Ravindra BagaleCourses & study guides

18. Ethics, the Law and a Safe Kali Lab

18.4 Building a Safe, Isolated Lab

Aata maja cha bhag – swatacha lab! Niyam ek: vulnerable machines kadhi internet la joddu naka. Metasploitable 2 mhanje jaanun-bujun kamjor banvlela server aahe – to bridged network var thevla tar kahi minutat tovunach hack hoto. Aapan host-only network vapru: fakt tumcha laptop aani lab VMs ekmekanshi bolu shaktil, baher konashi nahi.

Software you install on your own laptop (host): VirtualBox (free) or VMware. Then these VMs:

VM What it is Default login (lab only)
Kali Linux Your attacker machine (all tools preinstalled) kali / kali (change it)
Metasploitable 2 A deliberately vulnerable Linux server msfadmin / msfadmin
DVWA Damn Vulnerable Web Application (web bugs) admin / password
OWASP Juice Shop A modern vulnerable web app (OWASP Top 10) register your own account

DVWA and Juice Shop can run inside Metasploitable-style VMs, or on their own small Linux VM, or in Docker on a lab VM. Whatever you choose, keep every one of them on the host-only adapter.

        ┌─────────────── Your laptop (host) ───────────────┐
        │  VirtualBox host-only network 192.168.56.0/24     │
        │                                                   │
        │  Kali .10 ──►  Metasploitable2 .20                │
        │      │    ──►  DVWA / Juice Shop .30              │
        │      └──────────  NO route to the internet or LAN │
        └───────────────────────────────────────────────────┘

Set it up (VirtualBox example):

  1. Install VirtualBox on your laptop. File → Host Network Manager → Create a host-only network (e.g. 192.168.56.0/24, DHCP on).
  2. Import the Kali VirtualBox image from kali.org, and the Metasploitable 2 image. Import/build DVWA and Juice Shop.
  3. For every lab VM: Settings → Network → Adapter 1 → Host-only Adapter. Metasploitable, DVWA and Juice Shop should have no NAT/bridged adapter at all.
  4. Kali may have a second adapter set to NAT only when you need to update Kali – turn it off again before attacking the lab.
  5. Take a snapshot of each VM once it is clean, so you can roll back after breaking things.
# on Kali, confirm you are on the lab network and find your lab machines
ip a                                  # should show 192.168.56.x
ip route                              # no default route = no internet (good for attack mode)

Why this matters for security

Isolation is the whole point. A host-only network means your intentionally-broken machines cannot be reached from the internet and cannot be used as a launch pad against anyone else. This is also how real security teams build "detonation" labs for malware and testing.

Ravindra Bagale's Tip

Students attach a bridged adapter to Metasploitable 2 "to test on the internet" and leave it exposed to the world – it really does get hacked, and your laptop is put at risk too. Never! Vulnerable VM = host-only only. Give temporary NAT only to Kali for updates, then turn it off.

Lab

Create the host-only network, attach Kali and Metasploitable 2 to it, and from Kali run ping 192.168.56.20 (works) and ping 8.8.8.8 (should fail in attack mode). Take a clean snapshot of each VM.