Guides

Safe Metasploitable / Vulnerable Home Lab Setup

By Ravindra Bagale, Cyber Security trainer · LinkedIn · Published: 29 September 2026 · Last updated: 30 September 2026

Intentionally vulnerable lab VMs (for example Metasploitable-class images) exist so students can practise discovery and defence on broken-on-purpose systems. This guide covers SAFE SETUP only: host-only or fully isolated networking, snapshots, written scope, and ethics. It does not teach Metasploit modules, payloads, reverse shells, or how to hack Metasploitable services.

Host PC → hypervisor → host-only switch → [analyst VM] + [vuln VM]
Snapshots = undo button
Bridged to LAN / WAN = common disaster
This page = fences + ethics, not attack recipes

What do I need before this guide?

• A PC with enough RAM/disk for two VMs (rough guide: 8 GB+ RAM helps).
• Hypervisor install rights on that PC.
• Willingness to keep notes and obey isolation rules.
• Read first: Nmap ethical basics, course ethics chapter links below.

Why isolation comes before the vulnerable ISO

1. Vulnerable images are meant to be breakable — that is unsafe on a shared network.
2. Worms and scanners on the real internet will find open lab ports if you NAT them carelessly.
3. A host-only network keeps curious traffic inside the hypervisor fence.
4. Snapshots let you return to a known baseline without reinstalling.
5. Written scope trains the same muscle you need for real authorised tests later.
6. If isolation is unclear, do not download the image yet.

What is in scope on this page (and what is not)?

In scope (setup / governance)

1. Hypervisor choice and VM placement.
2. Host-only / internal network configuration (concept + checklist).
3. Snapshot habit and naming.
4. Written lab scope template.
5. Ethics and legal reminders (permission, IT Act awareness at high level).
6. Safe shutdown / wipe when the course ends.

Explicitly out of scope (do not expect steps here)

1. Metasploit msfconsole exploit workflows.
2. msfvenom payloads.
3. Reverse / bind shells.
4. Service-by-service “how to hack Metasploitable”.
5. Privilege escalation attack chains.
6. Bypassing network isolation.

How do I build the safe lab step by step?

Step 1 — Prepare the host

1. Update the host OS.
2. Install hypervisor from the official vendor site.
3. Create a folder labs/vuln-isolated/ for disks and notes.
4. Disable any habit of “I’ll just bridge it for internet apt installs” on the vuln VM.

Step 2 — Create the isolated network

1. In the hypervisor, create a Host-only (or Internal) network with a private CIDR (example documentation range 192.0.2.0/24 style lab addressing — use whatever your hypervisor assigns, but write it down).
2. Do not enable DHCP toward your home LAN.
3. Confirm there is no adapter set to Bridged for the vulnerable VM.
4. Optional: analyst VM may use NAT plus host-only if you need package installs — vulnerable VM stays host-only only.

Step 3 — Import the vulnerable image carefully

1. Download only from the project’s official distribution channel.
2. Verify checksum when the project publishes one.
3. Create the VM with the vulnerable disk attached.
4. Attach only the host-only NIC.
5. Boot once; take snapshot 01-clean-import.

Step 4 — Add an analyst / notes VM (optional but wise)

1. Separate “attacker curiosity” from your everyday laptop browser profile.
2. Keep coursework notes on the analyst VM or host folder — not inside the vuln VM.
3. Snapshot the analyst VM too after tools you are licensed to install for class.

Step 5 — Write the scope sheet (non-negotiable)

Copy this template into a text file:

Lab name: home-vuln-lab-01
Owner: <you>
Hypervisor host: <your PC name>
Network: host-only only — CIDR ________
VMs: analyst-01, vuln-01
Allowed activities: network discovery notes, defensive observation, coursework reading
Forbidden: bridging to LAN/WAN, port-forward to internet, attacking non-lab IPs
Start date: ____  End date: ____
Snapshot baseline: 01-clean-import
Emergency: power off VMs; restore snapshot; ask trainer

Step 6 — Prove isolation before any scanning lesson

1. From the vuln VM, confirm it cannot reach general internet sites (expected fail on host-only).
2. From a LAN PC that is not on the host-only network, confirm you cannot reach the vuln IP.
3. Record both proofs in the scope file with timestamps (IST labelled).
4. Only then schedule authorised discovery practice from other guides/courses.

Step 7 — Snapshot rhythm

1. Before each new experiment week: snapshot 02-before-<topic>.
2. After a messy state: restore rather than “fixing forward”.
3. Keep at least one known-good snapshot you never delete until the course ends.

Real incident theme: unpatched / exposed lab mistakes (lessons from WannaCry-era exposure)

Public worm events such as WannaCry (2017) showed how quickly unpatched, reachable systems become everyone else’s problem. A home Metasploitable VM bridged or port-forwarded “for convenience” can look like another unpatched host on a hostile network. Your care-take is boring on purpose: keep broken labs off the internet.

Takeaways (vertical):

1. Intentionally weak services + public reachability = irresponsible.
2. Isolation is a safety control, not a suggestion.
3. Snapshots beat heroic cleanup.
4. Scope notes prove maturity in interviews more than bold claims.
5. If a cloud host is used for class, lock security groups to your IP and prefer private networking — still no guide to attacking it here.
6. When unsure, power off.

Red Team vs Blue Team (awareness only)

Red Team — temptation (do not follow here)

• Want exploit steps and shells immediately.
• Bridge adapters to “make packages easier”.
• Point tools at random public IPs.

Blue Team / educator posture

• Fences first: network, snapshots, scope.
• Teach detection and reporting courses after isolation is proven.
• Treat the vuln VM like hazardous material: labelled, contained, disposed.

Care-take — ethics that travel with you

1. Permission and isolation beat cleverness.
2. Never upload vuln VMs to random cloud with open ports.
3. Do not share lab IPs in public Discord “join my hacknet” invites.
4. When the course ends: shut down, delete disks or keep offline encrypted archive if policy allows.
5. Indian learners: treat IT Act / permission culture seriously — when unsure, do not scan.
6. Job interviews: describe your isolation design, not alleged exploit trophies from home.

How do I fix common unsafe lab mistakes?

Ghabru naka 😅 — these are the usual ones: