What are the limitations when performing a penetration test with a virtual machine instead of a physical one?

  • 5
    Are you performing pen testing from a virtual machine, or against a virtual machine? – Brian Duke Sep 6 '15 at 15:42
  • @user3623501 I think it was very clear from the OP's question itself. He meant from within the VM and not against any VM. – Shritam Bhowmick Sep 7 '15 at 4:45

In my opinion performing a penetration test from a virtual machine is actually the preferred way of doing it from opsec perspective (i.e. to maintain separation between your clients' data).

Limitations may arise from the fact that you can't access the underlying hardware directly, in particular:

  • Wired network interfaces: some host operating systems (e.g. OSX) will continue using the wired network even if you explicitly disable it in host OS and bridge the virtual machine to it. From the network perspective that means two separate MAC addresses on the same port, which sometimes triggers the NAC.
  • Wireless interfaces: most hypervisors don't emulate wireless devices at all
  • GPU: if you want to use something like oclhashcat for password cracking, you need direct access to the GPU

That being said most of these problems can be solved by dedicating the necessary hardware to the VM (e.g. PCI or USB passthrough).

  • 1
    I think one can perform wireless security tests from within the VM - you would just need to install an alpha card to help you. – Shritam Bhowmick Sep 7 '15 at 4:47
  • Yes, that part of my answer was a bit imprecise. It is definitely possible with a wireless interface dedicated to the VM. – eax Sep 8 '15 at 22:09
  • Don't most VMs lack the ability to put the physical adapter into promiscuous mode? That would cripple any packet sniffing vectors. Personally I always use physical hardware when sniffing because of this. – Rick Chatham Sep 11 '15 at 18:50

I use docker-machine and packer/vagrant with vmwarefusion as my provider. I can check the status of my machines with:

docker ps
vagrant global-status

Vagrant is used for Windows and OS X images while Docker is used for Linux and FreeBSD.

My Kali 2.0 Docker image, for example, started at around 550MB and is now around 1.8GB. I save a lot of disk space this way, and am capable of diffing my images easily to determine what changed and how it changed. I have images for Arch, CentOS, Debian, Fedora, FreeBSD, Kali, Qubes, REMnux, RHEL, Scientific, and Ubuntu.

Accessing my containers is very easy. I can have a brand new OS X or Windows image booted in 15 or so seconds. Docker is much faster -- fractions of a millisecond to attach to a freshly-created running container. I use CTRL+P CTRL+Q to detach, almost like screen or tmux.

In my opinion, it's the opposite effect: I feel limited in my penetration-testing capabilities without virtual machines. I especially feel empowered with containers and Docker-based workflows. Using a single, host-only OS is the real limitation. How else are you supposed to emulate environments, stage tools, or develop new ideas without a constantly-evolving lab?

  • Good one. Docker is a great solution for pen testing. – Danny Lieberman Sep 7 '15 at 6:06

You may have some packet injection issues as the VM will see the virtual interface instead of the physical interface. This will only effect some wireless attacks.

Other than this I cannot think of any other issues.


In my personal experience, virtual machines don't really matter as long as you do not have programs running which sometimes need direct interaction with certain hardware.

For instance scenarios where you want to directly address the GPU (password cracking) or where you want to perform some low-level network operations it might give you issues.

Furthermore it also depends on the type of virtualization you use.

  • Out of curiosity, are rowhammer attacks different against VMs? It seems like they would be, given the interesting hardware/software dynamics at play... – KnightOfNi Sep 6 '15 at 20:16
  • I honestly have no idea, then again it all would depend on the type of virtualization as well – Lucas Kauffman Sep 6 '15 at 20:56

Theoretically, the only limitations you could face when using a virtual machine are inherent to hardware limitations themselves and this depends fully on the nature of the pentest you want to perform. In practice, you can say there are no limitations in (very) most and common cases.


In my experience with MSF (Metasploit Framework) the more horsepower you can throw at it the better - you will prefer a big powerful VM with a fast WAN connection over a dedicated i3 notebook with 4GB RAM.

  • @Danny Lieberman - I cannot endorse the idea in network pentesting (MSF) but in web applications, I don't think to rely on such automation and increasing memory for such task is completely beneficial at all. – Shritam Bhowmick Sep 7 '15 at 4:49
  • I meant 4GB. My experience with MSF is the more resources the better. With ZAP web app vulnerability testing, the resource requirements seem to be much more modest but YMMV. – Danny Lieberman Sep 7 '15 at 6:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.