Security is a pillar of sovereignty, so I built a hacking lab to learn how I get hacked

• An afternoon, not a project
• The architecture, in plain words
• The part that changes the game: a local, unlimited AI tutor
• So, what can go wrong?
• The quiet part: none of this needs the internet
• Join me

In the Sovereign Continuum I use five pillars: Money, Health, Data, Attention and Energy. Data is the one most people wave away. We say “I have nothing to hide” and move on. But data sovereignty is not about hiding. It is about control, and you cannot control what you do not understand. You cannot defend a home network, a laptop, a wallet or a family’s photos if you have never seen how they are actually taken.

So I decided to learn the uncomfortable half of the story. Not just how to lock a door, but how the lock is picked. And the honest way to learn that is to attack something. Not a stranger, that is a crime and it is also pointless. You attack a copy of the world that you own, in a room nobody else can enter.

This week I built that room. A full, isolated hacking lab, from nothing, in a couple of hours, together with Claude Code. Here is what we built, why it matters for a beginner, and the part that should make you stop and think.

§An afternoon, not a project

I am not a security engineer. A month ago the idea of standing up an attacker machine, a domain controller and a set of vulnerable targets would have been a multi-weekend project full of half-broken tutorials. This time I described what I wanted in plain language, and Claude Code did the heavy lifting: it created the virtual machines, wired the network, verified every step, wrote the documentation as it went, and handed me a working lab.

The interesting shift is not the speed. It is that the machine kept me honest. Every claim was checked. Is the lab really isolated? It did not tell me “yes”, it ran the test from inside a target and showed me the packets die at the wall. That is the difference between a tutorial and an engineer sitting next to you.

§The architecture, in plain words

The whole point is a world that looks real but touches nothing real. So the design is simple and strict:

• One isolated virtual network. The lab has its own private network with no route to my home network and no route to the internet. This is the wall. Everything else is a convenience. This is the rule.

• An attacker box. A Kali Linux machine with the full offensive toolkit, the same tools a real attacker would reach for.

• A set of targets. A couple of deliberately vulnerable Linux machines, two vulnerable web applications, and a small Windows world: a normal desktop and a domain controller, so I can learn how an intruder moves from one weak laptop to the keys of the whole house.

• A clean reset. Every target has a snapshot. I break it, I learn, I roll it back in seconds. Nothing accumulates, nothing is precious, so I am free to be reckless inside the walls.

• Planted, fake treasure. The “secrets” an attacker hunts, the bank statement, the crypto seed, the reused password, are all obvious fakes I placed on purpose. No real key ever lives in a lab.

That last point is the whole philosophy in one line. You practice the attack so you learn the defense. For every step that works against me, the real lesson is the one control that would have stopped it: a stronger passphrase, a network split in two, a patch, a hardware wallet with the seed kept offline.

§The part that changes the game: a local, unlimited AI tutor

Here is where it stops being a normal lab. The lab is not only built with AI, it is tutored by one that runs entirely on my own machine. A local model server, Ollama, with an open qwen3 model that is free of the usual guardrails, sitting offline on my desktop. It knows every machine and every tool on the Kali box, and it answers without hedging.

What makes it genuinely mine is what it reads. The model is connected by retrieval to two knowledge bases that never leave my computer. The first is the living documentation of the lab itself, so it answers about my exact machines, not a generic tutorial. The second is my own Joplin notebooks, years of my personal notes, so it can reason across what I am learning now and everything I have written before. This is retrieval augmented generation, but the sovereign version of it: the model is open, the knowledge is mine, and nothing is sent to a company to make it work.

For a beginner this is enormous. The hardest part of learning security alone is not the tools, it is the wall of jargon and the fear of asking a “stupid” question. Now I have a patient tutor that never gets tired, never sends my questions to a company, and will actually explain how an attack works and, in the same breath, how to defend against it. An AI that knows Kali Linux inside out, available at any hour, on hardware I control.

Sit with that for a second, because it cuts both ways.

§So, what can go wrong?

An unlimited AI, wired to a machine full of offensive tools, running with no external brake. It is a fair question, and I do not want to wave it away.

The model has no built-in guardrails. That is exactly why the guardrails have to live somewhere else: in the isolation of the lab, and in me. The wall around the network is not a detail, it is the entire safety design. The model can explain any technique it likes, and it does not matter, because inside that room there is nothing real to point it at, and it can reach nothing outside. The same knowledge that could do harm in the wrong place is, in a sealed lab against machines I own, simply education.

The uncomfortable truth is that this power now exists and it is cheap. A capable, uncensored assistant that understands offensive tooling runs on a normal desktop today. Pretending that is not the case does not make anyone safer. Understanding it does. I would rather be the person who has seen how the lock is picked, in a room I built for exactly that, than the person who trusted that nobody ever would.

That is the whole argument for doing this out loud. Sovereignty over your data does not come from a product you buy. It comes from understanding, and understanding the attack is how you earn the defense.

§The quiet part: none of this needs the internet

There is a detail here that matters more than it looks, and it is the reason this whole thing belongs on my sovereignty journey and not just in a security forum. Nothing in this lab needs to be online. The machines run on my own hardware. The AI tutor runs on my own hardware. The knowledge it reads, the lab’s documentation and my own Joplin notes, lives on my own hardware. I can pull the network cable, sit in a cabin with no signal, and keep working: keep breaking things, keep asking questions, keep learning. The tutor does not go dark when the connection does.

Put that next to how the rest of our digital life behaves. Most of our tools stop the moment the Wi-Fi drops, because the real work happens on someone else’s computer and the intelligence lives in someone else’s cloud. On the Sovereign Continuum I mapped this exact ladder: the seven stages from dependent to sovereign. Owning your tools is Control. Being able to use them when the outside world is unavailable is Resilient, and then Parallel. A capable assistant that keeps working with the cable pulled is not a gimmick. It is what sovereignty over your data and your attention actually feels like in practice.

§Join me

I am at the very beginning of this. I will make mistakes, I will hit walls, and I will share both. If you have ever felt that your digital life is something that happens to you rather than something you control, this is the same journey, one brick at a time.

Next I will run the first real attack across the lab and write up what worked and, more importantly, what would have stopped it.

Come along. It is more fun to learn to defend when you are allowed to attack.