Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

My objective is to learn and practice all the vulnerabilities and their exploitation on vulnerable OS.

share|improve this question

2 Answers

up vote 4 down vote

Check out NIST's FDCC (Federal Desktop Core Configuration). They offer Windows XP and Vista downloads.

http://nvd.nist.gov/fdcc/download_fdcc.cfm

share|improve this answer
Ummm, wow. Not sure how they get away with giving those out. Also note that these may be at least partially patched. The VHDs were created well after the release of their OS's. Best bet to get a system in a known configuration is to build it yourself - get TechNet. – Iszi Jan 5 '12 at 15:08
Ah, those are also 120 day trial versions, which is how NIST get away with it! They've also been hardened, so not a great choice if you're looking for vulnerability examples. However, seeing those makes me suspect that you might be able to get hold of Microsoft's older OS trial versions if you look around microsoft.com enough. – Graham Hill Jan 5 '12 at 15:42
1  
@GrahamHill However they do tell you all the hardening work and you can roll it back. – Jeff Ferland♦ Jan 5 '12 at 21:43
up vote 3 down vote

A TechNet subscription will let you download older versions of Windows, which you can install into an image and not patch.

You can purchase one at http://technet.microsoft.com/en-us/subscriptions/hh442910 or via your Volume Licensing agreement if you have one.

share|improve this answer
Spot on, here. Unfortunately, due to obvious licensing restrictions, there is no such thing as a legally free Windows system. However, a TechNet subscription will let you download older versions of MS OS's and software - even back to DOS! I would also recommend loading these images in VirtualBox (free VM software) for easy testing without having to buy additional hardware. – Iszi Jan 5 '12 at 14:55
1  
Well, there's one free Windows system, although it's time limited. Microsoft will let you download a trial version of Windows Server 2008 R2 with SP1 that will run for 60 days; and Microsoft are OK with you using the rearm procedure to stretch the evaluation to 6 months. But (hopefully) that version of Windows is going to have fewer vulnerabilities than something older. – Graham Hill Jan 5 '12 at 15:34
There's also the Windows 8 test versions, but I'm not counting that. – Iszi Jan 5 '12 at 15:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.