VirtualBox: How to set up a Basic Pentesting Lab
Introduction
Training penetration testing typically occurs in a dedicated environment known as a pentesting lab, which is isolated from regular user applications and operating systems for security and convenience. A pentesting lab can vary in complexity, with a minimalist setup involving a single computer running multiple virtual machines (VMs), often referred to as a virtual or basic pentesting lab. This variant uses virtualization software like VMware or VirtualBox to create an attacker VM with a specialized OS, such as Kali, Parrot or Arch, and allows for the addition of target machines. These machines are then consolidated in a virtual network. Users can log into the attacker machine to begin testing. More advanced labs may incorporate real hardware, such as real computers, routers, and firewalls, but this increases costs and electricity usage. However, these sophisticated environments enable more realistic scenarios and complex tasks.
This page explains how a basic pentesting lab that can be set up with VirtualBox. This environment will suffice for most people who want to try out or train pentesting and hacking at home. The system will consist of a base machine at performs the actual operations (the attacker machine) and arbitrary target machines, the user can add and remove at will.
The software used in this tutorial:
- Windows 10 or 11 (as the Host OS)
- VirtualBox
- Kali Linux
Setup Steps
Installation
Download and install VirutalBox on your Windows machine. There is no need to manually configure anything in this installation process, you can just leave everything at default.
On the Kali Linux download-page, make sure you go to "Pre-built Virtual Machines" and select the VirtualBox option. Using a pre-built image will make the OS setup much more easy than with traditional ISO-files. This download might take a while.
Attacker Setup
Downloading the Kali pre-build VM will get you a .ZIP-folder. Extract it to a directory of your choice. Inside you should find a .VBOX-file. Double-click it and the VM will be automatically imported to the VirtulBox Manager.
This machine can now be used out-of-the-box. The login credentials are "kali" and "kali". This is OK because, this is just a training environment, the password does not need to be strong or protected.
If the machine automatically boots up when imported, you can shut it down again. Do this by click "File" in the top bar of the machine windows. Then "Close" and "Power off the machine" -> OK. Alternatively, you can login and shut it down from there normally.
Now you should have the Kali VM in your list, looking something like this: