How to Build a Safe, Isolated Cybersecurity Home Lab (Kali + Ubuntu)

Reading about a SQL injection isn't the same as triggering one yourself and watching the database dump on screen. That's why I built my own home lab, and why I wrote this guide to help you build yours. A cybersecurity home lab is a small, self-contained network you build on your own computer, entirely cut off from the internet and your home network. You run two virtual machines: one plays the attacker (Kali Linux, loaded with security tools) and the other plays the target (Ubuntu Server, configured with intentionally vulnerable services). You then practice the same techniques real penetration testers use, scanning, exploiting, monitoring, and defending, without any risk to a real system. My name is Elijah Abolaji, and I developed this guide for educational purposes only. ⚠️ Legal & Ethical Ground Rules Every tool in this guide is dual-use: the same command that finds a vulnerability in your lab can cause real damages, and real legal consequences. If pointed at a system you don't own. Rule #1: Only ever run these tools against machines you personally own or have explicit written authorization to test. In this guide, that means the Ubuntu VM you build yourself, on an isolated virtual network with no route to the internet or your home Wi-Fi. Rule #2: Unauthorized scanning, exploitation, or denial-of-service against systems you don't control is illegal in most countries (including Nigeria), even when done "just to learn." Keep this lab air-gapped from anything else. For a smooth-running lab, you'll need a computer with: 4-core processor 16GB RAM SSD storage Anything below this still works, but not efficiently. 🛠️ Step 1: Install VirtualBox Go to virtualbox.org and open the Downloads page. Download the installer for your host OS (Windows / macOS / Linux). Run the installer and accept the default options. Also download the matching VirtualBox Extension Pack from the same page and install it from inside VirtualBox (File → Preferences → Extensions). It adds USB and network features you'll want later. 🐉 Step 2: Download & Install Kali Linux (Attacker) What is Kali? A Debian-based distribution pre-loaded with hundreds of security and penetration-testing tools: Nmap, Metasploit, Burp Suite, SQLmap, and everything else in Part 1 of this guide. Go to kali.org/get-kali and choose Virtual Machines. Download the pre-built VirtualBox image (a .7z file) that matches your CPU architecture—this is faster than installing from an ISO. Extract the archive, then in VirtualBox choose File → Import Appliance and select the extracted .vbox file. Once imported, start the VM. Default credentials are username: kali, password: kali—change the password immediately with passwd. Update the tool set: bash sudo apt update && sudo apt full-upgrade -y 🐧 Step 3: Download & Install Ubuntu Server (Target) Go to ubuntu.com/download/server and download the latest Ubuntu Server LTS ISO. In VirtualBox, click New, name the VM "Ubuntu-Target" (or any preferred name), and attach the ISO as the virtual optical drive. Give it at least 2 GB RAM and 20 GB disk, then follow the installer, accepting default partitioning. When prompted, install the OpenSSH server option so Kali can connect to it later. After installation completes, remove the ISO from the virtual drive and reboot. 🔒 Step 4: Building the Isolated Lab Network This is the most important safety step in the whole guide. You want Kali and Ubuntu to talk to each other, but not to anything else. In VirtualBox: File → Host Network Manager → create a Host-Only Network (e.g., vboxnet0, range 192.168.100.0/24). Kali VM → Settings → Network → Adapter 1 → attach to Host-only Adapter → choose vboxnet0. Repeat for the Ubuntu VM, attaching it to the same host-only network. Set IP addresses for both machines and use the default gateway in the same subnet. Boot both VMs and confirm they can see each other: bash # From Kali ping 192.168.100.20 Both VMs sit on the same Host-Only network (192.168.100.0/24)—isolated from your home Wi-Fi and the internet. Double-check: A Host-Only network has no route to the internet by design. If you also attach a NAT adapter for updates, DoS/exploitation traffic should still only ever target 192.168.100.20. 🔍 Step 5: Reconnaissance & Scanning (from Kali) Everything below runs on the Kali VM, targeting the Ubuntu VM's IP (192.168.100.20). Goal: Find out what's alive on the network and which ports/services are open before touching anything. nmap 192.168.100.0/24 # scan the subnet sudo nmap -A 192.168.100.20 # OS, version, scripts nmap --script vuln 192.168.100.20 Tip: Save your scan output: nmap -oA scan 192.168.100.20 writes normal, XML, and grepable formats at once. Goal: Once port 80/443 is open, map out what the web application actually contains: hidden directories, files, misconfigurations. gobuster dir -u http://192.168.100.20 -w /usr/share/wordlists/dirb/common.txt http://192.168.100.20 -w /usr/share/seclists/Discovery/Web-Content/common.txt nikto -h http://192.168.100.20 # automated vulnerability scanner http://192.168.100.20 # view response headers http://192.168.100.20/vulnerable.php Note: Burp Suite's proxy is how you'll capture authenticated requests (with login cookies) to feed into SQLmap on the next step. 