Vulnerable VMs

To practice attacks legally and safely you need targets you are allowed to break. Intentionally vulnerable VMs are built for exactly this.

They contain known weaknesses so you can learn scanning, exploitation, and post-exploitation in a controlled lab.

Metasploitable 2 is an intentionally vulnerable Ubuntu-based VM from Rapid7. It runs many outdated, exploitable services like vsftpd, Samba, and an old Apache.

It is a classic target for learning Metasploit and network exploitation.

Metasploitable 2 uses well-known weak credentials so you can log in after exploitation or via brute force practice.

• Username: msfadmin
• Password: msfadmin

Never expose this VM to the internet - it is wildly insecure by design.

DVWA (Damn Vulnerable Web Application) is a PHP/MySQL web app built to be insecure. It is ideal for learning web attacks like SQL injection, XSS, command injection, and file upload abuse.

DVWA lets you set a security level that changes how hard each vulnerability is to exploit:

• Low - no protection, easiest.
• Medium - weak filtering.
• High - stronger but still bypassable.
• Impossible - shows the secure code as a reference.

The fastest way to run DVWA is via Docker. This spins up the app on port 80 of your lab host or a dedicated VM.

Beyond Metasploitable and DVWA there are many trainers:

• OWASP Juice Shop - modern web app vulns.
• bWAPP - 100+ web bugs.
• VulnHub - downloadable boot-to-root VMs.
• HackTheBox / TryHackMe - online labs.

After importing a target VM, confirm Kali can reach it on the isolated lab network. Find the target IP and ping it, or scan for it.

Exploits often corrupt or crash a target. Take a clean snapshot of each vulnerable VM right after setup.

When a service dies or you fill the disk with payloads, roll back and try again.

These VMs have no security at all. If reachable from the internet, real attackers will compromise them within minutes and could use them to pivot into your network.

• Keep them on host-only or internal networks.
• Power them off when not in use.

Different targets teach different skills:

• Metasploitable - network service exploitation with Metasploit and Nmap.
• DVWA / Juice Shop - web app attacks with Burp Suite and manual injection.

A complete lab usually runs at least one of each.

Pick the right target for the job.

You now have legal practice targets:

• Metasploitable 2 - vulnerable network services (login msfadmin/msfadmin).
• DVWA - vulnerable web app with Low to Impossible security levels.
• Snapshot before attacking and never expose these to the internet.

Next: building the isolated network that connects them.