Homelabs for hackers: Building a cyber range on a student budget

The cyber security skills shortage is a constant topic at conferences like this one, but most of the conversation focuses on hiring pipelines, university programs, and certifications. Less discussed is what happens after someone decides to pursue a career in cyber but before they land their first role: a gap where motivation is high, budgets are low, and the path from coursework to practical competence is unclear.

This session addresses that gap directly. It walks attendees through how to build a functional cybersecurity home lab from nothing, using free and open-source tools, secondhand hardware, and cloud free tiers, then scale it into a genuine cyber range capable of supporting red team, blue team, and network security exercises.

The session opens by framing why labs matter beyond certification prep. A home lab is a place to break things safely, build portfolio evidence, and develop confidence with the same tools used in production environments. For students, it is often the single biggest differentiator in interviews. For early-career practitioners, it is a low-risk space to test detection logic, practise incident response, and experiment with configurations that would be too disruptive to try at work.

The core of the session covers four practical lab architectures, each one scalable and built from freely available software: a single-PC setup using VirtualBox with Kali Linux and a vulnerable target; a beginner blue team setup pairing a Windows endpoint running Sysmon with Wazuh or Elastic SIEM; a cloud lab using free-tier compute for remote targets and centralised logging; and a Proxmox-based cyber range running multiple VMs with network segmentation, a Windows domain, and an ELK SIEM stack. 

This final architecture is the basis of Homelabs for Hackers, a free open-source guide to building cyber ranges on a single laptop using Proxmox, GNS3, QEMU, and SIEM.

Each architecture includes specific tools, minimum hardware requirements, and a clear path to scale from one tier to the next. The session also covers sourcing hardware cheaply and avoiding common pitfalls with cloud billing, licensing, and resource constraints.

The session closes with how to turn lab work into career capital: building a portfolio, publishing to GitHub, and speaking to real tools in interviews rather than theoretical knowledge. Attendees will leave with a resource pack of setup guides, tool links, and lab blueprints, along with access to the full Homelabs for Hackers documentation. All tools discussed are free or have free tiers. No vendor-specific products are endorsed or recommended.

This talk has been well received at BSides Sydney and BSides Ballarat, where it was delivered to student and early-career audiences. This submission expands the content into a longer format with additional depth on each lab architecture and the career capital component.