You must never practice security techniques against systems you don't own or have explicit written permission to test. Doing so is illegal in most jurisdictions. Instead, build an isolated home lab.
Only attack machines you own or are explicitly authorized to test (e.g., dedicated practice platforms). Unauthorized access is a crime under laws like the US CFAA, the UK Computer Misuse Act, and India's IT Act.
| Component | Purpose | Free option |
|---|---|---|
| Hypervisor | Run isolated VMs | VirtualBox, VMware Player |
| Attacker VM | Tooling | Kali Linux, Parrot OS |
| Target VMs | Practice | Metasploitable, OWASP Juice Shop, DVWA |
| Host-only network | Keep traffic isolated | Built into hypervisor |
Configure your lab on a host-only or internal network so vulnerable practice machines are never exposed to your real network or the internet. A deliberately vulnerable VM on your home Wi-Fi is an open door.
These are designed and authorized for hands-on learning:
Before each experiment, take a VM snapshot. If you break something or detonate malware, roll back in seconds. Never analyze live malware on your host OS.
Ethics is not optional in this field. The same knowledge that defends a hospital can harm one. Throughout this course we study offensive techniques only to build better defenses. Stay on the right side of the line — your career depends on it.