How to Set Up Hacking Lab in 2026 — Complete Home Lab Guide for Ethical Hackers

This guide provides a practical, step-by-step approach to building a free, isolated home hacking lab using VirtualBox, Kali Linux, Metasploitable 2, and DVWA via Docker. The article addresses the critical need for hands-on practice environments in cybersecurity learning, arguing that while online platforms like TryHackMe are valuable, local labs are essential for developing real penetration testing skills without constraints. The guide emphasizes safe isolation through Host-Only networking to prevent vulnerable machines from exposing the home network or internet, and includes exercises, hardware planning, and expansion roadmaps for advanced scenarios.

• Host-Only isolation is non-negotiableThe article stresses that vulnerable VMs must run exclusively on VirtualBox's Host-Only Adapter configured with the 192.168.56.0/24 subnet, creating a completely isolated network segment with no routing to the internet or home network. Metasploitable 2 specifically must never have a second NAT adapter because it contains intentionally backdoored services (including a vsftpd 2.3.4 backdoor in FTP) and default credentials that could compromise the host machine if exposed. The guide provides verification steps: ping 8.8.8.8 from Metasploitable should fail, and ping to home network gateway should
• Local labs enable unrestricted experimentationUnlike TryHackMe and HackTheBox which have scheduled resets, time limits, rate limiting, and shared environments, a local lab allows breaking targets completely without cleanup concerns, rebuilding from snapshots in under 60 seconds, running unlimited tool iterations, and practicing multi-machine attack chains impossible on cloud platforms. The article argues this freedom is essential for developing deep skill in post-exploitation persistence, Active Directory attacks, and custom tool integration—capabilities that professional penetration testers require.
• Hardware configuration directly determines lab capacityThe article provides a decision table matching available RAM to lab scope: 8GB RAM supports only Kali plus Docker-based DVWA; 12GB enables the full three-VM basic lab (Kali, Metasploitable, DVWA); 16GB adds room for one VulnHub VM; 32GB supports a full Active Directory environment with Domain Controller and multiple Windows workstations. The guide also requires users to verify CPU virtualization support (Intel VT-x or AMD-V) and have 50GB free disk space minimum.
• Metasploitable 2 provides 30+ intentional vulnerabilitiesThe article describes Metasploitable 2 as a deliberately insecure Ubuntu VM created by Rapid7 specifically for Metasploit Framework testing, running services including FTP (vsftpd 2.3.4 with backdoor), SSH, Telnet, HTTP (with DVWA, Mutillidae, phpMyAdmin), Samba, and MySQL. It functions as the primary network target for learning exploitation fundamentals and can be discovered and verified using netdiscover or Nmap from Kali, with Nmap expected to show 20+ open services.
• DVWA via Docker simplifies web application testingRunning DVWA (Damn Vulnerable Web Application) as a Docker container inside Kali Linux rather than as a separate VM is faster and simpler, accessible at 127.0.0.1 without additional network configuration. The guide provides the exact docker pull and docker run commands, login credentials (admin/password), and reset procedures (docker rm and re-run to remove injected data). The article notes DVWA covers the primary curriculum for the courses referenced.
• Kali requires dual network adapters for updatesThe guide configures Kali Linux with two network adapters: a Host-Only Adapter for lab traffic (enabling communication with Metasploitable and isolated testing) and a NAT adapter for internet access to retrieve tool updates via 'sudo apt update && sudo apt full-upgrade'. This dual-adapter configuration balances isolation of vulnerable targets with the ability to maintain and expand the attacker machine's toolkit.
• Expansion roadmap aligns with course progressionThe article provides a structured timeline: Months 1–2 focus on the basic lab mastering DVWA at all security levels and exploiting Metasploitable services, with introduction to VulnHub beginner machines (Mr-Robot, Basic Pentesting, DC-1); Month 3 adds Active Directory lab using free Windows Server 2022 and Windows 10 evaluation ISOs from Microsoft's evaluation center for practicing BloodHound, Pass the Hash, and Kerberoasting; beyond Month 3, intermediate VulnHub machines and cloud-based environments on AWS Free Tier extend the scope.
• TryHackMe bridges gaps during local setupThe article recommends using TryHackMe's free browser-based AttackBox while downloading local lab files, positioning the two environments as complementary: TryHackMe provides structured guided learning and instant access without setup, while the local lab becomes the permanent environment for unrestricted practice. The workflow minimizes wasted time by running downloads in parallel with TryHackMe room completion, then transitioning to local setup once files finish downloading.

Bottom line: Building a free, isolated home lab using VirtualBox's Host-Only networking is the foundational skill for serious cybersecurity practice, and the article provides exact configurations, hardware requirements, and step-by-step exercises to establish Kali, Metasploitable, and DVWA on any machine with 12GB RAM and 100GB free disk space at zero cost. The critical security principle is strict isolation—vulnerable VMs must never use Bridged or NAT adapters—combined with the freedom to experiment without