Last reviewed 7 min read

Beginner

Vulnerable Virtual Machines

Downloadable vulnerable VMs to practice exploitation techniques locally. Perfect for offline learning and building foundational skills.

Getting Started

Use VirtualBox or VMware to run these VMs. Put every VM — attack and target — on the same host-only network, or on a VirtualBox "NAT Network" if you need DHCP. Do not use plain NAT: it puts each VM behind its own isolated NAT, so your Kali box cannot reach the target. Never connect vulnerable VMs to the internet.

Image Freshness And Integrity

Prefer current official downloads, verify checksums when provided, and snapshot before first boot. If a VM is unmaintained or ships an end-of-life operating system, keep it host-only and use it only for legacy technique practice.

Isolate First

Host-only keeps Kali and the targets on one segment your LAN cannot route to. The distinction that trips people up: plain NAT carries each guest out through the host and cannot do VM-to-VM traffic, while a NAT Network is a private segment with DHCP and outbound access. Pick one deliberately — plain NAT gives you neither isolation nor reachability.

Network type
Host-only adapter (a NAT Network if you need DHCP)
Lab network
lab-vms
Subnet
10.20.20.0/24

IP plan

Role IP
Kali attack VM (Kali) 10.20.20.10
Target VM A 10.20.20.21
Target VM B 10.20.20.22

Create it

VirtualBox (VBoxManage)

# hostonlyif create prints the vboxnetN name — use that name below
VBoxManage hostonlyif create
VBoxManage hostonlyif ipconfig vboxnet0 --ip 10.20.20.1 --netmask 255.255.255.0
VBoxManage dhcpserver remove --netname HostInterfaceNetworking-vboxnet0
# attach each VM to it instead of the default NAT adapter
VBoxManage modifyvm "Kali" --nic2 hostonly --hostonlyadapter2 vboxnet0
VBoxManage modifyvm "Target" --nic1 hostonly --hostonlyadapter1 vboxnet0

VMware, Hyper-V or KVM

# VMware: Virtual Network Editor > Add Network > Host-only, 10.20.20.0/24, DHCP off
# Hyper-V: New-VMSwitch -Name lab-vms -SwitchType Internal; then assign 10.20.20.1/24 to vEthernet (lab-vms)
# KVM: <forward mode='none'/> network on 10.20.20.0/24 (virsh net-define / net-start)

Prove it is isolated

nmap -sn 10.20.20.0/24; ip -4 route

Expected: only the lab VMs answer the scan, and the host-only adapter owns only 10.20.20.0/24. A 192.168.x host in the result, or a default route on that adapter, means the target is reachable from your home LAN.

Never bridge a vulnerable target VM — it will be scanned and exploited from your home network within hours, not days.

Lab Runbook

Use this page as a controlled lab build, not a production hardening guide. Prove the network is isolated before running exercises, then validate and clean up from the operational section at the end of the page.

Medium risk Beginner 30-90 min

Plan

4-12 GB; 40-120 GB. Free. Isolation: Host-only or internal network; never bridged to home LAN.

Outcomes

  • - Target inventory
  • - Known IP plan
  • - Connectivity from Kali
  • - Clean rollback snapshot

Web Application Practice

DVWA

Beginner

Damn Vulnerable Web Application - PHP/MySQL app with multiple security levels.

  • ✓ SQL Injection
  • ✓ XSS (Reflected, Stored, DOM)
  • ✓ Command Injection
  • ✓ File Upload
  • ✓ CSRF
  • ✓ Brute Force
docker run --rm -it -p 127.0.0.1:8081:80 ghcr.io/digininja/dvwa
GitHub →

bWAPP

Beginner

Buggy Web Application - Over 100 web vulnerabilities to exploit.

  • ✓ OWASP Top 10 coverage
  • ✓ 100+ vulnerabilities
  • ✓ API Security issues
  • ✓ XML/XXE attacks
docker run -d -p 127.0.0.1:8082:80 raesene/bwapp

Unmaintained: the bWAPP project is archived and the raesene/bwapp image has not been rebuilt since 2022. Pin the image digest, keep it host-only, and prefer DVWA, WebGoat or Mutillidae II for current practice.

itsecgames.com →

OWASP WebGoat

Intermediate

Java-based vulnerable app with guided lessons for each vulnerability type.

  • ✓ Guided lessons
  • ✓ Modern vulnerabilities
  • ✓ JWT attacks
  • ✓ Client-side security
docker run -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 webgoat/webgoat
OWASP WebGoat →

OWASP Juice Shop

Intermediate

Modern Node.js app with 100+ challenges covering OWASP Top 10 and beyond.

  • ✓ CTF-style challenges
  • ✓ Score tracking
  • ✓ Modern tech stack
  • ✓ API + SPA vulnerabilities
docker run --rm -p 127.0.0.1:3000:3000 bkimminich/juice-shop
OWASP Juice Shop →

Network & System Exploitation

Metasploitable 2

Legacy

Classic vulnerable Linux VM for learning fundamentals. Treat it as legacy practice, not a model for modern enterprise exposure.

