I want to get started with penetration testing, and have read that it is better to conduct such tests using a virtual machine rather than your own computer. I also want to use the internal network function of VirtualBox to ensure that I dont mess anything up. How can i create a network to attack and have an attacker outside this network, but with all of them internal, and with no access to the internet? Is this even what I should be doing?

  • Within the VirtualBox, I want to have two internal networks. The attacker is on the first network and the other devices are on the other one. I understand that there must be a device that has access to both networks, through which the attacker can then access the 2nd network. However, I am unsure how to do this. – James Apr 5 '16 at 7:22
  • @JamesTan that "device" is your host computer already. But if you are starting, you don't want to go that route. Check my answer. – yzT Apr 5 '16 at 7:30

On the VM settings, set each of the NICs to Internal Network. This will allow the VMs to communicate with each other but not the outside world.

As to getting started, get a premade .ova of Kali and another of Metasploitable. If you happen to have access to a Windows Vista or earlier disk (especially if it doesn't ship with any service packs!), install one of those, too.

This will allow you to launch attacks and scans from Kali without accidentally hitting your real network. Plus, metasploitable is designed to have vulnerabilities, so you're not hitting a proverbial brick wall before you know how to use the hammer.

In particular, in Kali, look at nmap (especially with the --script option) and metasploit.

I noticed you're asking about network penetration, too. Consider that an additional complication for later, as firewalls are another obstacle entirely, and except where you've enabled port forwarding, you're relying on the targets to reach out (or making them reach out after some compromise they've brought upon themselves; still, not the same as port scans unless you already know which ports you purposely make vulnerable, or are looking for vulnerabilities in the router.)


You're asking a lot of questions.

To configure a network in VirtualBox, just go to preferences > networks, and create a host-only network.

But then what? what's your plan? you need something to attack. You need to figure out what do you want to focus in.

Web applications? Install some webserver and download DVWA, WebGoat or whatever other vulnerable web application is people using nowadays.

Operating Systems? Install some vulnerable virtual machine like Metasploitable.

You really don't need to create the VBox network because you are going to attack a single system at the beginning. When you are more proficient, you can start installing "real" systems, connecting them and finding vulnerabilities.

  • So what youre saying is that I should first have the internal network limited to 2 systems: the attacker and vulnerable VM. Then i can try any attacks using the former to the latter? And only after I am more familiar with these should I start on a 'real' network mentioned above. – James Apr 5 '16 at 7:35
  • @JamesTan you don't need to create an internal network. Just install the vulnerable VM and access it. If you set the network adapter as bridged, just be sure you are not forwarding traffic to that IP in your router, and that's it. – yzT Apr 5 '16 at 7:37

I will share my way to do penetration tests with VMs.

  1. I use VirtualBox, typically I start with two machines, the attacker and the victim.
  2. The victim is my target system, it could be only the OS, or an specific configuration or software. Some people already suggest some matasplotaible or other images prepared to be compromised.
  3. The attacker is a recent version of Kali or other environment with the tools for the work.
  4. Configuration of VirtualBox allows me to interact directly with those two VM.
  • Welcome on the Security SE! :-) – peterh Aug 9 '18 at 15:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.