SETUP LAB 1

Personal Cyber Security Home Lab

Download and configure Oracle VM VirtualBox, construct an isolated Host-Only local network, provision Kali Linux, Windows Target, and Metasploitable VMs, verify connection routes, and set system rollback states.

Environment

VirtualBox / Local OS

Difficulty

Beginner (Level 2)

Course Module

Home Lab Setup

Deliverables

Lab Diagram & Connectivity Logs

1. System Architecture & Workflow

The diagram below highlights the network topology for the cybersecurity lab. All virtual machines reside on an isolated VirtualBox host-only switch interface. There is no bridging or routing enabled to the external Internet or the local physical subnet, preventing malware and scanning tool traffic leaks.

2. Part 1: Step-by-Step Action Items & Key Execution Steps

STEP 1

Install VirtualBox and Configure Virtual Host-Only Networks

Install the hypervisor software and provision a virtual internal network card that connects the lab VMs while blocking outside connectivity.

Download and run the VirtualBox Installer on your physical system (Windows, macOS, or Linux).
Open the Oracle VM VirtualBox Manager desktop application.
In the top menu bar, click on File, and select Tools from the dropdown list, then click on Network Manager.
In the Network Manager panel, navigate to the Host-only Networks tab.
Click the Create button in the top-left of the manager. This action provisions a new adapter named vboxnet0 (or VirtualBox Host-Only Ethernet Adapter on Windows).
Select the newly created adapter, and under the Adapter tab in the bottom panel, configure the following values:
- IPv4 Address: 192.168.56.1
- IPv4 Network Mask: 255.255.255.0
Click on the DHCP Server tab in the bottom panel, and ensure the checkbox Enable Server is UNCHECKED. This guarantees that IP address assignments must be performed manually (static allocation) to mimic real-world network infrastructure design.
Click Apply to commit the network interface configurations to the hypervisor database.

STEP 2

Provision the Kali Linux Virtual Machine

Create a dedicated virtual hardware slot for the penetration testing host and mount the installer ISO file.

In the main VirtualBox Manager window, click the blue New button to launch the Virtual Machine creation wizard.
Configure the VM description parameters in the dialog box:
- Name: Kali-Linux-Attacker
- Folder: Leave as default or choose your path
- Type: Select Linux
- Version: Select Debian (64-bit)
Click Next. On the hardware page, configure the following metrics:
- Base Memory: Allocate at least 2048 MB (2 GB RAM) or 4096 MB if host system has 16GB+ RAM.
- Processors: Allocate at least 2 CPUs.
Click Next. On the Virtual Hard Disk page, configure the following details:
- Select Create a Virtual Hard Disk Now.
- Disk Size: Set to at least 25.00 GB (30 GB recommended).
Click Finish. Select the newly created Kali-Linux-Attacker VM in the left panel, and click the gear-shaped Settings button in the top menu.
Navigate to the Storage tab. Under the Storage Devices tree, click on the optical disc icon labeled Empty under Controller: IDE.
In the right-hand attributes panel, click the blue disc icon and select Choose a disk file.... Browse to and select your downloaded Kali Linux Installer ISO file.
Navigate to the Network tab. Under Adapter 1:
- Ensure Enable Network Adapter is checked.
- Change the Attached to: dropdown value from NAT to Host-only Adapter.
- Select the name of the host-only adapter you created in Step 1 (e.g., vboxnet0).
Click OK to close the VM settings panel.

STEP 3

Install Kali Linux OS and VirtualBox Guest Additions

Power on the VM, execute the graphical OS installation process, and compile the driver modules to support screen resizing and clipboard sharing.

Select the Kali-Linux-Attacker VM and click the green Start arrow at the top of the manager.
In the VM boot menu console, use the arrow keys to select Graphical Install and press Enter.
Complete the graphical wizard by selecting English as the system language, your keyboard region, and setting the hostname to kali. Leave the domain name blank.
Configure user credentials: enter a full name (e.g., Student), set username to student, and set a password (e.g., Password123).
On the partitioning page, select Guided - use entire disk, select your virtual hard disk, select All files in one partition (recommended for new users), select Finish partitioning and write changes to disk, select Yes to confirm, and press Enter.
On the Software Selection page, leave the defaults checked (desktop environment XfCE and top 10 tools) and click Continue.
When prompted to install the GRUB boot loader to the primary drive, select Yes, select the drive named /dev/sda, and click Continue. When installation completes, click Continue to reboot the VM.
Log in with username student and your password. In the top VM menu bar, click Devices and select Insert Guest Additions CD Image....
Open a terminal window and run the commands below to compile the Guest Additions kernel drivers.

