Practical cybersecurity guides, labs & compliance
Kioptrix Lab
Practical learning from a cybersecurity enthusiast with extensive hands-on lab experience. Choose the path that matches your question.
Educational planning guides. Verify obligations against current official sources and your own contract.
All VM downloads · All compliance guides · About the author and evidence policy
Understand Kioptrix as a deliberately vulnerable VM practice series. Choose the right release, review host compatibility and lab boundaries, then follow a first learning task with evidence-based notes and links to setup or solution guides.
Plan recurring and post-change internal scans, authentication, remediation and rescanning. Copy a coverage record to reconcile the asset inventory with reached, authenticated, missed and verified targets.
Compare dated ASV price examples by target count, annual term, rescans and support. Copy a quote record and distinguish external scanning fees from internal remediation and administration time.
Plan PCI penetration testing around methodology, internal and external scope, changes, segmentation and retesting. Copy a handoff record that separates deployed fixes, pending tests and verified corrections.
Build a tokenization budget from integration, migration, service and operating costs. A worked example separates external cash from internal capacity so scope reduction is not mistaken for guaranteed savings.
Compare hosted entry, tokenization, encryption, segmentation and P2PE without confusing reduced data exposure with eliminated responsibility. Copy a scope-change record that tracks remaining data, access and validation evidence.
Separate a marketplace’s merchant and service-provider functions. Map seller payment arrangements, confirm validation responsibilities and copy a role-and-handoff record tied to the relevant provider evidence.
Review PCI scope across signup, renewals, payment retries, card updates and support. Copy an event record that tracks data paths, provider confirmation and unresolved questions without storing payment credentials.
Build a Statement of Applicability from your scope, risks and treatment decisions. Copy a tab-separated header and decision-review record, with hypothetical examples that distinguish necessity from implementation status.
Distinguish merchant and service-provider roles, map SaaS payment flows and identify control owners. Copy a service-specific responsibility record that links customer actions, provider evidence and unresolved dependencies.
Map your WooCommerce checkout before selecting an SAQ. Review hosted forms, script security, ASV scans and merchant responsibilities, then copy a payment-flow record for provider and acquirer confirmation.