  • ✓ Vulnerable services
  • ✓ Weak configurations
  • ✓ Metasploit modules
  • ✓ Privilege escalation
Download from SourceForge →

Metasploitable 3

Legacy

Windows and Linux VMs with useful practice paths, but old operating systems and provisioning assumptions.

  • ✓ Windows Server 2008
  • ✓ Ubuntu 14.04
  • ✓ CTF-style flags
  • ✓ Vagrant provisioning
GitHub →

VulnHub VMs

Various

Hundreds of community-created vulnerable VMs, many with walkthroughs available.

  • ✓ Kioptrix series (beginner)
  • ✓ Mr. Robot (intermediate)
  • ✓ Stapler (intermediate)
  • ✓ Brainpan series (advanced)
vulnhub.com →

HackTheBox Retired

Various

Download retired HTB machines for offline practice (VIP subscription).

  • ✓ Real-world scenarios
  • ✓ Official walkthroughs
  • ✓ Windows & Linux
  • ✓ Various difficulties
hackthebox.com →

HackMyVM

Various

Free community-driven platform with actively maintained VMs, flag submission, and leaderboards. The modern alternative to VulnHub.

  • ✓ Actively maintained (new VMs weekly)
  • ✓ Flag submission & scoring
  • ✓ Difficulty ratings
  • ✓ Walkthroughs available
hackmyvm.eu →

Proving Grounds

Various

OffSec's official practice platform. PG Play is free with community VMs. PG Practice for OSCP prep.

  • ✓ PG Play (free tier)
  • ✓ PG Practice (paid, OSCP-like)
  • ✓ Community & OffSec-made machines
  • ✓ Windows & Linux targets
offsec.com/labs →

Quick Setup Script

Launch multiple vulnerable apps using Docker Compose: 

# docker-compose.yml for vulnerable lab
services:
  dvwa:
    image: ghcr.io/digininja/dvwa
    ports:
      - "127.0.0.1:8081:80"
    
  juice-shop:
    image: bkimminich/juice-shop
    ports:
      - "127.0.0.1:3000:3000"
    
  webgoat:
    image: webgoat/webgoat
    ports:
      - "127.0.0.1:8080:8080"
      - "127.0.0.1:9090:9090"
    
  bwapp:
    image: raesene/bwapp   # unmaintained since 2022 - pin the digest, host-only only
    ports:
      - "127.0.0.1:8082:80"

# Run with: docker compose up -d
# Verify:  curl -s http://localhost:3000 | head -5

Troubleshooting FAQ

Can't reach vulnerable VM from Kali
  • Both VMs must be on the same network (host-only or NAT network)
  • Check IPs: ip addr on both machines
  • Try pinging from each direction to isolate the issue
  • VirtualBox: use "NAT Network" (not just "NAT") for VM-to-VM communication
VulnHub OVA import failing
  • Try importing with "Import Appliance" not drag-and-drop
  • If checksums fail, re-download the OVA
  • Some OVAs are VMware-only — convert with qemu-img convert
  • VirtualBox: uncheck "Import hard drives as VDI" if import fails
Docker container crashes immediately
  • Check logs: docker logs container_name
  • Port already in use: change host port (-p 9080:80)
  • Out of disk: docker system df and docker system prune
  • Architecture mismatch on Apple Silicon: add --platform linux/amd64

Readiness And Evidence

What this lab must have before you start, and what to capture so the work is repeatable and reportable.

Minimum Viable Setup

  • One Kali VM and one vulnerable target VM
  • Host-only or internal network only
  • Target snapshot before exploitation

Evidence To Capture

  • VM network mode screenshot
  • Target checksum or source URL note
  • Nmap service scan from Kali
  • Snapshot name before first exploit

Keep It Fresh

Re-check these against the current release before you trust the lab again.

  • VM images Before download

    Prefer official pages and verify checksums when available.

  • Legacy targets Per exercise

    Label old OS images as archival practice.

Setup Anti-Patterns

Habits that turn a useful lab into an unnecessary risk.

  • Bridging vulnerable VMs onto home or work networks
  • Trusting old OVA mirrors without integrity checks
  • Treating legacy VMs as modern enterprise examples

Operational Safety Baseline

Apply these rules before running any lab command on this page.

  • Work only on systems you own or have explicit authorization to test.
  • Keep vulnerable services off your home LAN and off public interfaces.
  • Take clean snapshots before every exercise and before every vulnerable configuration change.
  • Use dedicated cloud accounts, subscriptions, and projects with billing alerts before deployment.
  • Write down the teardown command before you run the setup command.

Validation Checkpoints

  • -Kali and target share only the lab network
  • -Nmap sees expected services
  • -Snapshots exist before exploitation

Cleanup And Rollback

  • -Revert target snapshots after compromise
  • -Delete stale OVAs from downloads
  • -Document any custom target changes

Practice Next

Internal Pentest Turn target discovery into an internal assessment workflow. Network Security Compare vulnerable service exposure with defensive baselines.

Related Topics

Kali Linux Setup

Configure your attack machine

Active Directory Lab

Build a Windows domain for testing

Web Pentest Guide

Learn web exploitation techniques

Burp Suite Cheatsheet

Web proxy reference