VULNAREX
SYSTEM ONLINE

🛡️ Training Arenas

Labs
Interactive exploit and defense labs
Courses
Structured learning tracks and missions
Sandbox
Live browser and terminal hacking arena
Whiteboard
Attack planning and vector sketches
Practice
Hands-on code and vulnerability exercises
Tools
Mini utilities for crypto, encoding, and analysis

📖 Knowledge Vaults

Articles
Deep-dive security investigations
Blogs
Cyber threat news and analysis
Cheatsheets
Quick reference payloads and commands
Docs
Platform docs, guides, and protocols
Vulnerabilities
Latest CVEs, advisories, and KEV details

💼 Career Prep

Exams
Certification and challenge prep
Interview Questions
Common questions and answer walkthroughs
Dashboard
XP, progress, and live rank telemetry
Learning Paths
Guided role-based learning roadmaps
Services
Consulting, training, and expert reviews
Contact
Get in touch with VulnarEx Lab ops
About
Login
Script Kiddie
Lv1 · 0xp
Intel Dispatch · Subscribe

Get Exploit Alerts & New Release Drops

Advanced exploit dissections, CVE breakdowns, and new lab drops — straight to your inbox. Unsubscribe anytime.

VULNAREX

A gamified offensive-security sandbox for developers, sysadmins, and researchers — from baseline hardening to kernel-level exploits.

Core Instance · Active & Stable
Telegram WhatsApp Facebook X / Twitter YouTube
Training
  • Labs
  • Courses
  • Sandbox
  • Practice
  • Whiteboard
  • Tools
Knowledge
  • Articles
  • Blogs
  • Cheatsheets
  • Docs
  • Vulnerabilities
Career
  • Exams
  • Interview Prep
  • Dashboard
  • Learning Paths
  • Services
  • Contact
Cluster Nodes
Active Nodes99.98% SLA
London · UK
24ms
Berlin · DE
18ms
Virginia · US
42ms
Tokyo · JP
95ms
30-day uptime99.98%

© 2026 VULNAREX SECURE LABS · ALL RECON FLAGS PROTECTED

Privacy·Terms·Disclaimer· TLS 1.3·Built with
Curriculum lobby
0s75 min Loop75 min★ 160 XP
Syllabus

Operating System Security

Operating System Security FundamentalsCommon OS Security Concepts (Trusted Computing Base, Security Kernel)OS Attack Surface Overview (Services, Ports, Processes, Registry/FS)Secure Installation & Baseline Configuration
User Account & Privilege ManagementPrinciple of Least Privilege (PoLP) in PracticeWindows User Accounts (Administrator vs. Standard User, UAC)Linux User Accounts (root vs. Regular User, sudo Mechanics)macOS User Accounts (Admin vs. Standard, Privacy Preferences)Group Policies & Role-Based Access Control (RBAC)
File System Permissions & Access ControlWindows NTFS Permissions (Full Control, Modify, Read & Execute)Linux/macOS POSIX Permissions (chmod, chown, umask, SUID/SGID/Sticky Bit)Access Control Lists (ACLs) – Windows icacls & Linux setfacl/getfaclShared Folder & Network Drive SecurityFile Integrity Monitoring (AIDE, Tripwire, Windows SFC)
Windows HardeningLocal Security Policy & Security Configuration WizardWindows Defender Firewall & Advanced Security RulesBitLocker Drive Encryption & TPM UsageDisabling Unnecessary Services (Print Spooler, SMBv1, RDP lockdown)Windows 10/11 Security Baselines & Microsoft Defender for EndpointWindows Registry Hardening (LSA, UAC, AutoRun)
Linux HardeningSecuring GRUB Bootloader & Single-User ModeSSH Hardening (Disable root login, key-only auth, fail2ban)AppArmor & SELinux (Enforcing/Targeted/Disabled modes)Unnecessary Package Removal & Service Disabling (systemd)iptables/nftables & TCP Wrappers/etc/security/limits.conf & PAM Configuration
macOS HardeningSystem Integrity Protection (SIP) & GatekeeperFileVault Full-Disk Encryption & Firmware PasswordmacOS Built-in Firewall & Application Firewall (pf)Privacy Settings (Camera, Microphone, Location, Accessibility)MDM Configuration Profiles & Security ConfiguratorXProtect, MRT, & Notarization
Patch Management & Update LifecycleVulnerability Lifecycle & Zero-Day RiskWindows Update (WSUS, Windows Update for Business)Linux Patch Management (apt, yum/dnf, zypper, unattended-upgrades)macOS Software Update & Nudge FrameworkThird-Party Patching (Chocolatey, Patch My PC, Munki)Testing Patches & Rollback Strategies
OS Hardening Automation & ComplianceCIS Benchmarks & DISA STIGs OverviewAutomated Hardening Scripts (PowerShell DSC, Ansible, Bash)OpenSCAP, Lynis, & Osquery for Compliance ScanningContinuous Hardening with Infrastructure as Code (IaC)
Real-World OS Attacks & DefensesWindows Privilege Escalation (Potato Attacks, PrintNightmare)Linux Privilege Escalation (Sudo Bypass, SUID Binaries, Dirty Pipe)macOS TCC Database Bypass & Persistence TechniquesDefensive Logging & Monitoring (Sysmon, Auditd, Unified Logging)
Capstone LabHarden a Windows 10 VM Against CIS Level 1Harden an Ubuntu 22.04 Server Using Lynis & SELinuxPatch Management Simulation (Identifying & Deploying Critical Patches)Post-Hardening Vulnerability Scan (Nessus/OpenVAS Comparison)
operating-system-security / etc-security-limits-pam

