I want to setup a testing lab in my basement for penetration/vulnerability testing & offensive/defensive security skills. I believe I have all the equipment that I need, and if I'll need something else, I will get it. I also have Cisco routers, firewalls, and managed switches. Money and resources are not an issue. How do I setup a lab if I have one host machine and three to four guest machines? Obviously, the host is the controller, but what OS and VM do I use? With the other machines, do I use one for Backtrack, one for Snort, one for Linux distro, one for Windows OS, e.t.c.? Any ideas on the structure of the setup?
closed as off topic by Lucas Kauffman, Adi, TildalWave, AJ Henderson, Terry Chia May 15 '13 at 5:33
Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.
So if I was you I would start relatively simply with some VMs and a host machine.
Personally I use VMWare workstation but other virtualization products are possibilities.
If you've got a decent enough machine (e.g. 8GB RAM, Quad-Core Sandy/Ivy bridge, fast disks), I'd recommend keeping the Host OS clear of lab tools or target Apps, as re-building VMs is an awful lot easier than physical kit. As to Host OS, I'd go with whatever you're most comfortable with as long as it runs your virtualization software of choice.
Then have a tools VM, and some targets. I'd start with Kali for the Tools VM and then have a selection of targets to attack.
A good place to start is the post that @hamza-dzcyberdev mentioned in his comment. Also you could look at pentesterlab who look to have some good free materials.
Once you've got the basics hanging you could start to introduce the physical systems (e.g. firewalls, routers) that you can't easily get Virtual versions of.
Have you thought about setting up honeypots on your network as well? They are pretty good at being able to configure ect. http://en.wikipedia.org/wiki/Honeypot_(computing)
I have also used a few programs for VMs.
Virtual box is one of the most common free ones (windows box). Proxmox is really common freeware that provides a lot of flexibility with virtualization via a linux hypervisor.
Sounds like you have the rest of the hardware. If you were looking to spend money on the OS Virtualization you may want to go the VMware route. Or even HyperV if you wanted to span across different virtual platforms.