Setting Up a Hacking Lab: Build Your Own Safe Practice Environment

Understanding hacking lab setup is the foundation of this guide. Below we break it down step by step so you can act with confidence.

A hacking lab is your safe, legal environment to practice everything you learn. You cannot become skilled at security without hands-on practice, and practicing on systems you do not own is a crime. Your lab gives you targets to attack, tools to attack them with, and the freedom to break things without consequences.

This lesson walks you through building a complete lab from scratch: installing VirtualBox, setting up Kali Linux, deploying intentionally vulnerable machines, and configuring the network so everything talks to each other safely.

Hacking Lab Setup: Lab architecture overview

Your lab needs three components:

1. Hypervisor — VirtualBox (free) or VMware Workstation. Runs virtual machines on your computer.
2. Attack machine — Kali Linux with all security tools pre-installed.
3. Target machines — Intentionally vulnerable systems to practice on: Metasploitable, DVWA, OWASP WebGoat, HackTheBox.

All machines run on an isolated internal network — nothing touches the internet or your real network.

# Download from https://www.virtualbox.org/
# Windows: run the .exe installer
# Mac: open the .dmg and drag to Applications
# Linux:
$ sudo apt update
$ sudo apt install virtualbox virtualbox-ext-pack

# Verify installation:
$ vboxmanage --version
7.0.14r161104

VirtualBox → File → Host Network Manager → Create
Name: vboxnet0
IPv4 Address: 192.168.56.1
IPv4 Mask: 255.255.255.0
DHCP Server: Enabled (range 192.168.56.100-200)

All lab VMs will use this network — isolated from your real LAN.

# Download pre-built VM from https://www.kali.org/get-kali/
# Choose 'Virtual Machines' → VirtualBox (64-bit)
# File is ~3 GB, extracts to ~8 GB

# Import into VirtualBox:
# File → Import Appliance → select the .ova file
# Settings: 4 GB RAM, 2 CPU cores minimum

# Network: Adapter 1 = NAT (internet access)
#          Adapter 2 = Host-only (vboxnet0)

# Default credentials: kali / kali
# First thing: change the password!
$ passwd kali

Installing vulnerable target machines

You need machines to attack. These are intentionally vulnerable — designed for learning:

# Download Metasploitable 2:
# https://sourceforge.net/projects/metasploitable/
# Extract the .vmdk file

# In VirtualBox: New → Name: Metasploitable2
# Type: Linux, Version: Ubuntu 64-bit
# RAM: 1024 MB, Use existing disk → select the .vmdk
# Network: Host-only Adapter (vboxnet0)

# Boot it up. Login: msfadmin / msfadmin
# Check its IP:
$ ifconfig
eth0: inet addr:192.168.56.101

# From Kali, verify connectivity:
$ ping 192.168.56.101

# Quick scan — see what's exposed:
$ nmap -sV 192.168.56.101
PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         vsftpd 2.3.4
22/tcp   open  ssh         OpenSSH 4.7p1
23/tcp   open  telnet      Linux telnetd
80/tcp   open  http        Apache httpd 2.2.8
3306/tcp open  mysql       MySQL 5.0.51a
5432/tcp open  postgresql  PostgreSQL 8.3
# Every one of these has known vulnerabilities!

Setting up DVWA and OWASP WebGoat

For web application security practice, DVWA (Damn Vulnerable Web Application) and OWASP WebGoat are essential:

# On your Kali VM (or a separate Ubuntu VM):
$ sudo apt update && sudo apt install docker.io -y
$ sudo systemctl start docker

# Run DVWA:
$ sudo docker run -d -p 80:80 vulnerables/web-dvwa

# Access at http://localhost/login.php
# Username: admin  Password: password
# Go to DVWA Security → set to 'Low' to start

# OWASP WebGoat:
$ sudo docker run -d -p 8080:8080 webgoat/webgoat
# Access at http://localhost:8080/WebGoat

# OWASP Juice Shop (modern, realistic):
$ sudo docker run -d -p 3000:3000 bkimminich/juice-shop
# Access at http://localhost:3000

# List running containers:
$ sudo docker ps
CONTAINER ID  IMAGE                    PORTS
a1b2c3d4      vulnerables/web-dvwa     0.0.0.0:80->80/tcp
e5f6g7h8      webgoat/webgoat          0.0.0.0:8080->8080/tcp
i9j0k1l2      bkimminich/juice-shop    0.0.0.0:3000->3000/tcp

Online practice platforms

Beyond your local lab, these platforms offer legal targets with increasing difficulty:

• TryHackMe (tryhackme.com) — guided rooms with step-by-step instructions. Best for beginners.
• HackTheBox (hackthebox.com) — realistic machines from easy to insane. The gold standard for practice.
• PicoCTF (picoctf.org) — beginner-friendly CTF with permanent challenges.
• PortSwigger Web Security Academy (portswigger.net) — free web security labs from the makers of Burp Suite.
• VulnHub (vulnhub.com) — downloadable vulnerable VMs for your local lab.

Start with TryHackMe's 'Complete Beginner' path, then move to HackTheBox when you are comfortable with the basics.

When evaluating hacking lab setup, start with the fundamentals: what problem it solves, who it serves, and how it compares to the alternatives buyers consider first.

Start with the fundamentals. Define who you are serving, the single outcome you want, and the budget you are comfortable committing before you compare any options.

A practical rule is to favour clarity over cleverness. The choice that is easiest to understand, spell, remember and act on tends to win over the long run.

Context changes the answer. What is optimal for a fast-moving startup is rarely optimal for an established brand, so weigh your own stage, market and ambitions.

Avoid the common mistakes: rushing the decision, copying competitors blindly, and ignoring the total cost of ownership beyond the very first year of use.

Think in terms of trade-offs rather than a single perfect answer. Every option trades memorability, cost, reach and flexibility in a slightly different mix.

Document your reasoning. Writing down why you chose one path makes it far easier to revisit the decision later and to explain it to partners and investors.

Test with real people. A quick check with a handful of your actual customers will surface problems that no amount of internal debate ever reveals.

Plan for growth. The option that fits today should still make sense when your audience, catalogue or team is several times larger than it is right now.

Frequently asked questions

How much RAM do I need for a hacking lab?

Minimum 8 GB for Kali + one target. 16 GB lets you run 3-4 VMs comfortably. If you have only 8 GB, use Docker containers instead of full VMs for targets — they use much less memory.

Can I use my regular computer or do I need dedicated hardware?

Your regular computer works fine. VirtualBox runs on Windows, Mac, and Linux. The VMs are isolated from your host OS. For heavy lab work, an SSD makes a big difference in VM boot times.

Is it safe to run vulnerable machines on my network?

Yes, IF you use Host-only networking (vboxnet0). This creates an isolated network that only your VMs can see. Never put vulnerable machines on your real network or bridge them to your LAN — an attacker could find them.