18. Ethics, the Law and a Safe Kali Lab
18.4 Building a Safe, Isolated Lab
Aata maja cha bhag – swatacha lab! Niyam ek: vulnerable machines kadhi internet la joddu naka. Metasploitable 2 mhanje jaanun-bujun kamjor banvlela server aahe – to bridged network var thevla tar kahi minutat tovunach hack hoto. Aapan host-only network vapru: fakt tumcha laptop aani lab VMs ekmekanshi bolu shaktil, baher konashi nahi.
Software you install on your own laptop (host): VirtualBox (free) or VMware. Then these VMs:
| VM | What it is | Default login (lab only) |
|---|---|---|
| Kali Linux | Your attacker machine (all tools preinstalled) | kali / kali (change it) |
| Metasploitable 2 | A deliberately vulnerable Linux server | msfadmin / msfadmin |
| DVWA | Damn Vulnerable Web Application (web bugs) | admin / password |
| OWASP Juice Shop | A modern vulnerable web app (OWASP Top 10) | register your own account |
DVWA and Juice Shop can run inside Metasploitable-style VMs, or on their own small Linux VM, or in Docker on a lab VM. Whatever you choose, keep every one of them on the host-only adapter.
┌─────────────── Your laptop (host) ───────────────┐
│ VirtualBox host-only network 192.168.56.0/24 │
│ │
│ Kali .10 ──► Metasploitable2 .20 │
│ │ ──► DVWA / Juice Shop .30 │
│ └────────── NO route to the internet or LAN │
└───────────────────────────────────────────────────┘
Set it up (VirtualBox example):
- Install VirtualBox on your laptop. File → Host Network Manager → Create a host-only network (e.g.
192.168.56.0/24, DHCP on). - Import the Kali VirtualBox image from kali.org, and the Metasploitable 2 image. Import/build DVWA and Juice Shop.
- For every lab VM: Settings → Network → Adapter 1 → Host-only Adapter. Metasploitable, DVWA and Juice Shop should have no NAT/bridged adapter at all.
- Kali may have a second adapter set to NAT only when you need to update Kali – turn it off again before attacking the lab.
- Take a snapshot of each VM once it is clean, so you can roll back after breaking things.
# on Kali, confirm you are on the lab network and find your lab machines
ip a # should show 192.168.56.x
ip route # no default route = no internet (good for attack mode)
Why this matters for security
Isolation is the whole point. A host-only network means your intentionally-broken machines cannot be reached from the internet and cannot be used as a launch pad against anyone else. This is also how real security teams build "detonation" labs for malware and testing.
Ravindra Bagale's Tip
Metasploitable 2 la bridged adapter lavun "internet var test karto" mhanun students to jagacha samor ughda thevtat – to kharokhar hack hoto aani tumcha laptop pan dhokyat yeto. Kadhi nahi! Vulnerable VM = fakt host-only. Update sathi fakt Kali la tatpurta NAT dya, mag band kara.
Lab
Create the host-only network, attach Kali and Metasploitable 2 to it, and from Kali run ping 192.168.56.20 (works) and ping 8.8.8.8 (should fail in attack mode). Take a clean snapshot of each VM.