Lab Setup (Kali, Parrot, Ubuntu Target Machines)

Lab Setup (Kali, Parrot, Ubuntu Target Machines)

A proper pentesting environment requires controlled, isolated systems where tools, techniques, and exploits can be practiced safely. The most reliable setup includes one or more attacker machines and multiple target systems running different Linux distributions. Kali and Parrot are commonly used for offensive tasks, while Ubuntu is ideal as a target machine due to its stable configuration, predictable structure, and common use in real environments.

Choosing Virtualization Software

Virtual machines allow safe experimentation without affecting the host system. They provide isolation, snapshots, and easy network customization.

Supported options include:

• VirtualBox

• VMware Workstation or VMware Player

• Proxmox or ESXi for advanced users

VirtualBox is widely recommended for beginners because it is free, simple to configure, and supports snapshots and NAT, Host-Only, and Bridged networking.

Downloading the Required ISO Images

The lab requires three main systems.

Attacker machines:

• Kali Linux

• Parrot Security OS

Target machine:

• Ubuntu Server or Ubuntu Desktop (recommended LTS versions)

ISOs must always be downloaded from official websites to avoid compromised images.

Creating the Kali Linux Virtual Machine

Kali serves as the primary attacker system. It includes preinstalled tools such as Nmap, Burp Suite, Metasploit, Wireshark, and dozens of enumeration and exploitation utilities.

Steps include:

1. Create a new VM and assign at least 2–4 GB RAM and 2 CPU cores

2. Attach the Kali ISO as the boot disk

3. Create a 20–40 GB virtual hard disk

4. Install Kali with default settings

5. Update system packages after installation using:

sudo apt update && sudo apt upgrade -y

6. Install VirtualBox Guest Additions if needed for full-screen mode and shared clipboard

Kali should remain clean and regularly updated to ensure tools work correctly.

Creating the Parrot Security VM

Parrot offers a lightweight and privacy-focused alternative to Kali. It includes similar tools but consumes fewer resources.

Configuration is similar:

• 2 GB RAM minimum

• 2 CPU cores

• 20–40 GB storage

• Boot from ISO and install normally

Parrot helps perform cross-validation by running the same tools in different environments and confirming consistent results.

Creating the Ubuntu Target Machine

Ubuntu is widely used for production servers, making it an ideal target for pentest training. It can be configured with additional vulnerable services to simulate real-world conditions.

Recommended configuration:

• 1–2 GB RAM

• 1–2 CPU cores

• 20 GB storage

After installation, install common services that expand the attack surface:

sudo apt install openssh-server vsftpd apache2 mariadb-server

These services help simulate realistic vulnerabilities such as weak SSH configurations, outdated packages, misconfigured web servers, and improperly secured databases.

Network Configuration for the Lab

A controlled network environment prevents accidental exposure to external systems. Virtual machines should communicate with each other while remaining isolated from the internet unless updates are required.

Common setups include:

Host-Only Network

Best for offline pentesting labs. VMs communicate only with each other and the host.

NAT Network

Allows systems to access the internet for updates but still isolates internal traffic.

Bridged Mode

Connects VMs to the physical network. Use only if you understand the risks because misconfigured services may be exposed to the entire LAN.

Most pentesting labs combine NAT for updates and Host-Only for isolated testing.

Setting Up Shared Folders and Tools

Shared folders help transfer scripts, payloads, and reports between host and VMs. Parrot and Kali may require Guest Additions or VMware Tools for shared folder support.

Tools to install immediately include:

sudo apt install net-tools curl wget git -y

These utilities are essential for enumeration, downloading payloads, and cloning repositories.

Creating Snapshots for Safe Testing

Snapshots allow reverting the VM to its previous clean state. This is critical when testing exploits that may break the system or modify configurations.

Recommended snapshot points:

• Fresh installation snapshot

• Post-update snapshot

• Pre-exploitation snapshot

• Post-exploitation review snapshot

Snapshots save time and prevent rebuilding the machine after failures.

Enabling SSH Access Between Machines

SSH enables remote access and supports secure file transfers and remote command execution.

Enable and start SSH on Ubuntu:

sudo systemctl enable ssh
sudo systemctl start ssh

Kali and Parrot include SSH clients by default. SSH access is used extensively during lateral movement, privilege escalation, and post-exploitation.

Optional: Adding More Vulnerable Machines

To expand the lab, additional targets can be installed:

• Metasploitable 2

• OWASP Broken Web Apps

• DVWA

• Vulnerable Docker containers

These platforms provide intentionally insecure environments for practicing exploitation techniques.

Intel Dump

• Lab setup uses VMs for safe, isolated pentesting

• Kali and Parrot serve as attacker machines

• Ubuntu acts as a realistic target system

• VirtualBox or VMware provide virtualization and networking options

• ISOs must always be downloaded from official sources

• Proper VM resource allocation improves tool performance

• Target machines should run common services for realistic attack surfaces

• Host-Only and NAT networks isolate and control traffic

• Snapshots allow safe testing and recovery

• SSH access simplifies remote enumeration and exploitation

• Additional vulnerable systems can expand the lab for advanced practice