Virtualization and Labs

You never practice hacking against real systems without permission: you practice in labs you build yourself, isolated and disposable. Virtualization (and containers) let you have your attack box, several victims, and a whole simulated network inside your laptop, with the ability to break everything and return to the initial state with one click. It’s the environment where you learn without doing harm or getting into legal trouble.

Virtualization: hypervisors

A hypervisor runs full virtual machines (VMs), each with its own OS:

VirtualBox (free, cross-platform) — ideal to start.
VMware Workstation/Fusion — more performance, convenient snapshots.
Proxmox / ESXi — type-1 hypervisors for serious labs/homelab.
UTM / Parallels — for Apple Silicon (ARM).

Key concepts: snapshot (a photo of a state you can return to — essential before breaking a VM), clone (independent copy), and the network mode.

Virtual networks (what confuses beginners most)

NAT          the VM reaches the Internet through the host; not reachable from outside
Host-only    private host<->VM network; no Internet (isolated, safe lab)
Bridged      the VM appears as another device on your physical LAN
Internal     network only between VMs, not even the host (isolated AD-style lab)

For an attack lab: a host-only/internal network with your Kali and the victims, with no Internet access → isolated and no risk of “escaping.”

Containers (Docker)

Lighter than a VM: they share the host’s kernel. Many labs and tools come dockerized:

docker run -it kalilinux/kali-rolling
docker compose up          # bring up a multi-container environment (e.g. a vulnerable web)

Docker is fast for standing up a specific vulnerable app; a VM is better for a full OS or an AD lab.

Where to practice (legal labs)

# local (you build them)
VulnHub          downloadable vulnerable VMs
Metasploitable   classic victim VM
DVWA / Juice Shop / bWAPP   vulnerable webs (Docker)
GOAD             "Game Of Active Directory": a full AD lab
# online
HackTheBox / TryHackMe   machines and guided paths
PortSwigger Web Security Academy   free web labs

Snapshots: your safety net

1. Install the clean VM -> snapshot "base"
2. Break, infect, exploit whatever you want
3. Restore to snapshot "base" -> good as new in seconds

Why it matters in security

Without a lab there’s no safe or legal practice. Virtualization gives you real victims you can wreck, isolated networks to test noisy attacks (Responder, scans, malware) without affecting anyone, and the ability to reproduce a client’s environment to rehearse before the real pentest. GOAD, specifically, is the standard for practicing the whole Windows & AD area.

Mastery checklist

I install a VM and take/restore snapshots
I understand NAT vs host-only vs bridged vs internal and when to use each
I build an isolated lab (Kali + victim) with no Internet access
I bring up a vulnerable app with Docker (compose)
I know VulnHub, HTB, THM, PortSwigger Academy, and GOAD
I clone VMs so I don’t always start from scratch
I know why I never practice against systems without permission