Thuta Learning
Search
BasicSecurityintermediate

Security Lab Setup

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

  • Understand Security Lab Setup without the intimidation factor
  • Get hands-on running tools yourself in an authorized lab environment
  • Be ready to apply this concept directly in a real assessment/report

Let's think about this for a moment

Kali Linux is a Linux distribution that comes with a huge number of security testing tools pre-installed (Nmap, Wireshark, Metasploit) — it's usually run as a virtual machine inside VirtualBox/VMware. The target VM is a 'deliberately vulnerable' practice machine (for example, Metasploitable, DVWA, or an online lab from HackTheBox/TryHackMe) — since it isn't a real production system, practicing on it carries zero legal risk. You'll also need to configure network isolation (Host-only or NAT network mode) so the lab VMs never touch the internet or a real network (protecting against accidental scans).

Let's connect it to a real scenario

Pick the 'Internal Network' or 'Host-only' adapter in VirtualBox and put your Kali Linux VM and Metasploitable VM on the same network — you can now scan/attack-test from Kali against Metasploitable while never touching the internet or any real-world system. Everything stays fully isolated right there on your own laptop.

Let's look at an example together

text
Lab setup checklist:

1. Install VirtualBox (or VMware)
2. Download Kali Linux VM image (kali.org)
3. Download Metasploitable2 (intentionally vulnerable target)
4. Set BOTH VMs' network adapter to "Internal Network" or "Host-only"
   (NOT "Bridged" — bridged would expose them to your real network)
5. Boot both, confirm they can ping each other, confirm neither
   can reach the internet or your home network
You should see
Confirm you can ping the Metasploitable VM from the Kali VM, and that neither can reach the internet.

Try it in 5 minutes

Try installing Kali Linux + Metasploitable in VirtualBox (or create a TryHackMe/HackTheBox account — you'll get browser-based labs) — confirm your network isolation setup is correct.

A quick word of caution

Never connect the Metasploitable/DVWA VM directly to the internet — it's packed with severe vulnerabilities by design, and a real attacker who finds it could exploit it instantly (running a VM like this facing the public internet is extremely dangerous).

Easy traps

  • Setting the VM's network adapter to 'Bridged' mode — this can effectively expose an intentionally-vulnerable lab VM to your real home/office network, which carries real risk
  • Treating the target VM (Metasploitable) as something production-like — it's for practice only and should never be used in a real deployment

Now try it yourself

Try installing Kali Linux + Metasploitable in VirtualBox (or create a TryHackMe/HackTheBox account — you'll get browser-based labs) — confirm your network isolation setup is correct.

You'll know it worked when: Confirm you can ping the Metasploitable VM from the Kali VM, and that neither can reach the internet.

Security Lab Setup | Thuta Learning