Build these 5 cyber projects this weekend and get a job

Main ideas / lessons

• Hands-on experience is essential to land a first cybersecurity role. If you don’t have a job/internship, build practical home labs using only a laptop and virtual machines.
• The video proposes 5 cybersecurity home lab projects you can do this weekend to build skills relevant to real work (e.g., SOC, SIEM, blue/red teaming, and AI-assisted analysis).
• 3 labs are already covered on the channel (with guides to be shared via comments). The other 2 are “concept” labs (not yet built in the video maker’s channel content), but you can extend the earlier labs.
• A consistent best practice: document your labs (LinkedIn write-up, resume links, GitHub evidence) to show proof to recruiters.

Methodology / project list (detailed)

Prerequisites (implied approach)

• Use VirtualBox (or similar) to run virtual machines.
• Build all labs with free components where possible.
• Expect to use at least:
  • A Windows VM and/or Ubuntu VM
  • Optionally a Kali Linux VM as an attacker
• Skills emphasized across the labs:
  • Blue teaming and red teaming
  • Networking / IT fundamentals
  • Python programming
  • Some use of AI agents (cloud or local LLMs)

---

1) Build your own SIEM home lab (WSO / Wazuh SIEM) — real lab with guide

Goal: Learn SOC analyst fundamentals by creating a log/alert collection and monitoring environment.

Definition:

• SIEM = Security Information and Event Management Collects logs from devices and displays alerts/insights on a central dashboard.

Components / setup described:

• VirtualBox
• 2 VMs:
  • Windows VM
  • Ubuntu VM
• Install/run:
  • WSO agent on the Windows VM
  • WSO server on the Ubuntu VM

What to do / lab features demonstrated:

• File and integrity monitoring:
  • Monitor/log changes to directories/files
  • View results on the WSO dashboard
• Add an attacker VM for deeper learning:
  • Add Kali Linux VM
  • Attack the Windows VM
  • Observe what logs/events are produced in WSO

---

2) AI-based cybersecurity home lab: “AI junior SOC analyst bot” — real lab with guide

Goal: Use AI to analyze security alerts/events and simulate a junior SOC workflow.

Tools described:

• VirtualBox with:
  • Ubuntu VM
  • Optional Kali Linux VM (attacker)
• An AI agent:
  • Example used: Area AI (cloud-based AI agent)
  • The presenter says you can use different agents/models, but the lab follows Area AI
• Critical requirement:
  • Python programming (needed to connect events/alerts to the AI agent)

What the lab does (workflow):

• Run a Python script on Ubuntu VM
• The Python script includes an API integration to the AI agent
• Use Kali Linux to generate a DoS attack against the Ubuntu VM
• Python script:
  • Generates alert logs
  • Sends alert/event data to the Area AI agent
• AI agent:
  • Applies guardrails/logic
  • Returns analysis to Ubuntu
• Output includes:
  • Alert explanation
  • Risk rating

Extensibility:

• Tweak the Python + AI “guardrails” logic
• Integrate other components for increased complexity

---

3) Concept home lab: AI-based phishing email analyzer — concept only (not yet built by presenter)

Goal: Build a tool that analyzes phishing emails and produces a risk report, optionally with AI explanations.

Components / required knowledge:

• VirtualBox with VMs
• Python knowledge
• Optionally use:
  • ChatGPT or Claude to help generate a Python script (but you must still understand it)

Proposed system behavior:

• Build a web app using Streamlit or Flask (Python backend)
• User uploads a phishing email to the web app
• The app performs analysis such as:
  • URL extraction
  • Keyword detection
  • Risk scoring
  • Generate a risk report

AI integration options:

• Use a cloud AI agent (example: Area AI) or
• Use Ollama with a local LLM
  • The local AI explains findings in plain English

Portfolio/documentation intention:

• Use test cases and documentation to strengthen a recruiter-facing portfolio

---

4) Build your own Web Application Firewall (WAF) — real lab referenced with guide recommendation

Goal: Learn how firewalls (especially WAFs) protect against web attacks.

Rationale:

• The presenter previously covered two firewall home labs:
  • pfSense network firewall
  • Web application firewall
• They strongly recommend the WAF lab as more interesting

Suggested stack / lab arrangement:

• Use an Ubuntu VM
• Install/run Suricata/SafeLine WAF (presenter mentions “Safe Line web application firewall”)
• Run DVWA (Damn Vulnerable Web Application) on the Ubuntu VM
• Use Kali Linux VM to attack the DVWA app

Example attack mentioned:

• SSL injection attacks

What you implement/learn:

• WAF “controls and guards”
• How they block attacks originating from the attacker machine

---

5) Concept extension home lab: honeypot + attack dashboard — concept extension to the SIEM lab

Goal: Detect attacker activity using a honeypot and visualize logs in real time via a dashboard.

Relationship to prior lab:

• Extension of the Wazuh SIEM lab (project 1)

Proposed architecture (topology described generally):

• Start with the project 1 environment:
  • Windows VM + Ubuntu VM as server setup for Wazuh/Wazoo SIEM
• Add a third VM:
  • Run OpenCanary (honeypot simulator)
  • Fake services like:
    • Fake SSH
    • Fake HTTP
    • Fake SMTP
    • Fake FTP

Attack simulation:

• Spin up a Kali Linux VM
• Attack the honeypot services

How it detects and feeds SIEM:

• OpenCanary produces logs/alerts when attackers interact/exploit fake services
• Those alerts/logs are integrated into Wazuh SIEM

Dashboard goal:

• Add a dashboard to visualize honeypot activity/logs in real time

Honeypot definition (as taught here):

• A honeypot is a decoy system/device designed to attract attackers and expose bogus, deliberately open services so you can observe exploitation attempts

---

Advice on using the labs to get a job (explicit guidance)

• Document everything:
  • Add projects to LinkedIn
  • Write short explanations
  • Include links in your resume
  • Upload artifacts/projects to GitHub
• Emphasis:
  • Recruiters should see evidence, not just claims on a resume
• Call-to-action:
  • The presenter suggests commenting “labs” to get guides for the 3 labs already covered on their channel.

Speakers / sources featured

• Speaker/host: Royden (cybersecurity content creator based in Melbourne, Australia)
• Named tools/sources used or recommended:
  • WSO / Wazuh (SIEM/home lab components; “WSO” is how it’s referred to in the subtitles)
  • VirtualBox
  • Windows VM, Ubuntu VM, Kali Linux VM
  • Area AI (cloud-based AI agent)
  • Brilliant (Thinking in Python course; “Brilliant Tutor”)
  • Ollama (local LLM)
  • Streamlit and Flask (web app frameworks)
  • ChatGPT and Claude (optional script assistance)
  • SafeLine (web application firewall mentioned)
  • DVWA (Damn Vulnerable Web Application)
  • OpenCanary (honeypot services simulator)
  • Forced Wazoo SIEM (referenced as the base for extending into the honeypot project)