How To Setup A Virtual Penetration Testing Lab Video Lecture | Get to know Ethical Hacking (English) - Software Development

[Music]
hey guys hack exploit here back again
with another video and welcome to the
complete guide on how to set up your own
virtual penetration testing lab where
you can practice all your skills and
where you can practice or all your
skills and obviously improve as you move
along now I just want to pass out a
quick announcement that regarding the
ss7
exploitation video I'm currently working
with YouTube to get it accepted of
course I'm not going to be able to
monetize it but I'm still forcing it or
trying to make sure that it gets
published on YouTube if that's not the
case I'll have to host it on my website
so then you can check it out over there
reason being is that YouTube does not
allow any demonstration of of
exploitation of a system that you do not
own and in the video I explained and
show you how to exploit a GSM network
and and that type of thing that being
said welcome to this video in this video
I'm going to be showing you how to set
up your own virtual penetration testing
lab so you can practice your skills now
before we get started I just want to
point out that if you're installing Kali
Linux or parrot OS whatever
penetration testing distribution that
you decide if you're installing it on a
physical machine then it'll still be the
same for you as long as you have enough
computers to run Metasploit able as a
server or if you if you then tend to go
into virtualization which is my
recommended option especially nowadays
because computers are much faster and
they're they're able to handle
virtualization much much better alright
so let's get started and what we're
gonna be doing is I'm going to be taking
you through the different virtualization
softwares
we're then going to move on to to
actually selecting your penetration
testing distribution and then I'll show
you how to get your exploit able or your
your your vulnerable operating system or
vulnerable server which in this case is
Metasploit able to alright let's get
started so as I said the first thing
that you want to make sure you have
already or you want to make sure that
you have Hardware wise is
you have enough system resources now I'm
just gonna go ahead and say it the most
important thing you need is
virtualization if your processor does
not support virtualization and that
means that you cannot or you are unable
to use a virtualizing or a
virtualization software okay now this is
not very common because even the older
you know processes like the Pentium and
the co2 dears they all support it and
some of the older AMD processes it's a
very very common feature to have any
processor have virtualization okay now
this will work on any operating system
you could be running mac OS you could be
running Linux and if you're running
Windows it'll be the same thing right
here okay so as you can see I've got
these these files on my desktop and I'll
be explaining them as we move along now
let's get started with virtualization
software now I'm gonna start off with my
favorite and what I recommend to you
right now alright and that is VMware no
you don't have to buy VMware by the way
quick announcement I'm going to be doing
a giveaway probably when we hit 70 or 80
thousand subscribers I'm gonna be giving
away five legitimate serial keys for
VMware pro so that you guys can also get
started with it because I've invested in
it and it's absolutely fantastic
alright but if you want to use the free
one I apologize for my phone
notifications here let me actually just
turn that on silent that being said
there is the free free version and the
website will be linked in the
description so you can check it out for
yourself okay so let's get started with
the download so you can go to the
left-hand side here and click on
downloads alright now if you look at
product downloads it'll show you all the
products they have you can then go to
the free product trials and demos okay
you want to look for that that all to do
with demos if you want to try it VMware
Workstation pro quad and try it you can
have a trial you then want to go to your
free product downloads where you have
workstation player that is the free
version and you can use it as much as
you want the difference between the free
and pro version is that the pro version
has more features in regards to to just
making things easier when it comes down
to virtualization so you can you can
recover you know all that good stuff and
probably make a video on the differences
there but if you're a beginner you don't
have to spend money on the professional
version trust me I use the free version
and I've used it in many many enterprise
situations and it worked perfectly okay
so you just want to click on one of the
options here so for example workstation
play and just let it load apologize for
my slow internet if you know for some
reason it always is slow so there you
are you can download it for windows
64-bit operating systems and you want
four you can select your option here for
linux now if you're not interested or
you don't like vmware you can go for
VirtualBox virtual box was my favorite
but after a while it just has too many
compatibility issues especially with
kali linux and i'm going to be getting
to do that in a second alright so
VirtualBox is is essentially free and
you can use it on linux you can use it
on windows all that good stuff now if
you're running mac OS what i would
recommend is that you use a software or
a program called parallels i'm sure
you've heard of it if you've been using
