VULNAREX
SYSTEM ONLINE

🛡️ Training Arenas

Labs
Interactive exploit and defense labs
Courses
Structured learning tracks and missions
Sandbox
Live browser and terminal hacking arena
Whiteboard
Attack planning and vector sketches
Practice
Hands-on code and vulnerability exercises
Tools
Mini utilities for crypto, encoding, and analysis

📖 Knowledge Vaults

Articles
Deep-dive security investigations
Blogs
Cyber threat news and analysis
Cheatsheets
Quick reference payloads and commands
Docs
Platform docs, guides, and protocols
Vulnerabilities
Latest CVEs, advisories, and KEV details

💼 Career Prep

Exams
Certification and challenge prep
Interview Questions
Common questions and answer walkthroughs
Dashboard
XP, progress, and live rank telemetry
Learning Paths
Guided role-based learning roadmaps
Services
Consulting, training, and expert reviews
Contact
Get in touch with VulnarEx Lab ops
About
Login
Script Kiddie
Lv1 · 0xp
Intel Dispatch · Subscribe

Get Exploit Alerts & New Release Drops

Advanced exploit dissections, CVE breakdowns, and new lab drops — straight to your inbox. Unsubscribe anytime.

VULNAREX

A gamified offensive-security sandbox for developers, sysadmins, and researchers — from baseline hardening to kernel-level exploits.

Core Instance · Active & Stable
Telegram WhatsApp Facebook X / Twitter YouTube
Training
  • Labs
  • Courses
  • Sandbox
  • Practice
  • Whiteboard
  • Tools
Knowledge
  • Articles
  • Blogs
  • Cheatsheets
  • Docs
  • Vulnerabilities
Career
  • Exams
  • Interview Prep
  • Dashboard
  • Learning Paths
  • Services
  • Contact
Cluster Nodes
Active Nodes99.98% SLA
London · UK
24ms
Berlin · DE
18ms
Virginia · US
42ms
Tokyo · JP
95ms
30-day uptime99.98%

© 2026 VULNAREX SECURE LABS · ALL RECON FLAGS PROTECTED

Privacy·Terms·Disclaimer· TLS 1.3·Built with
Curriculum lobby
0s75 min Loop75 min★ 150 XP
Syllabus

Operating System Security

Operating System Security FundamentalsCommon OS Security Concepts (Trusted Computing Base, Security Kernel)OS Attack Surface Overview (Services, Ports, Processes, Registry/FS)Secure Installation & Baseline Configuration
User Account & Privilege ManagementPrinciple of Least Privilege (PoLP) in PracticeWindows User Accounts (Administrator vs. Standard User, UAC)Linux User Accounts (root vs. Regular User, sudo Mechanics)macOS User Accounts (Admin vs. Standard, Privacy Preferences)Group Policies & Role-Based Access Control (RBAC)
File System Permissions & Access ControlWindows NTFS Permissions (Full Control, Modify, Read & Execute)Linux/macOS POSIX Permissions (chmod, chown, umask, SUID/SGID/Sticky Bit)Access Control Lists (ACLs) – Windows icacls & Linux setfacl/getfaclShared Folder & Network Drive SecurityFile Integrity Monitoring (AIDE, Tripwire, Windows SFC)
Windows HardeningLocal Security Policy & Security Configuration WizardWindows Defender Firewall & Advanced Security RulesBitLocker Drive Encryption & TPM UsageDisabling Unnecessary Services (Print Spooler, SMBv1, RDP lockdown)Windows 10/11 Security Baselines & Microsoft Defender for EndpointWindows Registry Hardening (LSA, UAC, AutoRun)
Linux HardeningSecuring GRUB Bootloader & Single-User ModeSSH Hardening (Disable root login, key-only auth, fail2ban)AppArmor & SELinux (Enforcing/Targeted/Disabled modes)Unnecessary Package Removal & Service Disabling (systemd)iptables/nftables & TCP Wrappers/etc/security/limits.conf & PAM Configuration
macOS HardeningSystem Integrity Protection (SIP) & GatekeeperFileVault Full-Disk Encryption & Firmware PasswordmacOS Built-in Firewall & Application Firewall (pf)Privacy Settings (Camera, Microphone, Location, Accessibility)MDM Configuration Profiles & Security ConfiguratorXProtect, MRT, & Notarization
Patch Management & Update LifecycleVulnerability Lifecycle & Zero-Day RiskWindows Update (WSUS, Windows Update for Business)Linux Patch Management (apt, yum/dnf, zypper, unattended-upgrades)macOS Software Update & Nudge FrameworkThird-Party Patching (Chocolatey, Patch My PC, Munki)Testing Patches & Rollback Strategies
OS Hardening Automation & ComplianceCIS Benchmarks & DISA STIGs OverviewAutomated Hardening Scripts (PowerShell DSC, Ansible, Bash)OpenSCAP, Lynis, & Osquery for Compliance ScanningContinuous Hardening with Infrastructure as Code (IaC)
Real-World OS Attacks & DefensesWindows Privilege Escalation (Potato Attacks, PrintNightmare)Linux Privilege Escalation (Sudo Bypass, SUID Binaries, Dirty Pipe)macOS TCC Database Bypass & Persistence TechniquesDefensive Logging & Monitoring (Sysmon, Auditd, Unified Logging)
Capstone LabHarden a Windows 10 VM Against CIS Level 1Harden an Ubuntu 22.04 Server Using Lynis & SELinuxPatch Management Simulation (Identifying & Deploying Critical Patches)Post-Hardening Vulnerability Scan (Nessus/OpenVAS Comparison)
operating-system-security / macos-firewall-pf

