creating a testing environment

Question

This question has been asked over and over again across the web, but many answers are either ridiculous or the same. I have tried using OWASPs VM which has a range of purposely built holes in web applications to teach and explain the basics.

Here is the problem those tests are so easy even if you dont know how to pentest you can do them. I have also used hack.me which once again is just web applications (though some challenging) its all about MySQL injections and execution of code.

So here is my question:

What is the best way to legally test out server penetration skills and techniques? but more specifically... on a budget? assuming I have access to servers but little access to network hardware what approach can I take to set my self up a lab that isnt all about XSS, SQL injection and PHP execution?

I hope my question is not to broad and someone can help me and other people interested in penetration testing find a way to study safely.. (I am very knowledgeable in securing servers and encryption but I want to play for the other team!)

Answer 1

You MUST run your own servers, and then try to attack them, then secure them from that attack, then attack again.

You should use VMs.

One source of working VMs for a wide range of applications is Turnkeylinux; another is Bitnamithey should not have deliberate security flaws, but if you install an ISO created a few months ago, and don't let it patch itself, you can check for the most recent flaws in various software.

Answer 2

There is a very good resource for this but like @Anti-weakpasswords said it involves VM's. The site is https://www.vulnhub.com and has mostly CTF style challenges for beginners through to advanced users. There are also a lot of resources you can make use of.

Answer 3

There are many resources online available. Not sure what is your budget but if you are interested in attacking servers/infrastructure maybe you should consider taking OSCP course or course with eLearningSecurity and if you are looking something on budget you should try these ones Pentesterlab. All these courses has online labs/servers where you can learn different attack vectors.