Stand up your own pentest lab

hard

Learn with your AI

Open this lesson in your favourite AI. It'll walk you through the why, explain the demo, and quiz you on the try-it list.

Open in Claude Open in ChatGPT

Why this matters

Pentesting skill is acquired by doing — and you can't legally practise on systems you don't own. Stand up a lab: vulnerable VMs (VulnHub, HackTheBox Pwnbox), CTF platforms (CTFd self-hosted), AD lab (BadBlood, GOAD), web-app targets (DVWA, OWASP Juice Shop). The lab is your training ground.

Demo

Minimum lab: VMware/VirtualBox + Kali + 3 vulnerable target VMs from VulnHub + DVWA + a small AD lab (GOAD). Total: ~32GB RAM recommended. Practice on these every week.

Try it yourself

Set up a lab: Kali + 1 vulnerable Linux target (try Mr-Robot on VulnHub).
Compromise the target end-to-end. Document the chain.
Add an AD lab (GOAD on VMs) once Linux feels comfortable.

Prompt your AI

Use these three in order. Each builds on the one before.

1. Basics & terminology

In one paragraph, describe a minimal pentest lab.

2. Why it works (the mechanism)

Walk me through standing up GOAD AD lab.

3. Advanced — application & what's next

Design a progression of labs from beginner to red-team operator.