How To Build a Safe Penetration Testing Lab
Overview
Before using tools such as Nmap, Metasploit, Netcat, Burp Suite, or Wireshark, you need a safe environment where you can practice legally and ethically.
Throughout the Root Notebook Field Guides, we’ll reference this lab when demonstrating reconnaissance, enumeration, vulnerability assessment, exploitation, and post-exploitation techniques. Rather than targeting production systems, you’ll perform these exercises against an intentionally vulnerable virtual machine that exists specifically for cybersecurity training.
By building this lab once, you’ll have a safe, isolated environment where you can follow along with future Root Notebook projects, practice hands-on techniques, and develop your cybersecurity skills while staying within legal and ethical boundaries.
In this project, you will build an isolated penetration-testing lab using:
- VMware Workstation Pro
- Kali Linux
- Metasploitable 2
- A private VMware host-only network
Kali Linux will serve as the penetration-testing workstation. Metasploitable 2 will serve as the intentionally vulnerable target.
This lab will be referenced throughout the RootNotebook Field Guides. When a guide demonstrates scanning, enumeration, exploitation, reverse shells, or post-exploitation techniques, this is the environment you should use.
Authorization Required
Only scan, test, or exploit systems that you own or have explicit permission to assess. Metasploitable 2 was intentionally created for cybersecurity training, making it an appropriate target inside an isolated lab.
What You Will Build
┌──────────────────────────────────────────────┐
│ VMware Workstation │
│ │
│ ┌─────────────────┐ ┌──────────────────┐ │
│ │ Kali Linux │ │ Metasploitable 2 │ │
│ │ │ │ │ │
│ │ Testing System │ │ Vulnerable Target│ │
│ └────────┬────────┘ └─────────┬────────┘ │
│ │ │ │
│ └──── Host-Only ──────┘ │
│ Network │
└──────────────────────────────────────────────┘
The host-only network allows Kali Linux and Metasploitable 2 to communicate while keeping the vulnerable target separated from the Internet and your normal network.
Requirements
Before starting, make sure your computer has:
| Requirement | Recommended |
|---|---|
| Memory | 8 GB minimum; 16 GB preferred |
| Available storage | At least 60 GB |
| Processor | 64-bit processor with virtualization support |
| Operating system | Windows or Linux supported by VMware Workstation |
| Virtualization | Intel VT-x or AMD-V enabled |
You may need to enable hardware virtualization in the computer’s BIOS or UEFI settings.
Download VMware Workstation Pro
Download VMware Workstation Pro through the Broadcom Support Portal:
Download VMware Workstation Pro
VMware Workstation Pro is currently available without a license key for commercial, educational, and personal use. The download process may require a free Broadcom account.
After signing in:
- Open the Broadcom software download area.
- Search for VMware Workstation Pro.
- Select the current release for your operating system.
- Accept the required terms.
- Download the installer.
Install VMware Workstation Pro
On Windows:
- Locate the downloaded installer.
- Right-click the installer.
- Select Run as administrator.
- Accept the license agreement.
- Continue through the installation wizard.
- Keep the default options unless you have a specific reason to change them.
- Restart the computer if prompted.
- Open VMware Workstation Pro.
When asked for licensing information, select the free-use option presented by the installer.
[Screenshot – VMware Workstation Installation]
Download the Kali Linux VMware Image
Kali provides a prebuilt VMware image, so you do not need to install the operating system manually from an ISO.
Download it from the official Kali Linux website:
Download the Kali Linux VMware Image
Under Virtual Machines, select the current VMware 64-bit image. Kali also publishes an official guide for importing the prebuilt VMware machine.
The download is normally provided as a compressed .7z archive.
Extract the Kali Image
Use 7-Zip or another archive utility to extract the downloaded file.
On Windows:
- Right-click the Kali
.7zfile. - Select Show more options if required.
- Select 7-Zip.
- Select Extract to the suggested folder.
- Wait for the extraction to finish.
Do not try to run the virtual machine directly from inside the compressed archive.
[Screenshot – Extracted Kali VMware Files]
Open Kali in VMware
- Open VMware Workstation Pro.
- Select File.
- Select Open.
- Browse to the extracted Kali folder.
- Select the VMware configuration file ending in
.vmx. - Select Open.
Kali should now appear in the VMware library.
Do not start it yet. We will configure the network after adding Metasploitable 2.
Download Metasploitable 2
Metasploitable 2 is an intentionally vulnerable Linux virtual machine created for security training and penetration-testing practice.
Download it from SourceForge:
Select the available Metasploitable 2 archive and download it to your computer.
Critical Safety Warning
Metasploitable 2 contains deliberately vulnerable and outdated services. Never place it on a bridged network, expose it to the Internet, or connect it directly to a production environment.
Extract Metasploitable 2
- Locate the downloaded archive.
- Right-click the archive.
- Extract it into a dedicated folder.
- Open the extracted folder.
- Locate the VMware configuration file ending in
.vmx.
If no .vmx file is immediately visible, look inside the extracted Metasploitable folder.