a mac because that that's essentially
the only alternative to a virtualization
software on the mac OS platform okay so
don't worry if you're running a Mac it's
essentially the same process just open
up our parallels and you should be good
okay so with VirtualBox is it's
completely free and you just can just go
into downloads don't worry the link will
be in the description and you want to
look for the VirtualBox the latest
platform packages and for some reason
the windows hosts is not available right
now so you can oh by the way they also
added the u.s. X I believe that was
added probably around the version 5
sorry about that so you can also use
VirtualBox on Mac OS you can also use it
on Linux and Solaris so again the it's
very simple just download it and get it
installed ok so once you've chosen your
virtualization software now it is one of
the most daunting it's one of the most
complicated II well in my mind is not
really complicated but for many
beginners it's probably the most fidgety
topic and that is selecting your
penetration testing distribution now I'm
going to recommend one of two and
is Kali Linux so you can use part power
to us or you can use Kali Linux now a
lot of people ask me or send me my
messages and you know post their
comments in the description in the
comment section saying which one is
better why it's better then there's
always arguments heated arguments all of
that and here's what I say okay I was in
the same dilemma trust me and well
mostly the time I got started there was
only one there's backtrack that's it so
you had to learn it or you know that's
that so again I would say just choose
one and stick with it now most people
will say start with Kali master Kali
then you can use Paradis because it's
essentially the same functionality is
transferred over it's just that the
difference is the operating system and
the kernel and all of that so it's it's
very little to do with are the the tools
because the tools are you know on all
the platforms so again it's all about
what you like so here's what I'm gonna
say download each of them and then try
which one you like okay so maybe you can
try Kali if you don't like it try parrot
part is something yet you may like and
do not be confused and do not be scared
of making the decision once you've made
the decision stick with it and if you
have any problems then try and
troubleshoot it if you can't switch to
the other one alright and in my opinion
I'll say this that Kali Linux is and is
an enterprise type of operating system
especially now so it is what you I would
call a industry standard all right now
parrot OS is fantastic there is no doubt
about I've used it for many many
projects real-life projects and I can
tell you that it does work but when you
move on to a professional level I would
recommend Kali Linux because it is the
benchmark and it is sort of required
because they are not gonna allow you to
just test systems or employers are not
gonna allow you to test systems with
tools that are not familiar that's what
I was also talking about you know
installing all these weird scripts isn't
really going to help because you have to
know how to use the industry standard
tools okay so you can choose between
Kali Linux and parrot OS now when it
comes to black or canned bakbox all of
that all of these other distributions
I'm not really going to include them
because that's again a matter of
personal taste okay so getting back to
Kali in the next I just want to talk
about something for power to us the
download is very soon
or just go to download' and you have
three versions okay you have your
security which is the one you want to
get you then have workstation which
again is focused is the lightweight
system for daily use and privacy
protection so it offers a solution for
casual users as you can see who love the
look and feel of part you then have part
security which is a complete all-in-one
environment for pentesting privacy
digital forensics reverse engineering
and software development so again it's
focused on all of those facets and
that's why I kind of like it and I've
tried it out but for me I'm not really
doing you know digital forensics or
reverse engineering I've some of you
might be doing it and if that's your
field then by all means go ahead and use
power to it okay now let's get back to
let's get back to Kali Linux and I just
want to talk about the downloads now if
you're installing Kali Linux in a
virtualized environment I'm just gonna
show you a little tip here that will
save you a lot of time do not download
the ISO file all right many people have
seen make this mistake and I've made
made only a video an installation video
of Kali Linux showing you how to install
it using the ISO even on a virtual
machine and you can see it's just really
really hectic so why would you want to
go through that what I recommend is just
download the VMware virtual machine or
the VirtualBox virtual machine alright
as you can see you have your VMware your
64-bit and your 32-bit and the same for
VirtualBox so for those of you are
telling me it doesn't work on 64 or on
32-bit you can see here that indeed it
is real and it is working so once you
download one of these dependent on the
virtualization software using so for
example I've downloaded or I had the the
virtual the VMware version also you know
in a few seconds out easy it is to get
it set up so this virtual machine is
already installed you don't need to go
through the installation of Kali it's
already installed you just need to
import it into your virtual machine and
that's it and that's that you get
