A home lab gives you legal, safe targets to practice every technique on this wiki. The golden rule: keep it isolated so nothing escapes to your real network.
Components
| Piece | Role |
|---|---|
| Kali / Parrot VM | Attacker box (your tools) |
| DVWA | Deliberately vulnerable web app |
| Metasploitable 2/3 | Vulnerable Linux target |
| VulnHub images | Boot-to-root practice boxes |
| Hack The Box / TryHackMe | Hosted targets (no local setup) |
Network isolation
Critical: put all lab VMs on a Host-Only or isolated internal network — never bridged to your LAN. This prevents an exploited VM from reaching real devices.
VirtualBox/VMware → Host-Only Adapter (e.g. 192.168.56.0/24)
Snapshot each VM clean BEFORE attacking → revert after.Quick DVWA via Docker
docker run --rm -it -p 127.0.0.1:8080:80 vulnerables/web-dvwa
# browse http://127.0.0.1:8080 (admin / password), set security to Low → HighWorkflow: snapshot → attack → loot → revert. Start with Web App Penetration Testing Cheat Sheet against DVWA, then Metasploit Framework Basics against Metasploitable. Track findings with the CTF Methodology and Writeup Template.