Reading about security only gets you so far; you learn it by doing. The catch is that doing it on systems you don’t own is a crime. A home lab solves this: a small network of virtual machines on your own computer, where you can attack, break, watch and repair things freely. Here is how I would build one from scratch.
The one rule: permission
Only test systems you own or have written permission to test. Scanning a neighbour’s Wi-Fi, a school website or some random server “just to see” is illegal in almost every country, including Uzbekistan, whatever your intentions. Everything in this post stays inside your own computer.
Keep vulnerable machines off your home network and off the internet. They are built to be broken into, by you or by anyone else who can reach them.
What you need
- A computer with hardware virtualisation (Intel VT-x or AMD-V) turned on in the BIOS or UEFI settings. Most machines from the last ten years have it.
- RAM: 16 GB is comfortable. Kali takes 2–4 GB, a small target about 1 GB, a Windows machine 4 GB or more. With 8 GB, run one attacker and one light target at a time.
- Disk: 80–100 GB free, ideally on an SSD.
No extra router, no special hardware, nothing to buy.
Pick a hypervisor
A hypervisor is the program that runs virtual machines. On a laptop or desktop, the simplest choices are VirtualBox (free and open source) and VMware Workstation Pro, which is now free as well; both run on Windows and Linux. If you have a spare PC, Proxmox VE turns it into a dedicated lab server that you manage from the browser. Pick one and stay with it: the ideas are the same everywhere.
Keep the lab isolated
Put every lab machine on a host-only or internal network. In VirtualBox, set the network adapter to “Host-only Adapter” or “Internal Network”: the machines can see each other (and, with host-only, your computer), but not your router or the internet. When the attacker machine needs updates, switch its adapter to NAT for a moment, then back. The vulnerable machines never need the internet at all.
Take a snapshot of every machine while it is clean, and another before each experiment. When something breaks, you roll back in seconds. Snapshots make it safe to try things you don’t fully understand yet, which is the whole point of a lab.
The attacker and the targets
Kali Linux
Kali Linux is your attacker machine: a Debian-based system with hundreds of security tools installed. The Kali website offers ready-made images for VirtualBox and VMware, so there is nothing to install by hand.
Vulnerable targets
These are built to be broken, which makes them perfect practice:
- Metasploitable 2, an old Linux server full of outdated services. Never connect it to a real network.
- DVWA (Damn Vulnerable Web Application), a PHP site with difficulty levels for SQL injection, XSS and other classic web bugs.
- OWASP Juice Shop, a modern online shop with more than a hundred challenges. With Docker it takes one command, bound to your own machine only:
docker run --rm -p 127.0.0.1:3000:3000 bkimminich/juice-shop
Then open http://localhost:3000 in your browser. The 127.0.0.1 part matters: without it, other devices on your Wi-Fi could reach the shop too.
Watching the traffic
Wireshark shows every packet that crosses a network interface. Burp Suite Community Edition sits between your browser and a web application and lets you read and change each request. Both are free, and both teach you more about how the web really works than most courses do.
Your first exercise
Start Kali and Metasploitable 2 on the same host-only network, then on Kali:
# Which address and network am I on?
ip -brief address
# Find the machines in your own lab network
# (192.168.56.0/24 is VirtualBox's default host-only range; use yours)
nmap -sn 192.168.56.0/24
# List the target's open ports and service versions
nmap -sV 192.168.56.101
Read the output slowly. Look up each service and its version: which ones are years out of date, and what is publicly known about them? Pick one and find out how an attacker would abuse it and, just as important, how an administrator would fix it. Then run the scan again with Wireshark open and see what a port scan looks like from the defender’s side.
Practice platforms
When your own lab starts to feel small, these sites give you legal targets on their own infrastructure:
- TryHackMe: guided rooms in the browser, the friendliest start.
- Hack The Box: harder machines, plus HTB Academy courses.
- OverTheWire: free wargames; Bandit teaches Linux basics over SSH.
- PortSwigger Web Security Academy: free, excellent web security labs.
- VulnHub: downloadable vulnerable machines for your own lab.
Keep notes
Write down every command, what it returned, what you thought it meant and what you learned. A folder of Markdown files or an app like Obsidian is enough. Notes turn random poking into real learning, and clean write-ups of retired machines become a portfolio. Just don’t publish solutions for machines that are still active: Hack The Box, for one, forbids it, and it spoils them for everyone else.