$ sudo apt update && sudo apt install -y build-essential dkms

This command downloads packages from online repositories to prepare compiling and building guest additions kernel drivers. Note: Ensure you temporarily toggle the network card to NAT in settings if packages need fetching, then toggle it back to Host-only.

Part	What It Does
`apt`	Advanced Package Tool — the Debian/Ubuntu package manager for installing, updating, and removing software
`update`	Refreshes the local package index from remote repositories to get the latest available versions
`sudo`	SuperUser Do — executes the following command with root (administrator) privileges
`install`	Downloads and installs the specified package(s)
`-y`	Automatically answers "yes" to all confirmation prompts

$ sudo mkdir -p /media/cdrom && sudo mount /dev/cdrom /media/cdrom

This command creates a directory named cdrom and mounts the virtual optical CD containing the VirtualBox driver scripts.

Part	What It Does
`mkdir`	Make Directory — creates a new folder
`-p`	Port specification — defines which ports to scan (e.g., -p 80 or -p 1-1000)
`sudo`	SuperUser Do — executes the following command with root (administrator) privileges

$ sudo sh /media/cdrom/VBoxLinuxAdditions.run

This command executes the installer script to compile guest additions modules, enabling auto-resizing and clipboard sharing.

STEP 4

Assign Static IPs and Verify Network Isolation

Configure local network interfaces with static addresses and run ping tests to verify connection isolation.

In the Kali desktop environment, click the network status icon in the top panel and select Edit Connections....
Select Wired Connection 1 from the connection list and click the gear-shaped icon in the bottom left to edit.
Navigate to the IPv4 Settings tab, change the Method dropdown to Manual, and click Add.
Configure the network values exactly as follows:
- Address: 192.168.56.10
- Netmask: 255.255.255.0 (or enter 24)
- Gateway: 192.168.56.1
Click Save. In the terminal, run the commands below to restart the networking interface and verify settings.

$ sudo systemctl restart NetworkManager

This command restarts the networking daemon to apply the newly configured manual IP address to the system adapter.

Part	What It Does
`systemctl`	System Control — manages systemd services (start, stop, enable, disable, check status)
`restart`	Stops and then starts the service (applies configuration changes)

$ ip address show eth0

This command displays the network configuration for interface eth0, confirming the static IP 192.168.56.10 is bound.

$ ping -c 4 192.168.56.1

This command sends 4 ICMP echo request packets to the host adapter gateway to verify host-to-guest networking connectivity.

Part	What It Does
`-c`	Count — specifies the number of ping packets to send (Linux only)
`verify`	Verifies a certificate against a CA certificate to validate the trust chain

$ ping -c 4 8.8.8.8 || echo "Lab Is Isolated!"

This command attempts to contact a public DNS server, confirming the isolated host-only network is successfully blocked from the internet.

STEP 5

Configure Target Windows/Linux VMs and Take Snapshots

Import vulnerable VMs into VirtualBox, assign static IPs, verify inter-VM routing, and take recovery snapshots.

Create your target VMs in VirtualBox using the same network settings (Attached to: Host-only Adapter).
Log in to your Windows Server Target VM. Open the Control Panel -> Network and Sharing Center -> Change adapter settings. Right-click the Ethernet interface -> Properties -> select Internet Protocol Version 4 (TCP/IPv4) -> click Properties. Select Use the following IP address and enter:
- IP Address: 192.168.56.20
- Subnet Mask: 255.255.255.0
- Default Gateway: 192.168.56.1
Log in to your Metasploitable Target VM. In its shell, edit the network configuration file, then ping from Kali.
Once all VMs can ping each other, shut down the VMs.
Select the Kali-Linux-Attacker VM in VirtualBox. Click the hamburger menu next to the VM name, select Snapshots, click the Take button, enter Name: Lab Baseline, and click OK. Repeat this snapshot process for both target VMs to establish a clean rollback point.

$ ping -c 4 192.168.56.20

This command sends ICMP packets from the Kali attacker VM to the Windows target VM to test inter-VM network paths.