Open Metasploitable 2 in VMware
- Open VMware Workstation Pro.
- Select File.
- Select Open.
- Browse to the extracted Metasploitable 2 folder.
- Select the
.vmxfile. - Select Open.
Metasploitable 2 should now appear alongside Kali Linux in the VMware library.
[Screenshot – Kali and Metasploitable 2 in VMware]
Create an Isolated VMware Network
This is the most important part of the lab.
VMware offers several network modes:
| Network mode | Description | Use for Metasploitable 2? |
|---|---|---|
| Bridged | Places the VM directly on the physical network | No |
| NAT | Provides outbound access through the host | Not recommended |
| Host-only | Creates a private network between the host and VMs | Yes |
We will place both virtual machines on the same host-only network.
This allows Kali Linux to communicate with Metasploitable 2 without exposing the vulnerable machine to the Internet or the rest of your physical network.
Configure Kali Linux
Make sure Kali is powered off.
- Select the Kali Linux virtual machine.
- Select Edit virtual machine settings.
- Select Network Adapter.
- Select Host-only.
- Confirm that Connect at power on is enabled.
- Select OK.
[Screenshot – Kali Host-Only Network Setting]
Configure Metasploitable 2
Make sure Metasploitable 2 is powered off.
- Select the Metasploitable 2 virtual machine.
- Select Edit virtual machine settings.
- Select Network Adapter.
- Select Host-only.
- Confirm that Connect at power on is enabled.
- Select OK.
Both virtual machines must use the same VMware host-only network.
[Screenshot – Metasploitable 2 Host-Only Network Setting]
Start Metasploitable 2
Select Metasploitable 2 and power on the virtual machine.
VMware may ask whether you moved or copied the virtual machine.
Select:
I Copied It
This allows VMware to generate a new unique identifier and virtual network address for the machine.
After Metasploitable 2 finishes booting, log in using the credentials provided with the project:
Username: msfadmin
Password: msfadmin
The password will not appear on the screen while you type it. This is normal Linux behavior.
Lab Credentials
Metasploitable 2 uses intentionally weak default credentials because it was designed as a vulnerable training system. Never reuse these credentials elsewhere.
Find the Metasploitable 2 IP Address
At the Metasploitable terminal, run:
ifconfig
Look for the interface that contains an IPv4 address. On older Linux systems such as Metasploitable 2, the interface may appear as:
eth0
Example:
inet addr:192.168.200.128
Your address will probably be different.
Record the address as:
<METASPLOITABLE_IP>
Throughout the RootNotebook Field Guides, placeholders such as <TARGET_IP> or <METASPLOITABLE_IP> should be replaced with the actual address assigned to your virtual machine.
[Screenshot – Metasploitable 2 IP Address]
Start Kali Linux
Select the Kali Linux virtual machine and power it on.
If VMware asks whether you moved or copied the virtual machine, select:
I Copied It
The official prebuilt Kali VMware image currently documents the following default credentials:
Username: kali
Password: kali
Change the password after the first login.
Open a terminal in Kali Linux.
Find the Kali Linux IP Address
Run:
ip addr
Look for the active Ethernet interface and its inet address.
Depending on the VMware and Kali configuration, the interface may have a name similar to:
eth0
or:
ens33
Example:
inet 192.168.200.129/24
Kali and Metasploitable 2 should have addresses in the same subnet.
For example:
Kali Linux: 192.168.200.129
Metasploitable 2: 192.168.200.128
The first three sections of the address are normally the same when using a /24 subnet.
[Screenshot – Kali Linux IP Address]
Verify Connectivity
From the Kali terminal, ping the Metasploitable 2 address:
ping -c 4 <METASPLOITABLE_IP>
Example:
ping -c 4 192.168.200.128
Command Explanation
| Option | Purpose |
|---|---|
ping | Tests basic network connectivity |
-c 4 | Sends four ICMP echo requests |
<METASPLOITABLE_IP> | The address of the target virtual machine |
A successful result should show replies from the target:
64 bytes from 192.168.200.128: icmp_seq=1 ttl=64 time=0.682 ms
64 bytes from 192.168.200.128: icmp_seq=2 ttl=64 time=0.514 ms
The summary should report received packets:
4 packets transmitted, 4 received, 0% packet loss
If you receive replies, the virtual machines can communicate.
[Screenshot – Successful Ping from Kali]
Troubleshooting Connectivity
If Kali cannot reach Metasploitable 2, verify the following:
- Both virtual machines are powered on.
- Both network adapters are enabled.
- Both adapters use Host-only networking.
- Both machines received addresses in the same subnet.
- Neither machine is using Bridged networking.
- The VMware host-only adapter is enabled on the host computer.
You can also restart the network adapter by rebooting each virtual machine.
Do not change Metasploitable 2 to Bridged mode to solve a connectivity problem.
