If you are interested in the field of penetration testing, the most ideal thing is to create a home lab.
The main reason for setting up a pentesting lab at home is to provide you with a convenient way to try out new pentesting skills and software. But beyond convenience, there are other important reasons why setting up your own pentesting lab is a good idea.
A good reason is also that it helps you hone your skills while also keeping you out of legal trouble, as hacking into computer without their consent is illegal.
Also, when you use a penetration testing lab you have greater security. Some tools and techniques have the potential to destroy a target computer or network.
Finally, setting up a pentesting lab at home can be useful for researching and developing new tools and techniques. An isolated lab provides a controlled environment for testing and the ability to set up the target according to the exact specifications required for the test.
What do I need for my workshop?
To set up a pentesting lab, you simply need a target computer and a pentesting computer. However, as skill levels and the need for realism increase, the number and complexity of targets will need to increase and more elements will need to be added to the target network.
The goal
A new pentester should start with a simple environment and gradually add complexity. By starting with a vulnerable target and adding the complexity they desire, a dedicated pentester can design an environment with the right level of complexity to suit their needs.
Starting with the vulnerable targets
If you're just starting out as a pentester, you may not know what makes a target vulnerable and what doesn't, or how to configure a target to be vulnerable to a particular type of attack. Fortunately, many individuals and organizations have done most of the work for you and provide vulnerable target machines that you can use.
Making a computer vulnerable is quite difficult. However, several websites offer free downloads of vulnerable machines. Some good options are the following:
DVWA (Damn Vulnerable Web Application) is a web application designed to have vulnerabilities built in. It is written in PHP and MySQL and is designed to be vulnerable to cross-site scripting, SQL injection, and other attacks.
Metasploitable is a virtual machine created by the Rapid7 team, the developers of the Metasploit Pentesting tool. Metasploitable is designed to be vulnerable to attacks included in the Metasploit framework .
Web Security Dojo by Maven Security is another target for pentesting. Built on Xubuntu, it also includes tools necessary for its exploitation, combining the roles of both target and pentesting machine.
Google Gruyere is another vulnerable application. Its use requires internet access for the pentesting machine. This sets it apart from the others listed here.
The simplest way to create a pentesting network is a target machine and a pentesting machine (which can be the same computer). However, as a pentester's skills and needs increase, a larger and more complex network will be needed.
The simplest way to increase the complexity of a pentesting network is to increase the number of targets on the network. By creating a series of machines with different operating systems and services, you can familiarize yourself with different computers.
Another simple way to increase the difficulty is to upgrade services installed on target machines. Vulnerable machines like Metasploitable intentionally run versions of software that are known to be vulnerable to certain types of attacks.
Finally, the complexity of a pentesting environment can be increased by expanding the threat surface of the network. This can be achieved by expanding the types of services being run, including email, web, FTP, databases, and file servers. Network-level modifications, such as adding routers and services such as DHCP and DNS, change the landscape of the target network.
In conclusion
A home pentestering lab is essential for both a beginner and an experienced pentester, as at some point, everyone will encounter a new situation or have a new idea they want to test. For ethical and security, testing should be done in an isolated environment.
Building a pentesting lab is quite easy, as it is possible to start simply and grow it over time. So if you are interested in starting penetration testing, create a simple pentesting lab, find a website that gives you some examples, and start testing your skills!