3. Automation Architecture

The diagram below highlights the setup lifecycle. During VM deployment, the system initializes virtual hardware slots, associates isolated adapter bindings, runs the OS installer routine, sets static configuration profiles, and saves the final rollback baseline snapshot state.

4. Part 2: Complete Deliverable Assets & Production Templates

To verify the network health of our isolated lab workspace, we will deploy a network validation shell script. The section below describes how this bash script is constructed, followed by the final consolidated script code.

Step-by-Step Script Construction

Step 1

Define Script Interpreter & Target IP Configurations

Setup standard shell safety controls and define variables mapping the target VM hosts in memory.

#!/usr/bin/env bash set -euo pipefail KALI_IP="192.168.56.10" WIN_IP="192.168.56.20" METASPLOITABLE_IP="192.168.56.30" HOST_GW="192.168.56.1"

This sets up the bash shell path, configures error handling behaviors, and maps the static IP addresses of our virtual lab system to local variables.

Step 2

Verify Local Network IP Assignment

Extract the current active IP address from the eth0 interface to verify that the static IP allocation is correct.

MY_IP=$(ip -o -4 addr show eth0 | awk '{print $4}' | cut -d/ -f1) if [ "${MY_IP}" != "${KALI_IP}" ]; then echo "Error: Kali IP configuration is ${MY_IP}, expected ${KALI_IP}." exit 1 fi

This command inspects interface eth0 address tables, parses the active IPv4 setting, and stops execution if it doesn't match the assigned static address.

Part	What It Does
`-o`	Output — saves the response body to a file instead of printing to terminal
`addr`	Address subcommand — shows or manipulates IP addresses on network interfaces
`show`	Display the current network interface configuration

Step 3

Perform Connectivity Pings & Validate Isolate State

Ping the target Windows/Linux hosts on the internal subnet, and check public routing tables to verify external internet isolation.

ping -c 2 "${WIN_IP}" &>/dev/null && echo "Windows VM: ONLINE" || echo "Windows VM: OFFLINE" ping -c 2 "${METASPLOITABLE_IP}" &>/dev/null && echo "Metasploitable VM: ONLINE" || echo "Metasploitable VM: OFFLINE" if ping -c 1 -w 2 8.8.8.8 &>/dev/null; then echo "CRITICAL WARNING: Lab is NOT isolated! Internet route detected." else echo "Success: Lab Network is isolated." fi

This block tests network routes to the targets, outputs online status markers, and checks if external packets slip out to the public internet.

Part	What It Does
`-c`	Count — specifies the number of ping packets to send (Linux only)
`ping`	Sends ICMP Echo Request packets to test network connectivity to a host
`-w`	Write — saves captured packets to a file (pcap format) for later analysis
`status`	Shows the current running state and recent logs for the service

Combined Automated Script

Save the compiled block below inside your Kali VM as /home/student/Scripts/verify_lab.sh, make it executable, and execute the verification test:

$ chmod +x /home/student/Scripts/verify_lab.sh && /home/student/Scripts/verify_lab.sh

This command marks the script file as executable and runs the validation checks in the local shell.

Code Breakdown — Line by Line

Copy

Line 1: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

#!/usr/bin/env bash

Line 2: This is a comment that describes what the code does: "!/usr/bin/env bash". Comments start with # and are ignored by Python.

# verify_lab.sh - Cybersecurity Sandbox Network Validation Utility

Line 3: This is a comment that describes what the code does: "verify_lab.sh - Cybersecurity Sandbox Network Validation Utility". Comments start with # and are ignored by Python.

set -euo pipefail

Line 4: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

KALI_IP="192.168.56.10"

Line 5: Creates a variable called KALI_IP and assigns a value to it. Variables store data for use later in the program.

WIN_IP="192.168.56.20"

Line 6: Creates a variable called WIN_IP and assigns a value to it. Variables store data for use later in the program.

METASPLOITABLE_IP="192.168.56.30"

Line 7: Creates a variable called METASPLOITABLE_IP and assigns a value to it. Variables store data for use later in the program.

HOST_GW="192.168.56.1"

Line 8: Creates a variable called HOST_GW and assigns a value to it. Variables store data for use later in the program.

echo "========================================"

Line 9: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

echo "Cybersecurity Sandbox Network Validation"

Line 10: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

echo "========================================"

Line 11: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

# 1. Local Interface Verification

Line 12: This is a comment that describes what the code does: "1. Local Interface Verification". Comments start with # and are ignored by Python.

