VirtualBox: How to set up a Basic Pentesting Lab

Introduction

Training penetration testing typically occurs in a dedicated environment known as a pentesting lab, which is isolated from regular user applications and operating systems for security and convenience. A pentesting lab can vary in complexity, with a minimalist setup involving a single computer running multiple virtual machines (VMs), often referred to as a virtual or basic pentesting lab. This variant uses virtualization software like VMware or VirtualBox to create an attacker VM with a specialized OS, such as Kali, Parrot or Arch, and allows for the addition of target machines. These machines are then consolidated in a virtual network. Users can log into the attacker machine to begin testing. More advanced labs may incorporate real hardware, such as real computers, routers, and firewalls, but this increases costs and electricity usage. However, these sophisticated environments enable more realistic scenarios and complex tasks.

This page explains how a basic pentesting lab that can be set up with VirtualBox. This environment will suffice for most people who want to try out or train pentesting and hacking at home. The system will consist of a base machine at performs the actual operations (the attacker machine) and arbitrary target machines, the user can add and remove at will.

The software used in this tutorial:

Windows 10 or 11 (as the Host OS)
VirtualBox
Kali Linux

Setup Steps

Installation

Download and install VirutalBox on your Windows machine. There is no need to manually configure anything in this installation process, you can just leave everything at default.

On the Kali Linux download-page, make sure you go to "Pre-built Virtual Machines" and select the VirtualBox option. Using a pre-built image will make the OS setup much more easy than with traditional ISO-files. This download might take a while.

Attacker Setup

Downloading the Kali pre-build VM will get you a .ZIP-folder. Extract it to a directory of your choice. Inside you should find a .VBOX-file. Double-click it and the VM will be automatically imported to the VirtulBox Manager.

This machine can now be used out-of-the-box. The login credentials are "kali" and "kali". This is OK because, this is just a training environment, the password does not need to be strong or protected.

If the machine automatically boots up when imported, you can shut it down again. Do this by click "File" in the top bar of the machine windows. Then "Close" and "Power off the machine" -> OK. Alternatively, you can login and shut it down from there normally.

Now you should have the Kali VM in your list, looking something like this:

Network Configuration

The goal is to create a testing network that is separated from the host OS. The easiest way to do this is by creating a virtual network that only contains the attacker and target machines. This can be achieved by setting up a DHCP-service within VirtualBox, that automatically assigns IP-addresses to the VMs when booted up.

Open the windows command prompt and navigate to the VirtualBox installation directory. By default this is C:\Program Files\Oracle\VirtualBox. Now use the vboxmanage tool to create the DHCP server:

vboxmanage dhcpserver add --network=sparta --server-ip=172.16.0.1 --lower-ip=172.16.0.2 --upper-id=172.16.0.100 --netmask=255.255.255.0 --enable

You can also choose other settings for you network, but make sure to private IP addresses. If you don´t know what values to pick, you can just copy this command.