documentation.md — Documentation improvement template
├── ARCHITECTURE.md — Architecture information, interfaces, network diagrams
├── assets/ — Visual resources (images, diagrams, etc.)
├── INVENTORY.md — Inventory list of all VMs and main characteristics
├── automation/ — Vagrant and Ansible automation for internal VMs
│ ├── README.md — Automation documentation and quick start
│ ├── ORCHESTRATION.md — VM orchestration and external integration guide
│ ├── Vagrantfile — Vagrant configuration for internal VMs
│ ├── ansible/ — Ansible playbooks and roles
│ └── scripts/ — Helper scripts for automation
├── docs/
│ ├── README.md
│ ├── SETUP/
│ │ ├── prereqs.md — Hardware and software requirements
│ │ ├── VMs_installation.md — Detailed VM installation and configuration guide
│ │ ├── pfsense_setup.md — pfSense installation and configuration documentation
│ │ ├── Web_server_setup.md — Web server deployment guide
│ │ ├── Wazuh_setup.md — Wazuh installation and agent enrollment guide
│ │ └── GOAD_setup.md — GOAD Active Directory deployment procedure
│ └── TESTS/
│ ├── Web_server.md — Web server validation checklist
│ ├── pfSense.md — pfSense and Suricata verification
│ ├── Wazuh.md — Wazuh testing/documentation
│ └── GOAD-MINILAB.md — GOAD MINILAB verification documentation
├── CONFIGS/
│ ├── web-server/ — Web server configuration files (Nginx, Docker, etc.)
│ └── pfsense/ — pfSense configuration files (rules, XML exports)
⚠️ Security Warning: This lab contains intentionally vulnerable services. Never connect these machines to a production network. Always change default passwords after installation. This environment is designed for isolated, educational use only.
Lab4PurpleSec provides semi-automated deployment using Vagrant and Ansible for most internal VMs.
Quick Start:
On Windows:
cd automation # Navigate to the automation directory
$env:VAGRANT_ANSIBLE = "true" # Enable Ansible provisioning
vagrant up # Start the VMs
On Linux/macOS:
cd automation # Navigate to the automation directory
export VAGRANT_ANSIBLE=true # Enable Ansible provisioning
vagrant up # Start the VMs
What is automated:
Deployment of the following VMs is automated:
What still requires manual setup:
See:
automation/README.md for detailed automation documentationautomation/ORCHESTRATION.md for complete deployment orchestrationdocs/SETUP/README.md for detailed manual installation guidesFor complete manual installation (educational purposes):
docs/SETUP/prereqs.md):
Note: This lab can be deployed using VirtualBox if needed, but VMware Workstation Pro was personally used for this documentation.
docs/SETUP/prereqs.md):
docs/SETUP/pfsense_setup.md):
docs/SETUP/pfsense_setup.md).docs/SETUP/Wazuh_setup.md.docs/SETUP/GOAD_setup.md.docs/TESTS/ to ensure everything is properly configured.You can now enjoy Lab4PurpleSec as you wish!
You can:
Note: The pfSense VM/router (FW-PFSENSE) must be started systematically for the lab to function properly.
See: docs/SETUP/README.md for detailed manual installation guides.
Objective: Obtain initial access on a web VM in DMZ then pivot to a LAN/AD machine.
Skills / tools: Reconnaissance, Tunneling (SSH/SOCKS, proxychains), pivoting.
Expected results: web logs + IDS alerts + Wazuh alerts.
Point to consider: Adapt pfSense rules (simulating a misconfiguration).
Objective: Exploit a web vulnerability (upload, RCE or LFI) on a DMZ service and establish limited persistence.
Skills / tools: web app testing, BurpSuite, OWASP Top 10, webshell, command injection, file upload, HTTP.
Expected results: web logs + IDS alerts + webshell capture.
Objective: Recover Kerberos service tickets to attack service accounts.
Skills / tools: AD enumeration, Kerberos tickets, hash cracking.
Expected results: AD logs + IDS alerts + Wazuh logs showing abnormal activity, timeline.
Lab4PurpleSec supports both automated and manual deployment:
The following VMs can be deployed automatically using Vagrant and Ansible:
See automation/README.md for automated deployment instructions.
The following components must be installed manually from official sources:
docs/SETUP/pfsense_setup.md)docs/SETUP/GOAD_setup.mddocs/SETUP/Wazuh_setup.md)docs/SETUP/Web_server_setup.md)Consult docs/SETUP/prereqs.md for the complete list of required ISO images and docs/SETUP/VMs_installation.md for detailed manual installation guides.
⚠️ Security Warning: The created machines contain intentionally vulnerable services — never connect them to a production network. Immediately change default passwords after installation. This lab is designed for isolated, educational use only.
Lab4PurpleSec is an open-source educational project. Contributions and constructive feedback are welcome!
This project is licensed under the MIT License.
License Notice: The use of this project (including for CTFs, commercial projects, training, or any other purpose) is subject to the terms and conditions of the MIT License. See LICENSE for full details. By using this project, you agree to comply with the license terms, including maintaining copyright notices and license information.
The logos and trademarks cited or represented in this project are the property of their respective holders.
The use of these logos is strictly informative and non-commercial.
Special thanks to Orange Cyberdefense for developing GOAD (https://orange-cyberdefense.github.io/GOAD/).