90 Days of Cybersecurity, Hands-On: Free Labs for Every Block

The plan has you watch a Network+ video course. Here you look at your own network and see each idea for real.

• Networking glossary — every term in plain words and in technical words
• What happens when you type a URL — DNS, TCP, TLS and HTTP in one walk-through
• Subnetting without tears — read your own network, then split it up
• DHCP explained — how your device gets its address
• IPv6 explained — why it exists and why IPv4 is still here
• DNS explained — how a name becomes an address, with nslookup
• Traceroute on Windows — every hop between you and a website
• Common ports cheat sheet — what usually lives where

Ready to move on when you can find your own IP, gateway and DNS server, and say which subnet you are on.

The plan covers the Security+ ideas on video. These lessons turn the everyday ones into habits, and two labs show the controls working.

• Strong passwords and passphrases and set up a password manager
• Spot a phishing text, read a link before you click and read email headers
• SAML, OIDC and RADIUS in plain English — the sign-in pieces the exam loves
• The Cyber Kill Chain explained — how an attack unfolds, stage by stage
• Canary tokens — plant a tripwire in your own files (deception, a Security+ topic)
• Scan your PC against a benchmark with OpenSCAP — hardening you can measure

Honest note on pace. One week is enough to meet the words, not to pass the exam. The plan links a course for SY0-701; CompTIA has announced a newer Security+ version (V8, SY0-801), so check which one your exam date falls under. Study Once, Earn Two explains how the certs stack.

Two weeks of Linux tutorials in the plan. Here you practise on a free wargame and then read real logs like a defender.

• Lab 02, Lab 03, Lab 05 and Lab 07 — Bandit levels 0 to 20, one small puzzle at a time
• Linux users, passwords and permissions — /etc/passwd, /etc/shadow and chmod
• Lab 09 — Read your own logs — a first-response triage with journalctl
• Lab 14 — Make sense of giant logs — time windows, .gz files and one request at a time
• journalctl cheat sheet — the searches you will reuse

Then defend a Linux box. The Linux for Defenders series (thirteen labs so far), each tested on Ubuntu 24.04 and Rocky Linux 9: sudo, services, cron and timers, firewall, SSH and fail2ban, packages, file permissions and AIDE, and a daily health-check script, then network and DNS, password policy and lockout, rootless containers, auditing root with auditd and disks, fstab and a restore drill.

Ready to move on when you can find a file by owner or size, read its permissions out loud, and pull every failed login from the last hour.

Learn the language from the plan’s courses. Then use it the way defenders do: small scripts that read evidence and flag what is odd.

• Build a packet by hand with Scapy — Python that speaks the network
• Spot a man-in-the-middle — a small read-only Python checker for your ARP table
• Lab 14 — Giant logs — Python next to grep and awk on 117,000 lines

Gap on StashGrid. There is no Python-from-zero course here, and there doesn’t need to be — the plan’s courses do that well. These labs are where you put it to work.

The plan teaches Wireshark, tcpdump and Suricata. These labs give you captures to read and a question to answer from them.

• Lab 12 — Read your first packet capture
• Lab 13 — Diagnose DNS in Wireshark — missing answers and stale caches
• tcpdump cheat sheet — capture from the command line
• Spot a man-in-the-middle — ARP spoofing seen from the defender’s side

Gap on StashGrid. No Suricata lab yet. Use the plan’s Suricata guide for that part.

The plan teaches Git itself. This lab teaches the security lesson every Git user learns eventually: deleting a secret does not remove it from history.

• Find leaked secrets in your repos — gitleaks and trufflehog on a throwaway repo, then a pre-commit guard

Ready to move on when you can explain why git rm doesn’t fix a leaked key, and what you do first instead.

The plan uses the Elastic (ELK) stack. The skill that matters is the same in any SIEM: collect logs, search them, turn a pattern into an alert. StashGrid teaches it with Wazuh and Splunk, both free to run at home.

• Which SIEM should you learn? — Elastic, Wazuh, Splunk and others compared, free-to-lab first
• Run Wazuh with Docker — its search engine is built on OpenSearch, a fork of Elasticsearch, so a lot carries over
• Lab 08 — Watch your own machine — enroll an agent and catch real alerts
• Splunk lab for beginners — find an SSH brute force in real logs
• Hunt failed logins in SSH logs with Splunk

Ready to move on when you can take one suspicious log line and write the search that finds every line like it.

The plan has you pick one cloud and work through its free learning labs. Do that — the providers’ own sandboxes are the right place.

• Canary tokens — includes a decoy AWS key that alerts the moment someone tries it
• Kubernetes Goat — a deliberately vulnerable cluster to practise on
• Pacu — the AWS testing framework, for your own account only

Gap on StashGrid. Cloud is the thinnest shelf here. No StashGrid-written cloud lab yet.

The plan’s review week asks for a home lab and a small project that ties everything together. This is where StashGrid is strongest.

• Lab 00 — Set up your lab — VirtualBox, Kali and a snapshot to roll back to
• Build an isolated attack range — a target VM on a network with no way out
• Build a security lab with Docker
• Home honeypot lab — a tripwire that catches snoopers on your network
• Lab 10 — Test your detections — run a safe attack and catch it in Wazuh. Networking, Linux, logs and security in one project
• The Purple Bridge — how running the attack and catching it line up

Ready to move on when you can rebuild your lab from nothing and explain every piece of it to someone else.

The plan saves hacking for last, on purpose. These are all targets built to be attacked.

• Lab 04 and Lab 06 — Natas, your first web hacking
• Attack OWASP Juice Shop locally and the bug bounty starter lab — with scope rules
• Vulhub — real vulnerable services in Docker, run in your isolated range
• TryHackMe vs Hack The Box — which to use, and when
• Hack The Box — visit Hack The Box (affiliate link — how that works)

Ready to move on when you can write down what you did on a box, step by step, so someone else could repeat it. That write-up is your portfolio.

The plan ends with a one-page resume and its best advice: list your labs and projects as hands-on experience.

Every hands-on StashGrid lab now ends with a Put it on your resume line: one sentence, written the way a hiring manager reads it. Copy it, then change it to match what you actually did.

• Study Once, Earn Two — how certs stack and renew each other, so you pick the next one well
• Lab 10 and the Splunk lab — the two that read best on a SOC resume
• The incident response lifecycle — what interviewers mean by “walk me through an alert”

Ready when every line under “Experience” names something you built or found, not something you watched.