MY_IP=$(ip -o -4 addr show eth0 | awk '{print $4}' | cut -d/ -f1 || echo "none")

Line 13: Creates a variable called MY_IP and assigns a value to it. Variables store data for use later in the program.

echo -n "Checking Local IP Interface... "

Line 14: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

if [ "${MY_IP}" = "${KALI_IP}" ]; then

Line 15: A conditional check — the code inside this block only runs if the condition evaluates to True.

echo "OK [${MY_IP}]"

Line 16: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

else

Line 17: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

echo "FAILED (Active: ${MY_IP}, Expected: ${KALI_IP})"

Line 18: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

Line 19: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.

# 2. Inter-VM Ping Verification

Line 20: This is a comment that describes what the code does: "2. Inter-VM Ping Verification". Comments start with # and are ignored by Python.

✓ Complete Combined Script: All lines explained above are combined into the full script shown below. Copy and paste the entire script into your file.

Copy

#!/usr/bin/env bash
# verify_lab.sh - Cybersecurity Sandbox Network Validation Utility

set -euo pipefail

KALI_IP="192.168.56.10"
WIN_IP="192.168.56.20"
METASPLOITABLE_IP="192.168.56.30"
HOST_GW="192.168.56.1"

echo "========================================"
echo "Cybersecurity Sandbox Network Validation"
echo "========================================"

# 1. Local Interface Verification
MY_IP=$(ip -o -4 addr show eth0 | awk '{print $4}' | cut -d/ -f1 || echo "none")
echo -n "Checking Local IP Interface... "
if [ "${MY_IP}" = "${KALI_IP}" ]; then
  echo "OK [${MY_IP}]"
else
  echo "FAILED (Active: ${MY_IP}, Expected: ${KALI_IP})"
fi

# 2. Inter-VM Ping Verification
echo -n "Pinging Gateway (Host Adaptor)... "
if ping -c 2 "${HOST_GW}" >/dev/null 2>&1; then
  echo "REACHABLE"
else
  echo "UNREACHABLE"
fi

echo -n "Pinging Windows Server Target (${WIN_IP})... "
if ping -c 2 "${WIN_IP}" >/dev/null 2>&1; then
  echo "ONLINE"
else
  echo "OFFLINE"
fi

echo -n "Pinging Metasploitable Target (${METASPLOITABLE_IP})... "
if ping -c 2 "${METASPLOITABLE_IP}" >/dev/null 2>&1; then
  echo "ONLINE"
else
  echo "OFFLINE"
fi

# 3. Isolation Integrity Check
echo -n "Validating Network Isolation Status... "
if ping -c 1 -w 2 8.8.8.8 >/dev/null 2>&1; then
  echo "WARNING: Lab is NOT isolated from internet!"
else
  echo "ISOLATED (Success)"
fi
echo "========================================"

5. Deliverables Summary

Students must produce and verify the presence of the following artifacts to complete the lab submission requirements.

Created Files / Configs

VirtualBox virtual machines: Kali-Linux-Attacker, Windows-Server-Victim, and Metasploitable-Target
/home/student/Scripts/verify_lab.sh - Network health validation script on Kali
Virtual Machine snapshots: Clean Lab Baseline snapshot created for all target and attacker hosts

Verification Artifacts / Execution Proof

Output of /home/student/Scripts/verify_lab.sh confirming connectivity routes and isolation status
Screenshots showing vboxnet0 IP settings in Network Manager
Screenshot of the snapshot manager in VirtualBox showing baseline states saved

6. Closing Explanation: Why We Did This & What It Accomplishes

Architectural Intent & Operational Impact

Why We Did This

Virtual sandbox environments provide a completely safe, legal playground where students can execute port scans, exploit templates, and digital forensics commands without risking disruption to production subnets.
Host-Only networking removes the virtual NAT router gateway to external domains, containing packet flows entirely inside the host and blocking malware callouts.
VM Snapshots enable instant rollback capabilities, protecting students from losing access to virtual systems if configuration errors or malware incidents corrupt OS components.

What This Accomplishes

Establishes a baseline cybersecurity training environment that mirrors professional security laboratory designs.
Prepares students to manage network cards, configure static routes, and verify system connectivity.
Minimizes troubleshooting overhead in later exercises by ensuring a standardized, repeatable system state.