Building a Home Security Lab with VirtualBox and Kali

A home security lab is the single best thing a newcomer can set up, because it gives you a place to run real attacks against real targets without touching anything you do not own. This walkthrough takes you from an empty laptop to a working practice range: VirtualBox as the host, a Kali Linux attacker, a couple of deliberately vulnerable machines to break into, and a private network that keeps the whole thing sealed off from the internet and from your home router. By the end you will have an attacker box that can ping and scan a target on 10.10.10.0/24, and the muscle memory to rebuild it whenever you want.

Work through the sections in order the first time. Each one builds on the last, and the networking step in the middle is the part that turns a pile of virtual machines into a lab you can actually trust.

01Why you need an isolated lab, and the one rule you never break

An isolated home security lab exists so you can make mistakes loudly and safely, with no risk to anyone else. When you are learning, you will run noisy scans, fire off exploits that crash services, and leave half-broken machines lying around. Doing that on your own private network is how you learn. Doing it on a system that belongs to someone else is a crime in most countries, even if you meant well and broke nothing.

That is the golden rule, and it is worth stating plainly: you only ever practice on systems you own or have explicit written authorization to test. A lab removes the temptation to "just try it" against a live site, because you have something better sitting on your own disk. It also removes the legal and ethical grey area completely. Inside the lab you can do anything. Outside it, you do nothing without permission.

There is a practical reason for isolation too. Vulnerable practice machines are, by design, full of holes. If one of them can reach the internet, it can be found and taken over by someone else, and now you are hosting an attacker's foothold on your home network. Keeping the lab on a private, internet-less network protects you as much as it protects everyone else.

02What the finished home lab looks like

The finished lab is three simple pieces wired together: a host machine, an attacker VM, and one or more target VMs on a private network. VirtualBox runs on your normal laptop or desktop. Inside it you run Kali Linux as the attacker. Alongside Kali you run the vulnerable targets. A host-only or internal network connects the attacker to the targets and to nothing else.

The diagram below shows the shape of it. The dashed boundary is the important part: traffic flows freely between the attacker and the targets, but that private segment has no route to the internet or to your real home LAN.

If you keep that picture in your head, every step below has an obvious place. You are either setting up the host, building a VM, or wiring the private network.

03Installing VirtualBox and what your machine needs

Installing VirtualBox is the first build step, and the system requirements are modest. VirtualBox is free and open source, made by Oracle, and it runs on Windows, macOS, and Linux. Download the installer for your host operating system from the official site and run it with the defaults. If VirtualBox does not suit you, the common free alternative is VMware Workstation Player, which is free for personal, non-commercial use; the concepts in this guide carry over, only the menu names change.

Your host needs hardware virtualization enabled, because that is what lets a VM run at a usable speed. On most machines it is a BIOS or UEFI setting called VT-x (Intel) or AMD-V (AMD) or sometimes just "Virtualization Technology". If VirtualBox warns that it can only start 32-bit guests, that setting is off, and you need to turn it on in firmware before anything else works.

While you are at it, download and install the matching VirtualBox Extension Pack from the same page. It adds USB and a few other conveniences. It is optional for a basic lab, but it is easier to add now than later.

04Building the Kali Linux attacker VM

The Kali Linux VM is your attacker, the box you run tools from. Kali is a Debian-based distribution that ships with nmap, Metasploit, Burp Suite, and most of the toolkit already installed, which is exactly why it is the standard starting point. The fastest route is to use the official prebuilt VirtualBox image rather than installing from an ISO, because the prebuilt image arrives pre-configured and already has the guest additions baked in.

# verify the download, then compare the printed hash to the value on kali.org
sha256sum kali-linux-2024.4-virtualbox-amd64.7z

# first thing after you log in: update the box and change the default password
sudo apt update && sudo apt -y full-upgrade
passwd

If you prefer to install Kali from the ISO instead of the prebuilt image, that works too, you just install the guest additions yourself afterwards. On Kali the clean way is to install the packaged version so it survives kernel updates.

# only needed if you built from the ISO; the prebuilt image already has these
sudo apt update && sudo apt install -y virtualbox-guest-x11
sudo reboot

05Adding vulnerable targets to practice against

Vulnerable targets are the machines you actually attack, and a good lab has a few different kinds. An attacker VM on its own has nothing to do. You want a spread: an old full-system target, a web application or two, and a rotating cast of challenge boxes. Here is a sensible starter set.

Metasploitable 2 is a deliberately broken Linux server published by Rapid7. It is the classic first target: dozens of weak services, default logins, and well-documented holes, which makes it perfect for learning scanning and exploitation end to end. It ships as a VMware disk, and VirtualBox imports it cleanly. Create a new Linux VM, skip creating a disk, and attach the downloaded Metasploitable.vmdk as an existing disk instead.

# Metasploitable 2 default login (expected; it is meant to be weak)
username: msfadmin
password: msfadmin

DVWA and OWASP Juice Shop are vulnerable web applications, and the quickest way to run them is in Docker on a small Linux target VM (or on Kali itself, which already has Docker available). DVWA is a classic PHP practice app with tunable difficulty. Juice Shop is a modern JavaScript app full of realistic web bugs.

# run two vulnerable web apps in seconds with Docker
docker run -d -p 80:80 vulnerables/web-dvwa
docker run -d -p 3000:3000 bkimminich/juice-shop

A VulnHub box rounds things out. VulnHub hosts a large library of community-made challenge machines that you download as a single appliance file and import. Each one is a self-contained puzzle, usually a boot-to-root. In VirtualBox you add one with File, Import Appliance, and point it at the downloaded .ova.

