Basic Pentesting

Easy

A classic beginner VulnHub box. Full recon to root, the honest way.

Linux-Bring-your-own VM-30 pts

About this target

Basic Pentesting is one of the most recommended first VulnHub boxes because it teaches the loop that never changes: enumerate everything, find the one thing that is weaker than it should be, it, then escalate. No exotic tricks, just discipline.

Authorized target only

This VM runs entirely on your own hypervisor, on an isolated lab . That is what makes attacking it legal. Keep it off any network you do not .

Verify the download

VulnHub mirrors change over time. Open the entry linked in the setup panel, grab the current download, and verify the checksum if one is published before you import.

The loop

Find the target on your network.
Map every open and identify each service and version.
Turn the weakest service into a (user).
Enumerate the box from the inside and escalate ().

Work it yourself first. The hints are here when you are genuinely stuck, and each one costs points, so earn them.

Set up the target

Download the VulnHub image, import it into your hypervisor (UTM / VirtualBox / VMware), and boot it on a host-only or NAT network.

Image: Basic Pentesting 1
Download: VulnHub entry

Import notes

Download the .ova and import it into VirtualBox or UTM. Put it on the same host-only or NAT network as your Kali box so you can reach it. Boot it, then discover its IP from your attacker machine (it does not tell you its address).

Find the target IP on your network

attacker@kali

$sudo netdiscover -r 192.168.56.0/24

Or: sudo arp-scan --localnet, or nmap -sn 192.168.56.0/24

Objectives

0/4

Submit flag

user root

Hints

I booted it but where is it?
I found the host, now what?
Foothold
Root

Walkthrough

The walkthrough unlocks once you capture root (or when the machine retires). No spoilers before then - try the hints first.