Practical Homelab for Web Security Research

Sometimes, during black-box testing, I recreate a similar web app using the same stack whenever possible to better understand how the target website actually works. Rebuilding those environments repeatedly on my MacBook is not practical, and I also prefer not to expose vulnerable web apps on my VPS. So, I use a homelab for this purpose. Below is information about the lab architecture and the tools I use for bug hunting.

Lab hardware

The main lab host is a Raspberry Pi 5. I keep it powered on 24/7, connected by Ethernet, and running headless Ubuntu with XFCE installed for cases where a GUI is needed. I chose Ubuntu because it is stable, well supported, and has extensive documentation.

My MacBook is the main machine I use for analysis and hunting. Most web testing tools work well on macOS, so I can keep my workflow simple and avoid switching systems unless I need something specific. Kali runs inside a VM on my MacBook, but I mainly use it for AD-related work rather than web app testing.

Network and access

The Pi and MacBook stay on the same local network. The Pi connects over Ethernet, while the MacBook connects over Wi-Fi. I use DHCP binding on the router for stable device addressing. I use both the router DNS and /etc/hosts on my MacBook depend on the scenario.

For setup Pi, I use SSH for terminal access and VNC when I need the Pi's GUI. This keeps the lab lightweight while still letting me use desktop tools when required.

Web stack

Nginx is the primary server on the lab and hosts multiple web apps. This makes it easy to test different web app-specific configurations in one place. I use Varnish when I want to study cache-related issues, including bugs that depend on response caching or request handling.

Tools on my MacBook

My main tools on macOS are Caido Community and Burp Community. I like Caido for its workflow and clean UI, while Burp is still better for http protocol-level testing, more advanced request manipulation, and plugins that are not available in Caido community version.

Claude Code use to create initial vulnerable web apps and to analyze framework source code, publicly reported issues, forum threads, and discussion posts. This helps me understand how a stack behaves before I start testing it manually.

I also use VNC Viewer for Pi GUI access, PDTM tools for recon, and Go and Bash for custom scripts. Go is useful when I need controlled requests or edge-case testing, while Bash is convenient for quick automation and PoC scripts.

Additional Tools on the Pi

I use Gitea on the Pi to keep my notes and local research material. I also run a few custom Django apps for practical personal use, such as time tracking, daily planning, and habit tracking. These apps are accessible over the local network using my phone on local network and help me keep the lab useful beyond security testing.

Sometimes I also run Burp Suite on the Pi for slow, time-consuming testing, since it is easier than using the MacBook and avoids running those processes in the background. A VNC server is available there for GUI-based work.

External testing

When a local setup is not enough, such as when testing CDN behavior, firewall rules, or location-based restrictions, I use an Akamai Nanode VPS. Direct SSH access is used with usual tools, and sometimes through WireGuard VPN. Both the MacBook and the Raspberry Pi have WireGuard clients installed.

__

This provides a stable and safe environment to recreate web application stacks, study behavior, and practice black-box testing. Analyzing and rebuilding the code also helps generate additional research leads, as the development process provides insight into implementation details, functionality, and system behavior.