Beginner · Your legal practice lab · topic 5 of 35 · 16 min
Why you need an isolated lab
Explanation
Practice has to be safe and legal
You cannot learn attacks by pointing tools at real websites — that is illegal, as the last module explained. The answer is a lab: machines that belong to you, running on your own computer, that you are allowed to attack as much as you like. Because they are yours and isolated, nothing you do can harm anyone else.
What a virtual machine is
A virtual machine (VM) is a whole computer running as a program inside your real computer. The software that runs VMs is a hypervisor; VirtualBox is a free one. You can run several VMs at once: one as the attacker (Kali Linux) and one or more as targets (deliberately weak machines). They talk to each other but, if you set it up right, not to the outside world.
Isolation: the most important setting
The key idea is isolation: your targets must not be reachable from the real internet, and your attacks must not escape your lab. In VirtualBox you do this with a host-only or internal network, which connects the VMs to each other (and optionally your host) but not to the internet. Deliberately vulnerable machines are full of holes; if one were exposed online, a real attacker could take it over and use it against others.
A typical beginner lab
| VM | Role | Notes |
|---|---|---|
| Kali Linux | Attacker | Ships with nmap, Burp, Metasploit and more |
| Metasploitable 2/3 | Target | A Linux box full of old, weak services |
| DVWA | Target (web) | Damn Vulnerable Web Application |
| OWASP Juice Shop | Target (modern web) | A modern, deliberately broken shop app |
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
Why you need an isolated lab · 1/7
You cannot practise on real websites. You build a lab instead.
Prefer a video by a teacher? Find free videos on “virtualbox kali linux hacking lab setup host only network beginners” on YouTube ↗
In real life: A student's laptop lab
A final-year student in Pune with an 8 GB laptop installs VirtualBox, a Kali VM and a DVWA VM, both on a host-only network. She practises SQL injection on DVWA every evening. Nothing she does can reach the real internet, so she can try anything without fear. When she corrupts the DVWA database, she restores a snapshot and carries on. Her whole "hacking lab" cost nothing but disk space.
Practice (0/3 done)
What is a virtual machine?
Why must a deliberately vulnerable VM stay off the internet?
Plan a beginner lab on paper: list the VMs you would create and the network setting that keeps them isolated.
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- Kali Linux: the attacker machineYour legal practice lab · same module
- Vulnerable targets: Metasploitable, DVWA and Juice ShopYour legal practice lab · same module
- Legal online platforms: TryHackMe, Hack The Box and moreYour legal practice lab · same module
- Building a home lab and a portfolioCyber Security: from zero to SOC analyst · Careers and certifications
- Ports and protocolsCyber Security: from zero to SOC analyst · Networking for security
- Virtualisation, VRFs and cloud networkingComputer Networking (CCNA level) · Automation, SDN and cloud networking
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
The software that runs virtual machines is called a…
Answer: Hypervisor
A hypervisor (like VirtualBox) runs VMs.
Which VirtualBox network keeps targets off the internet?
Answer: Host-only or internal
Host-only/internal networks connect the VMs privately without internet access.
A snapshot lets you…
Answer: Roll a VM back to an earlier state
Snapshots save a VM's state so you can restore it after breaking things.
The most important property of a practice lab is…
Answer: Isolation from real systems and the internet
Isolation keeps your attacks safe and legal.
Where should you get a Windows VM for your lab legally?Related
Answer: Microsoft's Evaluation Center (time-limited evaluation)
Microsoft offers free, time-limited evaluation editions for testing.
On a practice platform, which target may you attack?Related
Answer: Only the practice targets the platform assigns you
Permission covers only the assigned practice targets.
From Legal online platforms: TryHackMe, Hack The Box and more
Metasploitable is most useful for practising…Related
Answer: Scanning, enumeration and service exploits
It is a Linux VM full of weak network services to scan and exploit in your lab.
From Vulnerable targets: Metasploitable, DVWA and Juice Shop
Which port range does your computer usually pick its source port from?Related
Answer: 49152–65535
Clients use dynamic (ephemeral) ports, 49152–65535 in the IANA range.
From Ports and protocols
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- 3 more topics in “Your legal practice lab” before its exam: Kali Linux: the attacker machine, Vulnerable targets: Metasploitable, DVWA and Juice Shop, Legal online platforms: TryHackMe, Hack The Box and more.
- Module 2 exam: the practice lab · 12 questions · 20 min, without help. 4 topics of this module still to finish first.
- Then the next module, Methodology and reconnaissance. 35 topics left in the course before the final exam.