Pentest Lab Setup: Kali Linux, Metasploitable 2, and DVWA on VirtualBox

A penetration testing lab gives you legal, isolated targets for ethical hacking practice. This guide builds a three-VM layout on Oracle VirtualBox: Kali Linux as the attacker, Metasploitable 2 for network targets, and DVWA for web application testing.

Lab VMs and packages

This lab is a small, repeatable stack — not every tool you will ever use in a career, but enough surface area to practice recon, network exploitation, web attacks, and Metasploit workflows without touching a production network. Below is what we install, what role each piece plays, and where it fits in the ethical hacking course.

Install order for this guide

Follow these steps in order. Each step links to a dedicated guide where the full Kali or DVWA install is already documented with screenshots.

Do not skip ahead — Metasploitable and DVWA need the host-only network from Step 3, and verification in Step 7 assumes Kali is already on that subnet.

What we did not include (and why)

After the base lab is running, extend it from the optional targets section at the end of this page.

Lab topology

VirtualBox often assigns 192.168.56.0/24 on the default host-only adapter. Refreshed walkthroughs on this site use TARGET = 192.168.56.114 and KALI_IP = 192.168.56.115 on that subnet when your lab matches the default range. Substitute your own addresses from ip addr on each VM.

Metasploitable 2 console: msfadmin / msfadmin
Take a snapshot of each target VM after install and before your first exploit.

Here is the topology for this lab — Kali on host-only with targets DVWA and Metasploitable on the same segment:

Virtualization keeps vulnerable services off your physical network. Malware analysis, ARP spoofing, and Metasploit payloads can disrupt real systems if they leak onto a production LAN. The host-only network in Step 3 limits impact to VMs on that adapter.

Step-by-step lab build

Work through Steps 1–7 in order. Screenshots below were captured on VirtualBox 7.x with a Windows host; menu names may differ slightly on Linux or macOS hosts.

Step 1: Install VirtualBox on the host

1. Open the Oracle VirtualBox downloads page.
2. Download the installer for your host OS (Windows, macOS, or Linux).

3. Run the installer and accept the defaults on Windows, or follow install Oracle VirtualBox on Linux on RHEL-family hosts.
4. Confirm VirtualBox opens without errors before you continue to Step 2.

Step 2: Install the VirtualBox Extension Pack

1. On the same VirtualBox downloads page, download the Extension Pack that matches your VirtualBox version.
2. Double-click the Extension Pack file or install it from Tools → Extension Pack Manager in VirtualBox.
3. Accept the license prompt.

Step 3: Create the host-only network

This private subnet keeps lab VMs isolated from your home LAN.

1. In VirtualBox, open File → Tools → Network.

2. Select Host-only Networks on the right panel.
3. Open the default VirtualBox Host-Only Ethernet Adapter and set the Adapter tab values to match your lab plan (default 192.168.56.1 / 255.255.255.0 works with most refreshed course walkthroughs).

4. Switch to the DHCP Server tab and enable DHCP or note the assigned range.

5. Click Apply and confirm the adapter appears under Host-only Networks.

Step 4: Install Kali Linux and attach lab network adapters

Part A — Install Kali

1. Follow Install Kali Linux on VirtualBox from start to finish (bare-metal ISO or pre-built VirtualBox image).
2. Confirm the Kali VM boots to a login prompt before you change network settings.

Part B — Wire Kali into this lab topology

3. Select the Kali VM → Settings → Network.
4. Set Adapter 1: Enabled, Host-only Adapter (the network from Step 3).
5. Set Adapter 2: Enabled, NAT (Internet for apt and msfupdate).

6. Optional: on Adapter 2, add NAT port forwarding if you want SSH from the host without bridging lab traffic.

7. Start Kali and log in with the credentials from the Kali download page (often kali / kali).

8. On Kali, run ip -4 addr show and confirm the host-only interface received an address on your lab subnet.

Step 5: Install DVWA (web target)

Pick one path below.

Option A — DVWA as a separate guest VM (VulnHub ISO)

1. Download DVWA 1.0.7 from VulnHub.
2. In VirtualBox, click Machine → New and name the VM.

3. Allocate 2 GB RAM and 1 vCPU.

4. Create a 10 GB dynamically allocated virtual disk.

5. Open Settings → Network → Adapter 1: Host-only Adapter (same network as Kali).

6. Mount the DVWA ISO, start the VM, and boot the installer.

7. At the boot menu, choose start the installer directly.

8. Complete installation until the console shows DVWA running.

9. From Kali, browse to http://DVWA_IP/ after you read the address with ip addr on the DVWA guest.

Option B — DVWA on Kali (single-machine web lab)

1. Follow Install DVWA on Kali Linux.
2. Keep DVWA on localhost or the host-only interface only — do not expose it on a bridged adapter.
3. Continue with DVWA SQL injection after the setup wizard completes.

Step 6: Install Metasploitable 2

1. Download metasploitable-linux-2.0.0.zip from SourceForge.
2. Extract the archive to a folder on your host.

3. In VirtualBox, click Machine → New → Expert Mode.

4. Assign 2 GB RAM (512 MB minimum).

5. Attach the extracted VMDK as the virtual hard disk. The VM name must match the extracted folder name.

If you are building an empty VM instead of attaching the VMDK directly, add an 8 GB dynamic VDI under Settings → Storage:

6. Open Settings → Network → Adapter 1: Host-only Adapter (same network as Kali). Do not use bridged networking for this lab.

7. Start the VM.

8. Log in with msfadmin / msfadmin.

9. From Kali, open http://TARGET/ in a browser to reach the Metasploitable web menu (after you identify TARGET with ip addr on the Metasploitable console or a subnet scan).

Continue exploitation in Learn hacking with Metasploitable 2.

Step 7: Verify the lab and snapshot each VM

1. On Kali, ping Metasploitable (substitute your target address):

ping -c 2 TARGET

2. Optional: sweep the host-only subnet to list all lab guests:

nmap -sn 192.168.56.0/24

3. Run spot checks from Kali:

4. In VirtualBox, snapshot Kali, Metasploitable, and DVWA (or note the snapshot name if you use Kali-only DVWA). Restore these snapshots between exercises so each service starts from a known state.

Optional targets

Add more vulnerable apps on the same host-only network as you advance:

• OWASP Juice Shop
• Android pentesting lab
• CAINE forensics VM

Troubleshooting

Summary

You now have a standard ethical hacking lab: Kali on host-only + NAT, Metasploitable 2 and DVWA on host-only only, and snapshots for reset between exercises. Next steps:

1. Metasploit tutorial — msfconsole basics
2. Learn hacking with Metasploitable 2 — exploits against the network target
3. DNS enumeration or banner grabbing — recon on Metasploitable services

Keep every scan and exploit inside this isolated network.