In this article, I will demonstrate how to create your own virtual penetration testing lab at home. Creating a pentesting lab is must for learning different testing tools and hacks out of legal trouble because hacking into other computers and networks where you don’t have rights to access is illegal without prior consent so having your own lab that replicates someone else’s environment is a perfect platform to practice hacking and security testing skills.

Moreover, when you perform security testing on a system, there is a chance of severe damage that can permanently delete the data of targeted device or destroy the target computer or network but in your own pentesting lab you will have complete control over environment for testing and you can also configure the target to the exact specifications needed for the test.

Having said that, creating your own pentesting lab is easier if you are working on a virtual environment as it is cost-effective as well as scalable. So these are some prerequisites before creating your own pentesting lab:

1. Virtualization should be enabled on the processor
2. VirtualBox or VMware must be installed
3. Atleast 8GB RAM of the host machine is required

In our setup, we will configure one attacking machine (Kali Linux) and three target machines (DVWA, MetaSploitable and Windows10) on which the attacking machine will generate some exploits

Kali Linux

Kali Linux is a Debian based Linux distribution designed for penetration testing. In this setup it will be our attacking machine because it has some pre-installed penetration testing tools i.e. (Wireshark, Aircrack-ng, BeEF, Burp Suite, Metasploit Framework, Hydra, Nikto, Maltego, Nmap) aid the pen-testers to gather information, perform scanning and find some vulnerabilities.

MetaSploitable

MetaSploitable is a virtual machine that is an intentionally vulnerable version of Ubuntu Linux specifically designed for penetration testing learners to test security tools and exploit common vulnerabilities. This project is created and maintained by rapid7 Community, Originally design for Metasploit Framework testing.

Installation of MetaSploitable

To install MetaSploitable in VirtualBox download the MetaSploitable file from https://sourceforge.net/projects/metasploitable/files/Metasploitable2/

Open up VirtualBox and create a new VM by selecting ‘Machine’ and choosing the option ‘New’

Type name of the VM, set the destination where you want to install this VM, set the Type as Linux and version as Ubuntu(64-bit)

Set the memory size

Use existing virtual hard disk file

Attach the vmdk file that you already downloaded

Now start the VM

After rebooting it will ask for login credentials. The default username and password are “msfadmin”

After logging in successfully you will get the MetaSploitable prompt

DVWA

Damn Vulnerable Web Application (DVWA) is a PHP/MySQL web application that provides a platform to practice hacking. It is the best platform for beginners to come and practice security tools because it is damn vulnerable as mentioned in its name.

As hacking is an illegal practice there is a requirement for security professionals to test their skills and tools in a legal environment and help web developers better understand the processes of securing web applications. This could be achieved by using DVWA that is got a lot of vulnerabilities, helps the beginners to learn and practice ethical hacking.

It runs on a local server hence there is no need for an internet connection to use this web application. It has different security levels as a beginner, intermediate, and expert to aid security professionals at every stage of learning.

Stages to Install DVWA

We are using Kali Linux operating system to install DVWA because this OS is designed for penetration testing and there are many pre-installed security tools present in Kali Linux. After that you require to configure a database

STAGE 01: Install DVWA on Kali Linux

Go to web browser in Kali Linux and search the link github.com/ethicalhack3r/DVWA to copy the address

Now go to terminal and switch the directory to /var/www/html/ because all the files need to be installed in this directory to run the web application

After switching the directory type git clone and paste the address that you have copied from browser

The DVWA file has successfully cloned

Type ‘ls’ to see DVWA directoy

Give this directory all the permissions by typing “chmod –R 777 DVWA/”

Switch the config DVWA/config directory to set the configuration

Type ls to see the config file

This is the default configuration file. Make a copy of this file to keep the default configuration file that will help you to restore if you have made some mistakes while configuring this file.

Now go to nano editor to edit the configuration

In the editor set the username and password of your choice, save it and exit the editor

STAGE 02: Configure the MYSQL Database

Start the service

Login to mysql as root

Create a new user in a database as:

• Create user ‘user’@’127.0.0.1’ identified by ‘321;

The username and password should be the same as you have entered in the configuration file of DVWA

Give user all the privileges over the database:

• grant all privileges on dvwa.* to ‘user’@127.0.0.1’ identified by ‘321’;

Now exit the database

STAGE03: Configure the Apache Server

First, start the service

Switch to the directory /etc/php/7.3/apache2/ where the configuration file is present that we have to configure

Type ls to see the file i.e. php.ini

Use the editor to set the configuration in the php.ini file. I am using gedit editor

Set the two highlighted parameter on i.e. allow_url_fopen = On and allow_url_include = On

Save the file, exit the editor and then start the apache service

Now open the browser and access the web application by typing 127.0.0.1/DVWA/ (because we are running this application on a local server)

When accessing the application for the first time you will be redirected to this setup page where it is showing the configuration of web application

Scroll down and select “Create/Reset Database” to create a database

Now finally you will see a login page of DVWA that requires credentials to enter. Default username is “admin” and password is “password”

After logging in you will see a home page of DVWA that is showing some instructions and warnings. In the left-most corner, there are different vulnerabilities showing that can be exploited.

Windows

The third target machine is set to be Windows 10 as we will create an environment that will target Linux as well as Microsoft operating system.

Creating Windows VM in VirtualBox is easy because we don’t need to have a product key and can download the ISO file from Microsoft using the Windows Media creation tool.

Go to the link https://www.microsoft.com/en-us/software-download/windows10 and select ‘Download tool now’ option

Download the ISO file from here and then create a VM on VirtualBox:

1. Set name, destination, type, and version
2. Set the memory size
3. Create the virtual hard drive
4. Set hard disk file type as VDI
5. Set storage on a physical device as dynamically allocated
6. Select the size of virtual hard disk
7. From settings go to Storage tab and select Controller: IDE, select Empty and from the rightmost corner select the tiny CD icon from where you can browse the ISO file that you have downloaded on your PC. Select the image file
8. Start the VM and configure

So we have created all the VMs and set up the penetration testing environment successfully!

Use Kali Linux to scan the target and exploit many vulnerabilities present in DVWA, MetaSploitable, and Windows machines, generate some attacks for example: Brute Force, SQL Injection, CSRF, and many more to let you start your Capture the Flag journey.