How to Set Up a Home Hacking Lab
A home hacking lab gives you systems you fully own to attack and defend — the ideal legal practice environment, running entirely on your own hardware. Because you own everything in it, you can do anything, learn by breaking things, and reset with a click. Building one is a rite of passage and a practical skill in itself.
What goes in a home lab?#
The classic setup uses virtual machines:
| Component | Role |
|---|---|
| Virtualization software | VirtualBox or VMware (free options exist) |
| Attacker VM | Kali Linux or similar, with the tools |
| Vulnerable targets | DVWA, Juice Shop, Metasploitable, VulnHub images |
| Isolated network | Host-only/internal, so nothing leaks out |
You attack the target VMs from the attacker VM, all on your own machine. Because you own it all, everything you do is squarely within the law.
Keep it isolated and resettable#
Two rules make a lab safe and productive:
- Isolate the network. Use a host-only or internal virtual network so deliberately vulnerable machines cannot reach the internet or your real devices. Never expose an intentionally vulnerable VM to the internet — real attackers scan constantly and will find it.
- Use snapshots. Take a VM snapshot before an exercise so you can revert instantly, experiment fearlessly, and start clean each time.
A home lab is your personal, fully-legal proving ground. More at the Careers & Practice hub.
Frequently asked questions#
What do you need for a home hacking lab?
At minimum, a computer with enough RAM to run a few virtual machines, virtualization software (VirtualBox or VMware, both have free options), an attacker VM (like Kali Linux), and one or more vulnerable target VMs. Everything runs on your own hardware, which you fully own — so attacking these systems is completely legal.
How do you keep a home lab safe?
Isolate it from your home and public networks using a host-only or internal virtual network, so vulnerable and intentionally-attacked machines cannot reach the internet or your real devices. Use snapshots to reset VMs easily, and never expose deliberately vulnerable systems to the internet, where real attackers could find them.