started immediately same for VirtualBox
now for the rest of the video I'll be
continuing with VMware and that's
because as I said I've kind of lost the
liking for VirtualBox and I have
that's no offense to VirtualBox I just
like VMware because it's never let me
down and there aren't any compatibility
issues with installing the you know the
libraries or all of that you know so
going back to part as you can see that
the latest version as of recording this
video is part to us 3.11 okay and you
have your 64-bit and your 32-bit and
this is essentially the is whoo all
right so the ISO for pirate is really
very simple to install or to create a
virtual machine all you need to do is
open up your virtualization software and
said I'm going to be continuing with
VMware Pro and you can see also have the
VMware Workstation 14 player so if I
just open up that or actually have it
open sorry about that for some reason I
opened it another instance there so let
me just show you something I've already
opened it up and you can see these are
the two virtual machines that I always
have running one of them is Kali the
next don't worry about the title I have
updated it so you can edit your virtual
machine settings there and we'll get to
that in a second all right so I have
canned Linux and Metasploit able to now
don't worry about this if you want to
create a new virtual machine just going
to file new virtual machine go for
typical and next you want to then select
your ISO image as you can see - for some
reason selected in bull - ISO suggested
next we'll use that as an example so
then it's going to prompt you if you're
running Ubuntu to enter your full name
your username and password in most cases
if you're running pair to us it's not
going to prompt you to do that okay but
as I said if you're running this on a
virtualized space of software if you
want to run this in terms of
virtualization then download do not
download the ISO unless you're using
petrest download the virtual machine
file here because that automatically
imports and I'll show you that in a
second so let's say I've downloaded the
VMware file here I can just click on it
right here as you can see once I click
on it
I already have it so it's not gonna
prompt me but they it's going to prompt
me again to to re-import it and that's
going to essentially wipe your current
hard disk if you already have one
installed if you just hit import and
select the destination and that's that
you don't have to install it once it's
imported you're going to be given this
beautiful menu here giving you the
version again you can edit it and change
the name and it's gonna give you this
awesome description here saying this is
the username is root
the password is tor and the keyboard
layout is us all right so that's
information that you can just check out
and gives you the IRC Channel
all that good stuff okay so it's gonna
give you this little menu here excellent
so now you can edit your virtual machine
settings which is what we're going to be
talking about now okay but before that
let me show you how to download your
vulnerable operating system which in
this case is Metasploit able to now a
lot of people have asked me to do the
Metasploit about three video and the
reason i haven't done it yet is because
man that thing has bugs like i've tried
it i installing it on my computer and it
worked after five hours of configuring
it I then tried to try to do it on
another computer the same way that gave
me success on one computer and it didn't
work so it it it it's come to my
attention that you need to configure it
individually for every computer and a
video therefore will not be a good so
I'll make a post on my website regarding
how to select the appropriate settings
okay so again it's very dependent on
your hardware and you need to be really
attentive when installing it it's just a
pain in the neck what I would recommend
is just using Metasploit to go to and
installing your own tools on it or using
CTFs alright so you want to open the
link in the description that takes you
to the Metasploit about to page it's
developed by rapid7 which as you know
created Metasploit alright and I'm sure
you know about the Metasploit framework
and you can just go ahead and look at
the download page here you can go for
the rapid as a download page or the
source for the download page and just
click on it and it's gonna prompt you to
download it alright so once you have the
downloaded it's gonna be a zip file on
your desktop right here so I'm just
gonna extract it this Metasploit able to
it's gonna extract it to my desktop and
as you can see this runs exclusively so
let it let it just open up because I
really want to show you what I mean all
right
so let that just extract I apologize for
the speed although the file a drastic
even on all computers that have tried
this on it always is a quite a hefty
extraction process probably because it
was zipped very very thoroughly
okay so I'll let this complete and we
can just move back into our virtual
machines here all right so I already
have met exploitable imported we'll be
looking at these settings you need to
set and then we'll be looking at the
network configuration
okay so Metasploit able to has
successfully been extracted and as you
can see here this is a virtual machine
disk file so you can just click on it
and it will import it to the system the
same way so if I click on it you can see
oops sorry about that if I just click oh
my bad sorry you actually have to open
the virtual machine file there and that
will prompt it to open directly from
there alright so I already have one that
