Setting up a Lab (Kali / Parrot)

A home security lab is an isolated environment where you can break, study and rebuild systems without breaking the law or your daily-driver computer.

⚠️ Never scan or exploit systems you do not own or have written permission to test.

Windows

powershell
# 1. Install VirtualBox
winget install -e --id Oracle.VirtualBox
# 2. Download Kali OVA from kali.org/get-kali → "Virtual Machines" → "VirtualBox"
# 3. Double-click the .ova file → import into VirtualBox.
# 4. Set Network → Host-only Adapter.

macOS (Intel)

bash
brew install --cask virtualbox
# Then import the Kali OVA via VirtualBox GUI.

macOS (Apple Silicon — M1/M2/M3/M4)

bash
# VirtualBox does not run on ARM. Use UTM (QEMU GUI) instead.
brew install --cask utm
# Download Kali ARM64 ISO from kali.org → New VM in UTM.

Linux (Ubuntu / Debian)

bash
sudo apt update
sudo apt install -y virtualbox virtualbox-ext-pack
# Import the Kali OVA via VirtualBox GUI.

bash
sudo apt update && sudo apt upgrade -y
sudo apt install -y nmap nikto sqlmap hydra hashcat john burpsuite seclists
sudo systemctl disable ssh        # don't expose your lab

   ┌──────────────┐     host-only       ┌──────────────┐
   │   Kali VM    │ ◄──────────────────►│ Metasploitable│
   │ 10.0.0.10    │      192.168.56/24  │ 10.0.0.20    │
   └──────────────┘                     └──────────────┘
           │
           └── No NAT, no bridged — lab cannot reach internet

bash
$ ip addr show eth1
2: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500
    inet 192.168.56.10/24 brd 192.168.56.255 scope global eth1

• Running Kali on bare metal as your daily OS — risky and unnecessary.
• Forgetting to set Host-only networking, leaking attack traffic to the internet.
• Skipping snapshots — one bad exploit and the VM is unusable.

Snapshot, isolate, then attack. Never the other way around.

1. The lab must be isolated (host-only network).
2. Snapshots are non-negotiable — they save hours of rebuild time.
3. The lab is for learning, not for staging attacks against real targets.

1. Install Kali (or Parrot) on your machine using the steps above.
2. Run nmap -sS 127.0.0.1 against the VM itself.
3. Boot DVWA on the host-only network and reach the login page.

1. Always allocate sufficient RAM and CPU to your VMs; under-resourcing cripples performance and frustrates learning.
2. Master snapshot management; they are your most valuable tool for quickly resetting your lab to a known-good state.
3. Understand the implications of bridged, NAT, and host-only networking to secure your lab and control VM access.
4. Regularly update your Kali/Parrot OS and VM tools to ensure you have the latest features, patches, and stability.
5. Document your lab's configuration and every exploit attempt for future reference and to solidify your learning.