How to Build a Cybersecurity Home Lab in 2026 (Step-by-Step)

A home lab is the single most effective investment you can make in your cybersecurity career. It's where you practise techniques safely, break things without consequences, and build the muscle memory that makes you dangerous on real engagements.

This guide builds you a complete lab from scratch.

What You'll Build

By the end of this guide, you'll have:

• Kali Linux VM — your attack machine
• Metasploitable2 — vulnerable Linux target
• Windows Server VM — Active Directory target (optional but valuable)
• DVWA — web application target
• Isolated network — nothing escapes to the internet

Hardware Requirements

Spec	Minimum	Recommended
RAM	8GB	16GB+
CPU	Any quad-core, 2015+	Intel i5/i7 or AMD Ryzen 5/7
Storage	100GB HDD	256GB SSD
OS	Windows 10/11, macOS, Linux	Any

Virtualisation check: Before installing anything, confirm your CPU supports virtualisation:

• Windows: Open Task Manager → Performance → CPU → look for "Virtualisation: Enabled"
• BIOS: If disabled, enable Intel VT-x (Intel) or AMD-V / SVM (AMD) in BIOS settings

Step 1: Install a Hypervisor

A hypervisor lets you run multiple operating systems simultaneously.

VirtualBox (Free — Recommended for Beginners)

Download from virtualbox.org. Install normally. Also install the Extension Pack for USB 3.0 and full-screen mode support.

VMware Workstation Player (Free for Personal Use)

Faster than VirtualBox, especially for Windows VMs. Download from vmware.com/products/workstation-player.

Proxmox (For Dedicated Hardware)

If you have an old PC or mini PC to dedicate to the lab, Proxmox is a free bare-metal hypervisor. Install it on the machine and manage all VMs via web browser. Best for running 5+ VMs simultaneously.

Step 2: Set Up Your Attack Machine (Kali Linux)

Full Kali Linux setup guide here. Quick version:

1. Download the Kali Linux VM image from kali.org/get-kali/#kali-virtual-machines (pre-built for VirtualBox and VMware)
2. Import the .ova file: VirtualBox → File → Import Appliance
3. Default credentials: kali / kali
4. Update: sudo apt update && sudo apt upgrade -y
5. Configure network adapter: Host-Only or Internal Network (never Bridged for attack machines)

Step 3: Network Configuration

This is the most important safety step. Your attack VMs must not be able to reach the real internet or your home network.

Option A: Host-Only Network (Simplest)

• VMs can communicate with each other and with your host machine
• VMs cannot reach the internet
• Set all lab VMs to "Host-Only Adapter" in VirtualBox network settings

Option B: Internal Network (Most Isolated)

• VMs can only communicate with each other
• No host machine access, no internet
• Best for realistic adversarial simulations

Network Topology for Your Lab

[Your Main PC]
    │
    ├── [Kali Linux VM] ──── Host-Only Network (192.168.56.x)
    │                               │
    ├── [Metasploitable2] ──────────┤
    │                               │
    ├── [Windows Server] ───────────┤
    │                               │
    └── [DVWA] ────────────────────┘

Step 4: Deploy Vulnerable Targets

Metasploitable2 (Linux — Essential)

The classic intentionally-vulnerable VM. Runs services with known exploits: FTP, SSH, Telnet, HTTP, MySQL, PostgreSQL, Samba, and more.

1. Download from SourceForge (search "Metasploitable2")
2. Import the .vmdk file into VirtualBox (New VM → Use existing disk)
3. Set network to Host-Only
4. Login: msfadmin / msfadmin
5. Find its IP: ifconfig

What to practise on Metasploitable2:

• FTP anonymous login (port 21)
• Samba exploit via Metasploit (exploit/multi/samba/usermap_script)
• Tomcat manager upload (port 8180)
• PHP web shells
• PostgreSQL unauthenticated access

DVWA (Damn Vulnerable Web Application)

Best web application target. Teaches OWASP Top 10 in a hands-on environment.

Easiest setup via Docker:

docker run --rm -it -p 80:80 vulnerables/web-dvwa

Access at http://localhost/. Set security level to "Low" to start.

What to practise on DVWA:

• SQL injection (manual + automated)
• XSS (reflected + stored)
• File upload bypass
• CSRF
• Command injection

Windows Server (Active Directory Lab)

Essential for anyone targeting enterprise environments. Active Directory is present in virtually every corporate network.

1. Download Windows Server 2022 evaluation (180-day free trial from Microsoft)
2. Install as a VM (needs 2GB RAM minimum, 4GB recommended)
3. Promote to Domain Controller (Add Roles → Active Directory Domain Services → Promote to DC)
4. Create a domain: lab.local
5. Add some user accounts, some with weak passwords

What to practise on your AD lab:

• Enumeration with BloodHound
• Kerberoasting
• Pass-the-Hash
• AS-REP Roasting

See our Active Directory hacking guide for the full attack chain.

VulnHub (Additional Targets)

vulnhub.com hosts hundreds of community-created vulnerable VMs. Each has a write-up available. Download and import like any other VM. Good picks for beginners:

• Mr Robot — web + WordPress
• Kioptrix Level 1 — classic Linux exploitation
• DC-1 — Drupal CMS exploitation
• HarryPotter series — story-based, multi-step

Step 5: Tools to Install on Kali

Kali comes with most tools pre-installed. Add these if missing:

# Essentials
sudo apt install -y bloodhound neo4j gobuster ffuf

# Python tools
pip3 install impacket crackmapexec

# Update Metasploit
sudo msfupdate

What to Practise (Structured Approach)

Week 1–2: Basic Enumeration

• Nmap scan Metasploitable2: nmap -sC -sV 192.168.56.101
• Identify every open service
• Look up each service version on Exploit-DB

Week 3–4: First Exploits

• Use Metasploit to exploit Samba on Metasploitable2
• Get a Meterpreter shell
• Navigate the file system, dump /etc/passwd

Week 5–6: Web Application Testing

• Work through DVWA SQL injection at "Low" → "Medium" → "High" difficulty
• Practise XSS payloads
• File upload bypass

Month 2: Privilege Escalation

• Read the privilege escalation guide
• Run LinPEAS on Metasploitable2 and interpret the output
• Identify and exploit SUID binaries

Month 3: Active Directory

• Set up Windows Server AD
• Run BloodHound enumeration
• Perform Kerberoasting

Your home lab is your training ground. Every technique you master here transfers directly to CTF competitions, bug bounty programs, and professional penetration testing engagements.