has all my data saved there so I'm not
going to do that okay so that once
that's imported let me just get rid of
that because I don't need it right now
now we can get started with the virtual
machine settings very important so make
sure you have Kali Linux opened in one
tab or part OS and you have met
exploitable to open another tab now
let's start off with Kali Linux these
settings here alright so you want to go
into edit virtual machine settings now
as I said you must have I would say at
least four gigabytes of RAM alright and
the reason being his Kali Linux works
great with 2 gigabytes if you have more
system if you have more RAM you can then
increase it to whatever you like now if
you're running a one gig or I mean a two
gig computer that has 2 gigs of ram do
not worry you can reduce it to one gig
as well but it will then be really slow
and you won't be able to open up
programs or you know Metasploit will
take a huge amount of time to start up
all right
that being said if you have a 4 gigabyte
a computer just leave it at 2 and if you
have 8 or 16 it doesn't matter just
leave it at 2 it works really great
there unless you start doing things like
reverse engineering you know things that
are very resource hungry in the RAM
Department ok so you then want to go
into your processors now this is again
very dependent on your hardware
specifications and your processor more
specifically so if you have a dual-core
processor
recommend is just using one okay now you
can select the number of cores per
processor and that essentially is hyper
threading okay
so right now as you can see I've put two
processes and that theoretically is
wrong because I only have one processor
now if you're running a server type of
workstation that has two sockets on the
motherboard you can then select it from
there all right so I'll just explaining
that many people put this because they
think they have a quad core that is for
not really okay so you want to make sure
you select one processor now I'm
guessing that's what most of you have
and then you want to select the cause
all right now my processor has four
calls alright so I'm gonna select two
that gives me an optimal performance now
if you want to give it all four it will
work great but then you are your host
operating system will not work as
efficiently as possible so I would
recommend to if you have a quad core if
you have a dual core you can use one one
core and that's perfectly fine all right
or you can use two and you can just turn
off what's running in the background so
that's how I like mine right there
alright as for your hard disk you can
you can you can currently look at these
sites that it gives you it's around 60
gigabytes you can then also expand the
disk capacity depending on the type of
files you are using so again you can
expand it if you so choose to and you
also have your disk file location right
there alright if you only is a CD or DVD
drive which I'm guessing you don't you
don't need to touch anything there and
now for the network adapter settings now
a lot of people get confused here what
we want to do is we want to make sure
that that the virtual machines both Kali
Linux and Metasploit able or pair to us
depending on what you're using are
connected to the physical network that
means they are using your adapter your
computer's host adapter whether it's a
Wi-Fi adapter or it's an Ethernet
adapter right now you can see I'm using
that so what this means it's going to
share the hosts IP address now what this
means if I was to leave it on that that
would mean that if I launched Kali Linux
and I also launched Metasploit ball they
would have the same ip address as the
host IP address so it will have the same
IP as Windows now most people think
that's okay no you do not want that you
want each virtual machine to have its
own IP address and you do that by going
for a bridged connection and then
replicate physical network connection
say that will make sure that it
replicates the fact that it's on Ethan
if it's on Wi-Fi it's going to also
display it as Wi-Fi and they'll all have
their own IP addresses their own local
IP addresses okay so this very important
make sure it's set to bridged all right
awesome
once that's done you can play around
with your USB compatibility if you have
the USB three drives that you want to be
using you can also do that as well and
you have your display settings now again
this is something that many people ask
me should I use accelerate 3d graphics I
would recommend that you do if you have
a dedicated graphics card however if you
have an APU or an integrated graphics
card then I would urge you to shy away
from this now many people will ask me
how do I use more than one monitor
because I have a triple monitor or a
dual monitor setup and you can just
specify the amount monitor settings
depending on how many monitors you have
and you can select the resolution so
it's really that simple now that's all
the tough stuff
let's hit okay those are the settings
for Kali Linux you know we're going to
Metasploit ball 2 which again I want to
just show you a few settings go into
edit virtual machine settings and you
want to go into the memory now in my
opinion ok you need this is very
important if you're using Metasploit
able to on your own that means you're
the only one connecting to it then you
can change the RAM up to even 256
megabytes but if you are setting it up
for your class all right and let's say
you want your students or your friends
will try and use it at the same time
remember Metasploit able to here is
acting as a server now servers depending
