Stop 03 · Linux & Windows FundamentalsTopics · 10/10

Virtual Machines & Lab Setup

In short

Don't practise attacks or open malware on your daily laptop, and never practise on systems you don't own. A home lab of virtual machines gives you a safe, free place to break things.

Setting up an isolated practice environment — essential for safely practicing offensive techniques, malware analysis, or testing configurations without any risk to real systems.

The blob in goggles mixes a bubbling potion inside a clear glass glove box.

Think of it like this

The chemistry lab glove box

Dangerous experiments happen inside a sealed glass box with built-in gloves. If something explodes, it stays in the box. Virtual machines are that box: whatever you break inside stays inside, and you can reset it in seconds.

Watch it happen

A simple, isolated home lab

Host laptop

Kali VM

Target VM

Internet

snapshot: clean

1/5Your host runs VirtualBox or VMware. Take a snapshot of each VM right after setup.

The big ideas

What you need to know

Hypervisors are free

VirtualBox is free and works on Windows, Linux and Intel Macs. Apple Silicon Macs often use UTM.

Pick the right network mode

Host-only keeps VMs private. NAT gives internet. Bridged puts VMs on your real Wi-Fi, so avoid it for targets.

Snapshots are undo buttons

Snapshot before every risky step. It turns 'I broke it' into a 10-second fix.

Only attack what you own

Your lab, or platforms like TryHackMe and Hack The Box that give you permission. Anything else needs written approval.

See it in code

Walk through the code

bash

1# VirtualBox from the command line2VBoxManage list vms3VBoxManage snapshot "Kali" take "clean-install"4VBoxManage startvm "Kali" --type headless5 6# Later: roll back to the clean state7VBoxManage controlvm "Kali" poweroff8VBoxManage snapshot "Kali" restore "clean-install"

1/2List your VMs, snapshot one called Kali, and start it without a window.

You can do all of this in the VirtualBox window too. The command line is handy for scripting a fresh lab reset.

Save yourself the pain

Common mistakes

Oops

Putting a deliberately vulnerable VM on bridged networking.

Do this instead

Anyone on your Wi-Fi could attack it, and it could be used against others. Keep targets on host-only.

Oops

Giving every VM all your RAM.

Do this instead

Give each VM just enough, usually 2 to 4 GB for Linux, so your host stays usable.

Your mission

Build your first lab

~45 min

Quick check

Which network mode keeps a vulnerable target VM reachable from your Kali VM but not from the internet?

Go deeper

1Install a hypervisor (VirtualBox or VMware) and set up 2-3 practice VMs.
2Learn to configure an isolated (host-only) network for your lab so nothing leaks to the internet accidentally.
3Understand why an isolated lab is non-negotiable before practicing any offensive technique.