I want to get started with penetration testing, and have read that it is better to conduct such tests using a virtual machine rather than your own computer. I also want to use the internal network function of VirtualBox to ensure that I dont mess anything up. How can i create a network to attack and have an attacker outside this network, but with all of them internal, and with no access to the internet? Is this even what I should be doing?
On the VM settings, set each of the NICs to Internal Network. This will allow the VMs to communicate with each other but not the outside world.
As to getting started, get a premade .ova of Kali and another of Metasploitable. If you happen to have access to a Windows Vista or earlier disk (especially if it doesn't ship with any service packs!), install one of those, too.
This will allow you to launch attacks and scans from Kali without accidentally hitting your real network. Plus, metasploitable is designed to have vulnerabilities, so you're not hitting a proverbial brick wall before you know how to use the hammer.
In particular, in Kali, look at nmap (especially with the --script option) and metasploit.
I noticed you're asking about network penetration, too. Consider that an additional complication for later, as firewalls are another obstacle entirely, and except where you've enabled port forwarding, you're relying on the targets to reach out (or making them reach out after some compromise they've brought upon themselves; still, not the same as port scans unless you already know which ports you purposely make vulnerable, or are looking for vulnerabilities in the router.)
You're asking a lot of questions.
To configure a network in VirtualBox, just go to preferences > networks, and create a host-only network.
But then what? what's your plan? you need something to attack. You need to figure out what do you want to focus in.
Web applications? Install some webserver and download DVWA, WebGoat or whatever other vulnerable web application is people using nowadays.
Operating Systems? Install some vulnerable virtual machine like Metasploitable.
You really don't need to create the VBox network because you are going to attack a single system at the beginning. When you are more proficient, you can start installing "real" systems, connecting them and finding vulnerabilities.
I will share my way to do penetration tests with VMs.
- I use VirtualBox, typically I start with two machines, the attacker and the victim.
- The victim is my target system, it could be only the OS, or an specific configuration or software. Some people already suggest some matasplotaible or other images prepared to be compromised.
- The attacker is a recent version of Kali or other environment with the tools for the work.
- Configuration of VirtualBox allows me to interact directly with those two VM.