💉 Step 7: SQL Injection with SQLmap Goal: Confirm and exploit an injectable parameter to prove data can be extracted—this is why DVWA on the Ubuntu target exists. sqlmap -u "http://192.168.100.20/page.php?id=1" --batch http://192.168.100.20/page.php?id=1" --dbs http://192.168.100.20/page.php?id=1" -D dwva --tables http://192.168.100.20/page.php?id=1" -D dwva -T users --dump sqlmap -r request.txt --batch --dbs sqlmap -r request.txt --batch --level=5 --risk=3 # more thorough 🔑 Step 8: Password Attacks Goal: Test whether weak or default credentials on the Ubuntu target can be guessed—a huge share of real breaches start exactly this way. hydra -L users.txt -P pass.txt ssh://192.168.100.20 -t 4 -V john --wordlist=rockyou.txt hashes.txt hashcat -m 0 hash.txt rockyou.txt # MD5 Tool Best for Lab only: These commands can knock a real server offline. Run them only against your own isolated Ubuntu-Target VM—never anything else. Before you start: hping3 ships with Kali by default. Install anything missing: sudo apt install -y hping3 slowhttptest apache2-utils bash sudo hping3 -S --flood -p 80 192.168.100.20 slowhttptest -B -c 1000 -i 10 -l 300 -u http://192.168.100.20/ # Slow POST http://192.168.100.20/ # Slow Read ab -n 10000 -c 500 http://192.168.100.20/ hping3 flags: -S SYN flag · --flood send as fast as possible · --rand-source spoof source IPs · -p destination port · -i u1000 interval in microseconds wireshark # packet capture GUI sudo arpspoof -i eth0 -t 192.168.100.20 192.168.100.1 sudo ettercap -G # GUI How this works: ARP spoofing tricks both the target and the gateway into sending traffic through your Kali machine first, letting Wireshark or bettercap see it in transit. This only works within the same local network segment—exactly what your host-only lab network provides. Goal: Move from "this service looks vulnerable" to an actual working exploit against the Ubuntu target, using a pre-built module. sudo msfconsole Inside msfconsole: search ssh_login Reverse shell example: use exploit/multi/handler 📸 Step 12: Snapshot Management (VBoxManage) Why: Take a snapshot before every risky experiment so a botched exploit or a crashed service is one command away from undone. You can take the snapshot by opening the machine dialogue on the top-left of the VM or use the bash commands below. VBoxManage list vms VBoxManage startvm "Kali" --type headless ⚙️ Part 2: Ubuntu Target Configuration Everything below runs on the Ubuntu VM, giving Kali a normal network stack and running services to find. ip a # check interfaces sudo systemctl restart apache2 sudo systemctl status apache2 ss -tlnp SSH Server Setup sudo apt update sudo adduser testuser # for Hydra practice Key options to inspect: PermitRootLogin no Why a test account? The Password Attacks section uses Hydra against SSH—create a deliberately weak-password account here so there's something realistic to crack in your own lab. MariaDB / MySQL Setup Why: DVWA (next step) needs a database and a dedicated database user to store its own accounts and vulnerable tables. With DVWA, you can perform SQL injection attacks from a web interface by visiting: http://target-ip/DVWA sudo mysql -u root Inside MySQL: CREATE DATABASE dwva; SHOW DATABASES; Step 13: Installing DVWA (Vulnerable Web App) What is DVWA? A PHP/MySQL web app intentionally full of common vulnerabilities (SQL injection, XSS, weak passwords)—the standard practice target for Part 1's SQLmap and web enumeration commands. Install the LAMP stack plus git: bash sudo apt install -y apache2 \ Clone DVWA from GitHub into Apache's web root: bash cd /var/www/html/ https://github.com/digininja/DVWA.git Open permissions so DVWA can write its config: bash sudo chmod -R 777 /var/www/html/DVWA/ Copy the sample config and point it at your database: bash cd /var/www/html/DVWA/config/ Access it: Open http:///DVWA/setup.php from Kali's browser. Default login is admin / password. Set the security level to "low" while you're first learning each attack. Watching the target during an attack: top / htop # live resource usage Hardening Apache: sudo a2enmod reqtimeout Sample hardening for /etc/apache2/apache2.conf: Timeout 30 Full circle: After you've successfully run a DoS test from Kali, come back here and apply these settings—then re-run the same attack and watch the difference in how long the server holds up. Understanding bash commands is always the first and most important step. Ubuntu and Kali both have excellent documentation. If it feels overwhelming, you can download and run this binary tool that compiles and categorizes over 500 bash commands and their usage for free: https://github.com/toyosee/cyberref-releases/releases/tag/v0.2.0 Download and run the cyberref.exe—no installation needed, no internet needed. This is a free tool for students, researchers, and a quick reference for professionals. Your OS might reject it at first; grant it access. It is harmless. I am a usual guy that likes technology. If you wish to know more about me, follow me: LinkedIn: www.linkedin.com/in/elijahbolaji/ GitHub: https://github.com/toyosee/ YouTube: https://www.youtube.com/@barterverse Need a Video Guide? If you want a step-by-step video guide, ask in the comment section.