~/tutorials / build-your-hacking-lab

Build Your Hacking Lab

Set up an isolated virtual lab with an attack box and vulnerable targets so you can practice without breaking the law or your home network.

beginner30 min readupdated
  • lab
  • virtualization
  • kali

Lab only. Practice these techniques on your own machines or on platforms that explicitly authorize testing. Informational and educational use only.

Every skill on this site should be practiced against machines you own or platforms that invite you to attack them. A home lab gives you a safe, resettable place to break things. This guide builds one in about half an hour.

What you need

  • A computer with at least 16 GB of RAM and 100 GB of free disk. 8 GB works if you run one target at a time.
  • A hypervisor. Use VirtualBox or VMware Workstation on Windows and Linux, and UTM or VMware Fusion on Apple Silicon Macs.
  • An attack machine: Kali Linux or Parrot Security.
  • One or more intentionally vulnerable targets.

Step 1: Install the hypervisor

Install your hypervisor from the vendor’s site and enable hardware virtualization (Intel VT-x or AMD-V) in your BIOS if it complains. On Apple Silicon, download the ARM64 builds of every VM image.

Step 2: Create an isolated network

This is the most important step. Vulnerable machines are vulnerable on purpose, so they must never sit on the same network as your real devices.

In VirtualBox:

  1. Open File → Tools → Network Manager.
  2. Create a Host-only network, for example 192.168.56.0/24, with the DHCP server enabled.
  3. Every lab VM gets its network adapter set to that host-only network.

Give the Kali VM a second adapter set to NAT so it can download updates. Never give the vulnerable targets a NAT or bridged adapter.

            ┌─────────────── host-only 192.168.56.0/24 ───────────────┐
 Internet ── NAT ── [ Kali ]  ──────────  [ Target 1 ]  [ Target 2 ]
            └──────────────────────────────────────────────────────────┘

Step 3: Install the attack machine

Download the prebuilt Kali VM image for your hypervisor from kali.org. Import it, attach the adapters from step 2, and boot it. Then update everything:

sudo apt update && sudo apt full-upgrade -y
sudo reboot

Change the default password immediately with passwd.

Step 4: Add targets

Start with these, in roughly this order:

Target What it teaches How to run it
OWASP Juice Shop Modern web vulnerabilities docker run -d -p 3000:3000 bkimminich/juice-shop on Kali
DVWA Classic web bugs at adjustable difficulty Docker image or a LAMP VM
Metasploitable 2 Network services and exploitation Import the VM, host-only adapter only
VulnHub boxes Boot-to-root practice Import the OVA, host-only adapter only

Running Juice Shop and DVWA in Docker on the Kali box is the fastest way to start, because they listen only on your machine.

Step 5: Find your targets

From Kali, discover what is alive on the lab network:

ip -brief address            # confirm Kali's host-only IP
sudo nmap -sn 192.168.56.0/24

Any host that answers is a lab VM. Write the IPs down. You will use them in the Nmap tutorial.

Step 6: Snapshot everything

Take a snapshot of every VM in its clean state. When you break something, and you will, roll back in seconds instead of reinstalling.

Lab hygiene checklist

  • Vulnerable VMs only ever use the host-only network.
  • Shut targets down when you are not using them.
  • Never reuse a real password inside the lab.
  • Keep notes on every box: IPs, credentials found, and what worked. Tools like Obsidian or CherryTree are popular for this.

Next steps

With the lab running, learn your way around the shell in Linux Command Line for Hackers, then start scanning.