macOS Built-in Firewall & Application Firewall (pf)

#The macOS Firewall You Forgot: pf Is Not Just for BSD#link

macOS includes two firewalls: the Application Firewall (socket filter) and pf (packet filter). Most users only touch the simple GUI toggle, missing the powerful pf rule engine that can statefully filter traffic, limit connections, and log anomalies. This lesson opens the hood on both layers, providing pf.conf examples that turn your Mac into a hardened endpoint that blocks unsolicited inbound connections and exfiltrates only what you allow.

Application Firewall: Allowing Specific Apps

The Application Firewall (System Preferences → Security → Firewall) allows or blocks incoming connections on a per-application basis. It's a higher-level socket filter, not a full packet filter. In 'Block all incoming connections' mode, only essential services (like mDNSResponder) are allowed. This is suitable for most users, but it doesn't filter outbound traffic or protect against network-based attacks on allowed services.

Check application firewall status
root@vulnarex:~#/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate

The socketfilterfw command-line tool allows scripting firewall settings for deployment.

pf (Packet Filter): The Real Firewall

pf is a stateful packet filter with a syntax similar to OpenBSD's pf. Configuration lives in /etc/pf.conf. You can create rules to block all inbound traffic except established, allow specific ports, and even filter outbound. pf is disabled by default; enable with pfctl -e. A minimal ruleset should block all inbound, allow loopback, and allow established. For advanced use, add table definitions to block known-bad IPs and implement egress filtering.

bash
# /etc/pf.conf — block all inbound, allow established
set block-policy drop
set skip on lo0
block in all
pass out all keep state
# Optionally, block outbound to known malicious IPs
table <badhosts> persist file "/etc/pf.badhosts"
block drop out quick from any to <badhosts>
info

💡 Use 'pfctl -sa' to see active rules, state table, and tables. Enable logging with 'block in log all' to capture denied packets in /var/log/pf.log.

Firewall TypeLayerUse Case
Application FirewallSocket layerPer-app inbound control, user-friendly
pfNetwork layer 3/4Stateful packet filtering, egress control, threat intelligence

Integration with Little Snitch and Egress Filtering

For per-process outbound filtering, many security-conscious Mac users deploy Little Snitch or Lulu. These applications operate at the socket layer, prompting the user for each new outbound connection. Combined with pf for network-level filtering, this creates a robust two-tier firewall. However, malware with admin rights can disable these tools, so pairing with TCC restrictions and SIP is essential.

  • ▪Enable the Application Firewall and set to 'Block all incoming connections' for standard users.
  • ▪Deploy a pf.conf that blocks all inbound, allows loopback, and maintains state.
  • ▪Consider egress filtering via pf tables of known malicious IPs.
  • ▪If using third-party firewalls, ensure they can't be disabled by non-admins via TCC.
STRICT SECURE AUDIT RULE

⚠️ pf rules are not persistent across reboots by default. Use 'sudo pfctl -f /etc/pf.conf' to load, and create a launchd plist to enable on boot (sudo pfctl -E -f /etc/pf.conf).

quiz BLOCK (★ 50 XP)

You've enabled the Application Firewall. Why might you still deploy pf rules?

Select your proof vectors above
challenge BLOCK (★ 100 XP)

pf Configuration Lab

Select your proof vectors above

Verification Proof Checkpoint

Verify exercises to earn ★ 150 XP and unlock next lab level.

Previous Lab
Workspace
Lab Notes

✓ Auto-persisted per lesson. Export as Markdown.

Checkpoints
The macOS Firewall You Forgot: pf Is Not Just for BSD
Laboratory Sanity Code

Isolate active probes on matched virtual networks. Keep execution streams fully sandboxed.