Build a Safe Cybersecurity Home Lab

Step 1: Plan the lab and its isolation

You need three kinds of machines: an attacker or analyst machine, one or more intentionally vulnerable targets, and optionally a defensive machine such as a log server. Place them on a host-only or internal virtual network, which connects the virtual machines to each other and to your host but not to the internet or your physical LAN. Give the attacker machine a second network adapter only when it needs downloads, and disconnect it before starting practice.

Host computer
  |
  +-- Host-only network 192.168.56.0/24  (no route to the internet or your LAN)
        |-- Attacker VM      (for example Kali Linux)
        |-- Target VM        (intentionally vulnerable)
        |-- Defender VM      (log server or SIEM, optional)

Step 2: Install a hypervisor

Use a free hypervisor such as VirtualBox or VMware Workstation Player or Fusion. Create a host-only network in its settings and attach each lab VM to it. Take a snapshot of every VM in a clean state, so you can restore it instantly after you break something, which you will.

Step 3: Add an attacker machine

Kali Linux is a Debian-based distribution maintained by OffSec that ships with many security tools, and it provides ready-made virtual machine images on its website. Any Linux distribution works, since most tools can be installed with the package manager. Download images only from official sites and verify the published checksums.

# verify a downloaded image against the published checksum (Linux/macOS)
sha256sum kali-linux-*.7z

# on Windows PowerShell
Get-FileHash .\kali-linux-*.7z -Algorithm SHA256

Step 4: Add intentionally vulnerable targets

Metasploitable is a deliberately insecure virtual machine built for practice, and it must stay on the host-only network because it can be compromised trivially. OWASP Juice Shop is a modern deliberately vulnerable web application you can run in a container. Run it bound to the loopback address so only your own machine can reach it. Treat every practice target as hostile software: no personal data, no shared folders, no real credentials.

docker run --rm -d --name juice -p 127.0.0.1:3000:3000 bkimminich/juice-shop
# browse to http://127.0.0.1:3000

# when finished
docker rm -f juice

Step 5: Verify the isolation

Before practicing, prove the lab cannot leak. From a target VM, try to reach the internet and your home router, and confirm both fail. Check that no VM uses bridged networking, which would put it directly on your LAN. Keep the host operating system updated, because a compromised VM tries to escape to the host.

ping -c 2 8.8.8.8          # should fail from a target VM
ping -c 2 192.168.1.1      # your home router: should fail
ip addr                    # confirm only the host-only address is present

Step 6: Keep records and follow lab habits

Keep a notes file for every exercise: the goal, the commands run, what happened, and what you learned. Snapshot before risky steps. Add more machines as you grow: a Windows VM for event logs, a Wazuh server for detection, and a firewall VM for segmentation practice. Platforms such as TryHackMe and Hack The Box offer hosted, authorized practice environments if you prefer not to run everything locally.