How to Set Up a Penetration Testing Lab in 2026: Tools, OS, Network Topology and Practice Scenarios

Key takeaways

• Build the lab on an isolated host-only or internal network, so vulnerable targets such as Metasploitable never touch the internet.
• Take a snapshot of every VM before each exercise, so you can break things freely and restore in seconds.
• Start with Kali and one or two targets like DVWA in an evening, then grow the range toward Active Directory.

A home lab is where you practise scanning, exploitation, defence and report writing without touching anyone else's systems. This guide takes you from a single laptop to an Active Directory range, with the network layout, step-by-step build, practice scenarios and the safety rules that keep the lab legal.

Why build your own pentest lab?

A lab gives you a place to make mistakes safely and repeat them until the skill sticks. It matters for four reasons:

• Hands-on skill: penetration testing is learned by doing. Reading about SMB enumeration is not the same as finding a misconfigured share yourself.
• Legal safety: testing systems you don't own or have written permission for is an offence under India's IT Act, 2000. A lab removes that risk.
• Certification prep: practical exams such as OSCP (PEN-200), CEH Practical and CPENT are timed and hands-on. A lab lets you rehearse the full workflow.
• Both sides of the attack: add logging and you see what your own actions look like to a defender, which makes you better at both jobs.

What hardware do you need?

A laptop or desktop with 16 GB RAM, a 4-core CPU with virtualisation enabled in BIOS/UEFI (Intel VT-x or AMD-V) and an SSD with about 250 GB free runs a basic lab comfortably. RAM is the real limit, because every VM holds its memory while running.

If your laptop is already short on memory, an old desktop or a second-hand mini PC running Proxmox makes a good always-on lab box. Cloud labs are covered further down.

Which virtualisation platform should you use?

For a single laptop, VirtualBox or VMware Workstation Pro is the easiest choice. For a dedicated lab machine, use Proxmox VE.

Pick one and stay with it. Mixing hypervisors on the same laptop (for example Hyper-V and VirtualBox) can cause performance problems on Windows.

Which operating systems go in the lab?

Attacker machine

• Kali Linux: the standard choice. Offensive Security publishes ready-made VirtualBox and VMware images on the official Kali download page, so you don't need to install from scratch. Give it 4 GB RAM, 2 vCPUs and at least 40 GB of disk.
• Parrot Security: a lighter alternative if your laptop is short on RAM.

New to Kali? Start with how to learn Kali Linux as a beginner before you build the rest.

Target machines

How should the lab network be laid out?

Put attacker and targets on a network that cannot reach your home LAN or the internet, and give only the attacker a second adapter for updates. This is the single most important design rule.

 Internet
 |
 [ Home router ]
 |
 [ Host PC ]
 |
 NAT adapter (updates only, Kali only)
 |
 +---------------+-----------------------------+
 | Isolated lab network (host-only/internal) |
 | 192.168.56.0/24 |
 | |
 | Kali (attacker) 192.168.56.10 |
 | Metasploitable 2 192.168.56.20 |
 | Ubuntu + DVWA 192.168.56.30 |
 | Windows DC (AD lab) 192.168.56.40 |
 +---------------------------------------------+

On Proxmox you can go further with separate Linux bridges or VLANs, for example a "user" segment and a "server" segment joined by a pfSense or OPNsense firewall VM. That lets you practise pivoting and firewall rules later.

Step-by-step: build a starter lab in an evening

1. Enable virtualisation. Turn on Intel VT-x or AMD-V in BIOS/UEFI, then install VirtualBox or VMware Workstation Pro.
2. Create the isolated network. In VirtualBox, open the Network Manager and create a host-only network (the default is usually 192.168.56.0/24). In VMware, use a host-only VMnet. Turn off the built-in DHCP server if you plan to use static IPs.
3. Import Kali. Download the pre-built VM image, import it, and give it two adapters: NAT and host-only. Update it with sudo apt update && sudo apt full-upgrade -y.
4. Add a target. Import Metasploitable 2 (or build an Ubuntu VM running DVWA in Docker) with a single host-only adapter and no NAT.
5. Check isolation. From the target, a ping to the internet should fail. From Kali, the target should answer.
6. Snapshot everything. Take a clean "baseline" snapshot of every VM before you touch it.
7. Write down the scope. Note your lab subnet and the IPs you are allowed to test. It sounds formal, but it builds the habit you'll need on real engagements.

Quick checks from Kali:

# Confirm your lab IP and that you're on the right subnet
ip -br addr

# Discover live hosts in your lab subnet only
nmap -sn 192.168.56.0/24

# Service and version scan of a single lab target
nmap -sC -sV -oN target20.txt 192.168.56.20

Always type the lab subnet explicitly. A mistyped range is the most common way students end up scanning a network they don't own.

Practice scenarios to work through

Once the lab is running, work in a structured order. Each scenario should end with a short written finding: what you found, why it matters and how to fix it.

For a fuller AD practice range, the open-source GOAD (Game of Active Directory) project builds a deliberately vulnerable multi-domain lab. It needs a lot of RAM, so treat it as a later step. For a tour of what Kali ships with, see top ethical hacking tools in Kali Linux.

Core tools by category

Learn one tool per category well before collecting more. Commercial command-and-control frameworks are not needed for learning and are out of scope for a home lab.

Automate the lab so you can rebuild it

Once you break a lab a few times, you'll want to rebuild it quickly. Three common approaches:

• Snapshots: the simplest option. Revert after every exercise.
• Vagrant: describe VMs and networks in a Vagrantfile, then run vagrant up. Metasploitable 3 and many AD labs use it.
• Ansible or Terraform: useful on Proxmox for building users, services and vulnerable settings the same way every time. This also happens to be good DevOps practice.

Can you build a pentest lab in the cloud?

Yes, but treat it as an add-on to a local lab, not a replacement. AWS, Azure and Google Cloud all let you build a private VPC/VNet with an attacker VM and targets, which is handy if your laptop is weak. Three rules matter:

• Keep vulnerable targets in private subnets with no public IP, and restrict egress with security groups or firewall rules.
• Test only your own resources and follow the provider's penetration testing policy.
• Set a budget alert and shut VMs down after each session. A forgotten Windows VM can quietly run up a bill.

Safety and legal rules for any lab

• Never bridge vulnerable VMs onto your home, office or college network.
• Only test what you own or have written permission to test. Under India's IT Act, 2000, unauthorised access and damage to computer systems carry civil and criminal penalties (Sections 43 and 66).
• Treat downloaded targets as untrusted. Get images from the project's official source and keep them isolated.
• Keep malware analysis separate. Use an internal-only network with no shared folders or clipboard, and revert snapshots afterwards.
• Don't reuse real passwords anywhere in the lab.

Common mistakes and quick fixes

Your next step

Build the starter lab this week: one Kali VM, one Metasploitable or DVWA target, an isolated network and a baseline snapshot. Work through the scenario table in order and write a short finding for each. If you're aiming for OSCP, read how to pass OSCP on your first attempt next, and when you want guided labs with a trainer reviewing your methodology, look at the OSCP (PEN-200) training.

Related reading

• Parrot OS Installation Guide | Setting Up a Secure Virtual Workspace
• Best Budget Laptops for Ethical Hacking Beginners in 2026 | Which Affordable Laptop Is Ideal for Cybersecurity Training?
• Which Laptop Is Best for Cybersecurity? MacBook vs Windows vs Linux for Ethical Hacking (2026)