18. Ethics, the Law and a Safe Kali Lab
18.4 Building a Safe, Isolated Lab
Aata maja cha bhag – swatacha lab! Niyam ek: vulnerable machines kadhi internet la joddu naka. Metasploitable 2 mhanje jaanun-bujun kamjor banvlela server aahe – to bridged network var thevla tar kahi minutat tovunach hack hoto. Aapan host-only network vapru: fakt tumcha laptop aani lab VMs ekmekanshi bolu shaktil, baher konashi nahi.
Software you install on your own laptop (host): VirtualBox (free) or VMware. Then these VMs:
| VM | What it is | Default login (lab only) |
|---|---|---|
| Kali Linux | Your attacker machine (all tools preinstalled) | kali / kali (change it) |
| Metasploitable 2 | A deliberately vulnerable Linux server | msfadmin / msfadmin |
| DVWA | Damn Vulnerable Web Application (web bugs) | admin / password |
| OWASP Juice Shop | A modern vulnerable web app (OWASP Top 10) | register your own account |
DVWA and Juice Shop can run inside Metasploitable-style VMs, or on their own small Linux VM, or in Docker on a lab VM. Whatever you choose, keep every one of them on the host-only adapter.
┌─────────────── Your laptop (host) ───────────────┐
│ VirtualBox host-only network 192.168.56.0/24 │
│ │
│ Kali .10 ──► Metasploitable2 .20 │
│ │ ──► DVWA / Juice Shop .30 │
│ └────────── NO route to the internet or LAN │
└───────────────────────────────────────────────────┘
Set it up (VirtualBox example):
- Install VirtualBox on your laptop. File → Host Network Manager → Create a host-only network (e.g.
192.168.56.0/24, DHCP on). - Import the Kali VirtualBox image from kali.org, and the Metasploitable 2 image. Import/build DVWA and Juice Shop.
- For every lab VM: Settings → Network → Adapter 1 → Host-only Adapter. Metasploitable, DVWA and Juice Shop should have no NAT/bridged adapter at all.
- Kali may have a second adapter set to NAT only when you need to update Kali – turn it off again before attacking the lab.
- Take a snapshot of each VM once it is clean, so you can roll back after breaking things.
# on Kali, confirm you are on the lab network and find your lab machines
ip a # should show 192.168.56.x
ip route # no default route = no internet (good for attack mode)
Why this matters for security
Isolation is the whole point. A host-only network means your intentionally-broken machines cannot be reached from the internet and cannot be used as a launch pad against anyone else. This is also how real security teams build "detonation" labs for malware and testing.
Ravindra Bagale's Tip
Students attach a bridged adapter to Metasploitable 2 "to test on the internet" and leave it exposed to the world – it really does get hacked, and your laptop is put at risk too. Never! Vulnerable VM = host-only only. Give temporary NAT only to Kali for updates, then turn it off.
Ravindra Bagale's Tip – मराठी
Metasploitable 2 ला bridged adapter लावून "internet वर test करतो" म्हणून students तो जगासमोर उघडा ठेवतात – तो खरोखर hack होतो आणि तुमचा laptop पण धोक्यात येतो. कधी नाही! Vulnerable VM = फक्त host-only. Update साठी फक्त Kali ला तात्पुरता NAT द्या, मग बंद करा.
Ravindra Bagale's Tip – हिंदी
Metasploitable 2 पर bridged adapter लगाकर "internet पर test कर रहा हूँ" कहकर students उसे दुनिया के सामने खुला छोड़ देते हैं – वह सच में hack हो जाता है और तुम्हारा laptop भी ख़तरे में आ जाता है. कभी नहीं! Vulnerable VM = सिर्फ़ host-only. Update के लिए सिर्फ़ Kali को अस्थायी NAT दो, फिर बंद करो.
Lab
Create the host-only network, attach Kali and Metasploitable 2 to it, and from Kali run ping 192.168.56.20 (works) and ping 8.8.8.8 (should fail in attack mode). Take a clean snapshot of each VM.