06The networking step that keeps the lab contained

The networking step is the one that makes this a lab instead of a hazard, so take your time here. Every VM has one or more virtual network adapters, and the mode you choose for each adapter decides what it can reach. For an isolated lab you use either a host-only network or an internal network, and you keep the targets off NAT entirely.

The difference between the two modes is worth knowing:

A host-only network is the usual choice because it still lets your host talk to the VMs (handy for copying files or reaching a web app in your host browser) while giving the lab no path to the internet. If you want maximum isolation, use an internal network so nothing outside the VMs can touch the targets at all.

To put the lab on the 10.10.10.0/24 range, configure the host-only interface and then give each VM a static address. On a Linux or macOS host the interface is usually called vboxnet0; on Windows it is "VirtualBox Host-Only Ethernet Adapter". You can also do all of this from the Host Network Manager in the GUI.

# 0xpriv.dev/labs
# set the host-only network to 10.10.10.0/24 and turn off its DHCP
VBoxManage hostonlyif ipconfig vboxnet0 --ip 10.10.10.1 --netmask 255.255.255.0
VBoxManage dhcpserver remove --interface vboxnet0

# point a VM's first adapter at that host-only network
VBoxManage modifyvm "Kali" --nic1 hostonly --hostonlyadapter1 vboxnet0

With DHCP off, set static addresses inside each guest so you always know where things are. Give Kali 10.10.10.5 and a target 10.10.10.10, for example.

$ sudo ip addr add 10.10.10.5/24 dev eth0
$ ip -brief addr show eth0
eth0   UP   10.10.10.5/24

07Snapshots: break things, then roll back in seconds

Snapshots are the safety net that lets you break a machine on purpose and undo it instantly. A snapshot freezes a VM's exact disk and memory state, and you can return to it later no matter what you did in between. In a lab this is priceless: you run a destructive exploit, trash the box, and restore to a clean state in seconds, ready to try again.

The habit to build is to take a clean snapshot right after you finish setting up each VM, before you have touched anything. That becomes your baseline. Take more as you go, named for where you are, so you can jump back to any point.

# snapshot a freshly built, patched VM as your baseline
VBoxManage snapshot "Kali" take clean-base --description "fresh install, updated"

# list what you have, then roll a target back to its pristine state
VBoxManage snapshot "Metasploitable2" list
VBoxManage snapshot "Metasploitable2" restore clean-base

You can do the same from the GUI with the Snapshots view on each VM, which is easier when you are starting out. Either way, the rule of thumb is simple: snapshot before anything risky, and never be afraid to break a lab box, because clean is one restore away.

08First end-to-end check: ping and scan the target

The first end-to-end check proves the whole lab works: your attacker can see a target and read what it is running. Boot Kali and at least one target, both on the 10.10.10.0/24 network, then run three quick tests from Kali. If all three succeed, your lab is live.

Start by confirming raw connectivity with a ping. If this fails, the two VMs are not on the same network, and you go back to the networking step.

$ ping -c 3 10.10.10.10
64 bytes from 10.10.10.10: icmp_seq=1 ttl=64 time=0.42 ms
64 bytes from 10.10.10.10: icmp_seq=2 ttl=64 time=0.39 ms
--- 10.10.10.10 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss

Next, sweep the network to see which hosts are alive. This is a host discovery scan, and it is how you find targets whose address you do not already know.

$ nmap -sn 10.10.10.0/24
Nmap scan report for 10.10.10.5
Host is up (0.00030s latency).
Nmap scan report for 10.10.10.10
Host is up (0.00041s latency).
Nmap done: 256 IP addresses (2 hosts up) scanned in 2.15s

Finally, scan the target's services and versions. On Metasploitable 2 you will see a long list of open ports, which is exactly the point. That output is your first map of what to attack.

$ nmap -sV 10.10.10.10
PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 2.3.4
22/tcp   open  ssh         OpenSSH 4.7p1
80/tcp   open  http        Apache httpd 2.2.8
445/tcp  open  netbios-ssn Samba smbd 3.X - 4.X

If you got a successful ping, a host-discovery result, and a service list, congratulations: you have a working home security lab. Everything you learn from here, from exploiting a service to attacking a web app, happens on this foundation.

09Where to find more targets and where to go next

More targets are how you keep the lab interesting once the starter boxes feel easy. The library of practice material is large and mostly free, and you pull from it as your skills grow. A few reliable sources:

As for where to go next: pick one Metasploitable service and take it all the way, from the nmap result to a shell, then read how the fix would have stopped you. Rinse through a VulnHub box. Then start pointing the same attention at the defensive side, because the best attackers understand exactly what the logs on the other end look like.

10Staying in scope without slowing down

Staying in scope is the habit that keeps your practice legal and your lab safe, and it costs you nothing once it is built in. The rules are short, and they are all about keeping the dangerous stuff fenced off and your attacks pointed only where you are allowed. Treat the box below as the checklist you glance at whenever you add something new.

11FAQ

12Wrapping up

A home security lab turns "I read about an attack" into "I ran it and watched it work", which is the only way the skills stick. You now have the full recipe: VirtualBox on the host, a Kali attacker, a few vulnerable targets, a private 10.10.10.0/24 network with no way out, and snapshots so nothing you break is permanent. Build it once, snapshot a clean baseline, and you have a place to practice for years. Keep every attack inside those walls, learn the defensive side as you go, and the lab will take you further than any single tutorial.