A fully isolated, self-hosted lab for practicing offensive security techniques — built with VirtualBox, Kali Linux, and Metasploitable 2.
This repo documents the full setup process, network architecture, and the core commands/workflows used during practice sessions. Built as part of my ongoing offensive security / pentesting self-study track (working toward eJPT).
This lab is for educational purposes only, run entirely on an isolated virtual network with no internet-facing exposure. Every technique documented here is performed against intentionally vulnerable machines that I own and control.
Do not run these tools or techniques against systems you don't own or don't have explicit written authorization to test. Unauthorized access to computer systems is illegal in most jurisdictions.
pentest-homelab/
├── README.md # You are here
├── LICENSE
├── docs/
│ ├── 01-virtualbox-setup.md # Hypervisor install + networking basics
│ ├── 02-kali-linux-setup.md # Attacker VM setup
│ ├── 03-metasploitable2-setup.md # Victim VM setup
│ ├── 04-network-configuration.md # Host-only network + isolation
│ └── 05-commands-cheatsheet.md # Core commands & workflows
└── journals/
├── journal-01-initial-recon.md
├── journal-02-vsftpd-backdoor.md
├── journal-03-samba-usermap-script.md
├── journal-04-distcc-rce.md
├── journal-05-unrealircd-backdoor.md
├── journal-06-dvwa-sqli.md
├── journal-07-tomcat-manager-war.md
├── journal-08-ingreslock-bindshell.md
├── journal-09-nfs-no-root-squash.md
├── journal-10-mutillidae-command-injection.md
├── journal-11-java-rmi-rce.md
├── journal-12-vnc-no-auth.md
├── journal-13-mysql-weak-creds.md
├── journal-14-telnet-hydra-bruteforce.md
├── journal-15-postgresql-weak-creds.md
├── journal-16-mysql-outfile-webshell.md
├── journal-17-retrospective.md
├── journal-18-ssh-bruteforce.md
├── journal-19-smtp-user-enum.md
├── journal-20-chained-smtp-to-shell.md
├── journal-21-web-enum-gobuster-nikto.md
├── journal-22-post-exploitation-hashdump.md
└── journal-23-retrospective-goad-scoping.md
| Component | Role | Notes |
|---|---|---|
| VirtualBox | Hypervisor | Free, cross-platform |
| Kali Linux | Attacker VM | Official VirtualBox image |
| Metasploitable 2 | Victim VM | Intentionally vulnerable Linux target |
| Host-Only Adapter | Networking | Isolates lab traffic from host LAN/internet |
| Nmap, Metasploit Framework, Searchsploit, Gobuster, Nikto | Toolset | Bundled with Kali |
Optional additions (not covered in depth here, but drop-in compatible with the same network):
- OWASP Juice Shop / DVWA — web app exploitation practice
- Windows 7/10 target VM — SMB/AD-adjacent practice
- pfSense — for simulating a segmented/routed network instead of flat host-only
┌─────────────────────────────┐
│ Host Machine │
│ (VirtualBox installed) │
└──────────────┬────────────────┘
│
Host-Only Network (vboxnet0)
192.168.56.0/24
│
┌───────────────────────────┼───────────────────────────┐
│ │
┌───────▼────────┐ ┌─────────▼─────────┐
│ Kali Linux │ ── attacks / scans ──► │ Metasploitable 2 │
│ 192.168.56.10 │ │ 192.168.56.20 │
│ (Attacker) │ ◄── responses ── │ (Victim) │
└───────┬─────────┘ └────────────────────┘
│
NAT adapter (2nd NIC, updates/tool-downloads only —
never used to route traffic to the victim VM)
Full breakdown of adapters, IP scheme, and why Metasploitable 2 should only ever have a Host-Only adapter: see docs/04-network-configuration.md.
- Install VirtualBox + create the host-only network
- Set up Kali Linux (attacker VM)
- Set up Metasploitable 2 (victim VM)
- Wire up networking + verify connectivity
- Run through the commands cheatsheet
- Log your sessions in
journals/as you go
Write-ups from actual practice sessions in this lab — recon findings, exploitation steps, what worked, what didn't. Kept in a consistent format so they're easy to skim later or lift into a portfolio/resume.
| Journal | Focus |
|---|---|
| journal-01 | Initial recon & full service mapping |
| journal-02 | vsftpd 2.3.4 backdoor exploitation |
| journal-03 | Samba usermap_script RCE |
| journal-04 | distcc remote code execution |
| journal-05 | UnrealIRCd 3.2.8.1 backdoor |
| journal-06 | Manual SQL injection on DVWA (Burp + sqlmap) |
| journal-07 | Tomcat manager default creds → WAR deployment RCE |
| journal-08 | Pre-existing ingreslock root bindshell |
| journal-09 | NFS no_root_squash privilege escalation |
| journal-10 | Mutillidae command injection, chained into Journal 9's privesc |
| journal-11 | Java RMI registry RCE |
| journal-12 | VNC weak/default password → GUI access |
| journal-13 | MySQL empty root password & credential audit |
| journal-14 | Telnet credential brute force with Hydra |
| journal-15 | PostgreSQL default credentials → OS command exec |
| journal-16 | SSH brute force & comparison with Telnet |
| journal-17 | Retrospective: patterns across all 15 sessions |
| journal-18 | SSH brute force & comparison with Telnet |
| journal-19 | SMTP user enumeration via VRFY/EXPN |
| journal-20 | Shell, same accounts, proper sequencing |
| journal-21 | Web Enumeration Baseline: Gobuster & Nikto Before Touching a Specific App |
| journal-22 | Post-Exploitation Depth: Meterpreter, Hashdump, and Offline Cracking |
| journal-23 | Closing Out Metasploitable 2, Scoping GOAD |
- Practicing the recon → enumeration → exploitation → post-exploitation workflow
- Getting comfortable with Nmap scan types and output interpretation
- Learning Metasploit Framework (
msfconsole) fundamentals - Manual exploitation of known CVEs on Metasploitable 2 (vsftpd backdoor, distcc, Samba, etc.)
- Practicing enumeration of common services (FTP, SSH, SMB, HTTP, MySQL)
- Building muscle memory for the eJPT exam format
- TryHackMe
- Hack The Box
- PortSwigger Web Security Academy
- OverTheWire: Bandit
- Metasploit Unleashed
- Exploit-DB
MIT — see LICENSE.