Stocking It With Targets

The previous lesson, networking-your-lab, built an isolated segment: the attacker box and its targets can reach each other, and nothing on that segment can reach the house network or the internet. The segment works. It is also empty. A host-only network with a single machine on it has nothing to point a scanner at, and reading about an attack is a long way from running one.

This lesson fills the empty segment: where to get machines and applications that were built, on purpose, to be broken into, how to confirm the file that arrived is the one the author published, and which ones are worth starting on.

What makes something a legal target

The word target carries a warning straight from the first lesson in this module, why-you-need-a-lab: attacking a machine without the owner's permission is a crime, and a machine sitting on the public internet with an obvious hole in it is still someone's machine. A legal target is not "a computer with a vulnerability." It is a computer whose owner published it so that strangers would attack it.

Two conditions have to hold, and they are separate. The first is authorization: somebody built the thing to be broken into and released it under a license that says so, a standing grant of permission to attack it. The second is containment: it runs inside the isolated lab from the last lesson, where anything it does stays caged. Miss authorization and the exercise is a crime no matter how isolated the lab is. Miss containment and a deliberately broken app is now reachable from the wider network, an accident of a different kind.

Deliberately vulnerable software is a small, well-mapped field. VulnHub is the community archive: hundreds of vulnerable virtual machines, free to download. OWASP, the group behind a lot of open security tooling, publishes two standard practice apps, Juice Shop and WebGoat. DVWA, the Damn Vulnerable Web Application, is a separate long-running project. Metasploitable is a whole vulnerable operating system from Rapid7, the company that makes Metasploit. None of these hides what it is: each one announces in its own README that it is broken by design.

Two shapes of target

Targets come in two shapes, and picking between them is really a choice between rooting a whole machine and drilling one class of bug.

A full machine is a complete operating system with services running, users configured, and misconfigurations planted, packaged as a virtual machine. VulnHub distributes these as .ova files, the portable format the hypervisors from the choosing-virtualization lesson import directly. Booting one puts a fresh Linux or Windows host on the network with a hidden path from a first nmap scan, through a foothold, to full root access. That end-to-end path is the point: it is the whole job in one box. Metasploitable 2 is the broad practice range, an intentionally ancient Ubuntu with dozens of vulnerable services. Kioptrix, DC-1, and Basic Pentesting 1 are the well-worn beginner machines, each a self-contained puzzle.

A single app is narrower and faster. Instead of a whole operating system it is one deliberately broken web application, and it runs well as a container rather than a full virtual machine, the lighter option weighed in the choosing-virtualization lesson. Juice Shop is a modern single-page shop stuffed with realistic web flaws. WebGoat is structured as guided lessons, each teaching one bug with instructions attached. DVWA is the plain old drill machine for SQL injection, cross-site scripting, and file upload, with a security level that switches between Low, Medium, High, and Impossible so the same bug can be practiced as it gets harder to reach.

Juice Shop comes up in a single command, most of why it gets recommended first.

$docker run --rm -d -p 127.0.0.1:3000:3000 bkimminich/juice-shop

The 127.0.0.1:3000->3000/tcp in the PORTS column is the whole safety story. That prefix binds the published port to the local host only, so nothing but the machine running the container can reach the deliberately vulnerable app. Writing -p 3000:3000 instead tells the container engine to publish the port on every network interface, quietly undoing the network isolation the last lesson set up. The binding is the software-level echo of a host-only network: same idea, one layer up.

Check the file before trusting it

A VulnHub machine is a disk image built by a stranger and copied across mirror servers the project does not run. Two things can go wrong on the way. The download can arrive corrupted, a few bytes mangled by a flaky connection, in which case the machine will not boot cleanly. Worse, the file on a mirror could have been swapped for a different one by whoever controls that mirror. A checksum catches both.

A checksum is the output of a hash function, a piece of math that reads an entire file and boils it down to a short fixed-length fingerprint. SHA-256 is the common one, and its fingerprint is 64 hexadecimal characters. The fingerprint is fragile on purpose: flip a single bit anywhere in a multi-gigabyte image and the 64 characters come out completely different. The author computes that fingerprint on the real file and publishes it next to the download. Recomputing it locally and comparing the two strings answers one question exactly: is this the same file.

$sha256sum DC-1.ova

That string gets compared, character by character, against the one printed on the download page. A match means the file is the author's file. A single differing character means it is not, and the safe move is to delete it and pull it again from a different mirror. Comparing 64 characters by eye is error-prone, so the honest way is to paste the published value into a file and let sha256sum -c read the expected hashes and print OK or FAILED per file.

There is still a gap. A checksum printed on the same page as the download is only as trustworthy as the page: anyone who could swap the image could swap the number next to it. The fix is a signature. Kali, the standard attacker distribution, publishes its checksums as a file and signs that file with a GPG key only Kali holds. Verifying the signature proves the checksum list came from Kali, not from a mirror.

$gpg --verify SHA256SUMS.gpg SHA256SUMS

The 44C6513A8E4FB3D30875F758ED444FF07D8D0BF6 fingerprint is Kali's real signing key, published on kali.org, and confirming it matches that published value is what makes the signature mean anything. The [unknown] at the end is normal: it means the key is valid but has not been personally vouched for, which is fine here.

A difficulty that can actually be climbed

The common failure here is downloading twenty boxes, staring at the pile, and learning nothing. A shelf of targets is not progress. The better shape is one target at a time, chosen by the skill being practiced, because a target is really a lesson in disguise. A week on web bugs points at Juice Shop, DVWA, and WebGoat, not a full Windows domain. A week on privilege escalation points at a VulnHub machine known for a sloppy sudo rule or an old kernel, or at Metasploitable's pile of bad services.

The first box should be one that other people have written walkthroughs for, so there is a way to get unstuck. Kioptrix, DC-1, and Basic Pentesting 1 all qualify. Opening the walkthrough first, though, throws away the exercise. The value is in the struggle: import the machine, scan it, work the problem, and reach for the writeup only after hitting a genuine wall. WebGoat is the gentlest on-ramp because its vulnerabilities come with the lesson attached, and DVWA's security levels teach more than a new box would, since running the same injection at Low, then Medium, then High shows how a fix changes the attack rather than just handing over a new puzzle.

The segment now has targets on it and the attacker box can reach them. The moment real work starts, those boxes get messy. A rooted machine is contaminated with whatever was done to it, and the temptation to reuse a real password or let a box slip onto the internet shows up fast. The last lesson in this module, snapshots-and-safe-habits, covers rolling a machine back to a clean state, keeping the lab off the internet, never reusing personal credentials inside it, and rebuilding from scratch when something is contaminated beyond trust.