/etc/security/limits.conf & PAM Configuration

#When a Fork Bomb Crashes Your Server, You'll Wish You Set Limits#link

A single compromised web process can spawn thousands of processes, exhaust file descriptors, and take down the entire server—if resource limits aren't enforced. The Pluggable Authentication Modules (PAM) framework and /etc/security/limits.conf allow you to cap resources per user/group, enforce password policies, and add additional authentication factors. This lesson combines resource control with PAM hardening to create a resilient Linux account security architecture.

Resource Limits with limits.conf

The file /etc/security/limits.conf sets hard and soft limits for users and groups on parameters like nproc (max processes), nofile (open file descriptors), memlock (locked memory), and cpu (CPU time). Hard limits can only be increased by root; soft limits can be raised by the user up to the hard limit. Applying limits to service accounts (www-data, mysql) prevents resource exhaustion attacks. Use systemd's LimitNOFILE/LimitNPROC for finer per-service control.

bash
# Example limits.conf entries
# <domain>   <type>  <item>   <value>
@webops      hard    nproc    200
www-data     soft    nofile   4096
www-data     hard    nofile   8192
*            soft    core     0

Setting core 0 for all users disables core dumps, which can contain sensitive memory data.

PAM: Authentication, Session, and Password Modules

PAM configuration files in /etc/pam.d/ (e.g., common-auth, common-password, sshd) define the authentication stack. Hardening includes: enforcing strong passwords with pam_pwquality.so (minlen=12, dcredit=-1, ucredit=-1, ocredit=-1, lcredit=-1), limiting login attempts with pam_tally2.so or pam_faillock.so, and implementing MFA with pam_google_authenticator.so. Always test PAM changes with a separate root session open—a misconfiguration can lock all users out.

bash
# Enforce password quality in common-password
sudo sed -i 's/pam_unix.so obscure sha512/pam_unix.so obscure sha512 remember=5/' /etc/pam.d/common-password
# Add pwquality
# Add line: password requisite pam_pwquality.so retry=3 minlen=12 difok=3
info

💡 Always use the 'requisite' or 'required' control flags appropriately: 'requisite' stops immediately if the module fails, 'required' continues the stack but will deny at the end. This affects the error message shown.

PAM ModulePurposeExample Usage
pam_pwquality.soPassword strength enforcementpassword requisite pam_pwquality.so minlen=12
pam_faillock.soAccount lockout after failed attemptsauth required pam_faillock.so deny=5 unlock_time=600
pam_limits.soEnforce limits.confsession required pam_limits.so
pam_umask.soSet default umasksession optional pam_umask.so umask=027

Securing the su and sudo PAM Stacks

Restrict which users can use su (usually to the 'wheel' group on RHEL, or 'sudo' on Debian) by modifying /etc/pam.d/su. Add auth required pam_wheel.so use_uid. For sudo, ensure that PAM is configured to prompt for the user's own password (not root's) via pam_unix.so. Also, set timestamp_timeout=0 in sudoers to reduce risk of session hijacking.

  • ▪Set resource limits for all service accounts; especially nproc and nofile.
  • ▪Harden PAM password policies: minlen=12, remember=5, and complexity classes.
  • ▪Enable account lockout with pam_faillock (deny=5, unlock_time=600).
  • ▪Restrict su to a privileged group using pam_wheel.so.
STRICT SECURE AUDIT RULE

⚠️ A buggy PAM configuration can make the system unbootable. Always keep a root shell open in a separate tty while testing PAM changes, and test with a non-root user before logging out.

quiz BLOCK (★ 50 XP)

A service running as 'myapp' suddenly creates thousands of processes. What setting would have limited the damage?

Select your proof vectors above
challenge BLOCK (★ 100 XP)

PAM and Limits Configuration

Select your proof vectors above

Verification Proof Checkpoint

Verify exercises to earn ★ 160 XP and unlock next lab level.

Previous Lab
Workspace
Lab Notes

✓ Auto-persisted per lesson. Export as Markdown.

Checkpoints
When a Fork Bomb Crashes Your Server, You'll Wish You Set Limits
Laboratory Sanity Code

Isolate active probes on matched virtual networks. Keep execution streams fully sandboxed.