Perform the First Nmap Scan
Now that connectivity has been confirmed, perform a basic service scan from Kali:
nmap -sV <METASPLOITABLE_IP>
Example:
nmap -sV 192.168.200.128
Command Explanation
| Element | Purpose |
|---|---|
nmap | Starts the Nmap network scanner |
-sV | Attempts to identify service versions |
<METASPLOITABLE_IP> | The authorized target inside the lab |
Metasploitable 2 intentionally exposes numerous services. Your results may include services such as FTP, SSH, Telnet, HTTP, databases, and remote administration protocols.
Example output:
PORT STATE SERVICE VERSION
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
25/tcp open smtp
80/tcp open http
139/tcp open netbios-ssn
445/tcp open netbios-ssn
The exact results may vary.
At this stage, the objective is not exploitation. The scan confirms that:
- Kali can reach the target.
- Nmap is working.
- Metasploitable 2 is exposing its intentionally vulnerable services.
- The lab is ready for future RootNotebook exercises.
[Screenshot – First Nmap Scan]
Update Kali Linux
The prebuilt image may not contain the latest package updates.
Because the lab uses host-only networking, Kali may not currently have Internet access. Temporarily changing Kali to NAT is one way to download updates, but Metasploitable 2 should remain powered off while doing so.
Do not change Metasploitable 2 to NAT or Bridged mode.
To update Kali safely:
- Shut down Metasploitable 2.
- Shut down Kali.
- Open Kali’s virtual machine settings.
- Temporarily change Kali’s network adapter from Host-only to NAT.
- Start Kali.
- Open a terminal.
- Run:
sudo apt update
Then install available updates:
sudo apt full-upgrade -y
After the update finishes:
- Shut down Kali.
- Change its network adapter back to Host-only.
- Start both virtual machines.
- Confirm connectivity again.
Update Command Explanation
| Command | Purpose |
|---|---|
sudo | Runs the command with administrative privileges |
apt update | Downloads current package information |
apt full-upgrade | Installs available updates and handles dependency changes |
-y | Automatically confirms package installation prompts |
Change the Kali Password
The default password for a published virtual machine should not be retained.
Run:
passwd
Enter the current password when prompted, followed by the new password twice.
Use a strong password that is unique to the lab.
Take Clean Snapshots
Snapshots allow you to restore a virtual machine to a known working state after an experiment, configuration error, or failed exercise.
Create a snapshot of each machine before beginning any exploitation exercises.
Snapshot Kali Linux
- Shut down Kali or leave it in a stable state.
- Select the Kali virtual machine.
- Open the VM menu.
- Select Snapshot.
- Select Take Snapshot.
- Name it:
Kali - Clean Lab Configuration
- Add a short description.
- Select Take Snapshot.
Snapshot Metasploitable 2
Repeat the process for Metasploitable 2.
Suggested name:
Metasploitable 2 - Clean Starting State
[Screenshot – VMware Snapshot Manager]
Lab Safety Checklist
Before continuing to another RootNotebook guide, confirm the following:
- VMware Workstation Pro is installed.
- Kali Linux opens successfully.
- Metasploitable 2 opens successfully.
- Both virtual machines use Host-only networking.
- Metasploitable 2 is not Bridged to the physical network.
- Kali can ping Metasploitable 2.
- Nmap can identify services on Metasploitable 2.
- Kali’s default password has been changed.
- Clean snapshots have been created.
Lab Ready
You now have a safe and reusable penetration-testing environment consisting of:
- A Kali Linux testing workstation
- An intentionally vulnerable Metasploitable 2 target
- An isolated VMware network
- Verified network connectivity
- Clean recovery snapshots
Throughout the RootNotebook Field Guides, commands may use placeholders such as:
<KALI_IP>
<TARGET_IP>
<METASPLOITABLE_IP>
<LHOST>
<RHOST>
Replace these placeholders with the addresses assigned to your own lab machines.
For example:
nmap -sV <TARGET_IP>
could become:
nmap -sV 192.168.200.128
Never copy example IP addresses blindly. Always verify the address assigned to your target.
How This Lab Will Be Used
Future RootNotebook guides will reference this project when demonstrating:
- Nmap scanning and service enumeration
- Metasploit modules
- Netcat connections
- Reverse shells
- Web application testing
- Password auditing
- Vulnerability validation
- Linux enumeration
- Network traffic analysis
- Defensive monitoring and detection
Unless a guide specifically states otherwise, all attack commands should be performed against Metasploitable 2 or another intentionally vulnerable system inside an isolated lab.
Key Takeaways
Main Lesson
Cybersecurity tools and exploitation techniques should be practiced only in an environment you own or are explicitly authorized to test.
Important Commands
ifconfig
ip addr
ping -c 4 <TARGET_IP>
nmap -sV <TARGET_IP>
sudo apt update
sudo apt full-upgrade -y
passwd
Skills Practiced
- Installing a desktop hypervisor
- Importing prebuilt virtual machines
- Configuring isolated virtual networking
- Identifying Linux IP addresses
- Testing connectivity
- Performing basic service discovery
- Creating recovery snapshots
Defensive Considerations
Metasploitable 2 demonstrates the risks created by outdated software, weak credentials, excessive exposed services, and insecure default configurations. It should remain isolated at all times and should never be treated as a secure or production-ready operating system.