on the amount of requests and the amount
of processes it is processing will
require more RAM it's the it's like for
example let me just use a stupid analogy
it's like Minecraft
alright minecraft servers usually have
about 8 to 16 gigabytes of RAM and
that's because they are processing or
they are handling a lot of requests that
are being sent by the players now the
more players you have or the
users you have the more RAM you'll need
so again feel free to change it to even
128 megabytes because again you're just
going to if you're the only one using it
you don't need a lot and don't worry
about the recommended settings because
as you can see it's going to give your
recommended suggestions dependent on
your memory configuration so I like
leaving it at 512 because I'm usually
testing it with a few other friends of
mine
and we are trying to do a few other
settings with CTF we're actually trying
to create our own CTF website that's
something I shouldn't have actually told
it because I was keeping in secret but
don't worry that's coming out soon as
for the processor I like keeping this to
one one processor and one core so that
it just uses one processor because again
the process is very very minimal
depending on what you're doing the hard
disk space is 8 gigabytes if you're
installing your own files you can expand
it to what you want now as for the
network adapter make sure that it's
bridged and make sure that both options
if it prompts you for a dual network
adapter configuration make sure that
they are both bridged alright and once
that's done you can just hit OK and you
don't need to really use accelerated 3d
graphics because net exploitable is a
command-line and lacks it lacks a
graphical user interface ok so now that
we've set up all our settings now we can
power on Kali Linux and we can also
power on Metasploit able to ok there we
are so it's prompted me to start up
Kandy Linux excellent and Metasploit
Apple is also starting as I said they do
not have Metasploit able to does not
have a graphical user interface so I'll
show you how to log in and how to get
your local adapter alright so let Kali
Linux start up there it should be
starting up any time right now there we
are
Metasploit able to has started up and
it's starting the clock and the event
managers that start up this is checking
my disk yeah the story device yeah story
device is clean and the blobs also
looking good alright so give it a few
seconds to startup and I think Canada
next should have started up by now
and there we are let's just wait for
them both of them start up now let me
explain a few thing
with virtual of VMware Pro are the great
thing that I like is you can create a
full-screen mode immediately and that's
the also another great thing is if you
use the virtual machine file the Kali
Linux virtual machine file it already
has the VMware guest additions installed
so you don't have to install it you're
essentially you're good to go and you
can run it in full screen and you know
you can it's well optimized I am going
to be making another video on how to
configure VMware to work great with Kali
Linux because a lot of you guys have
been telling me that it's slow and I
also had this problem and F's and I
sorted it out ok so I think Kali Linux
should have started you'll know that it
started because you'll see the black
mouse pointer there Metasploit a table
has started so it's gonna say here never
expose this virtual machine to an
untrusted Network that's very very true
do not do that and you can log in with
the MSF admin combo alright so the
username is MSF admin and the password
is MSF admin whoops sorry about that
there we are
and once we are logged in it should tell
you welcome and there we are as you can
see it is running on Ubuntu or Debian
and let that just sit as it is and there
we are we're in Kali Linux right now and
the username as I said is root and the
password is tor alright now you can add
your own username if you want to and
essentially you have full control over
the system the default username and
password is root and tor alright so give
that a few seconds to start up and I'll
go into full-screen mode in a second let
me just clear up myths first of all here
by the way if if you have clicked in the
virtual machine you can see that my
mouse pondtest as they disappeared if
you want to exit out of the virtual
machine and go back to your host
operating system use the ctrl + Alt key
and that will take you back there
ok so there we are we have candy Linux
over here
and now you can go into view and hit
fullscreen and they give it a few
seconds to scale let me just move my
folder back there and voila now again if
you're using Wi-Fi it should show up as
well as a wireless
you should see a wireless adapter it's
going to be using the same bridged
adapter as your host operating system so
what we're gonna do is I'm just gonna
hit ifconfig here like so and as you can
see my local IP is 192.168.0.1 to make
sure that they are running under the
same subnet so the subnet will be one
ninety two point one sixty eight point
zero or one or two depending on how many
access points you have let's make sure
they're on the same network so when it I
have configure ifconfig and as you can
see it's running on the same network or
the same subnet which is one ninety two
point one sixty eight point one point
105 and there you are they can now
communicate with each other so for
example if I said let me just run a
simple whoops and map OH
one ninety two point one sixty eight
point one point let me just check the IP
here 105 all right so 105 oops my bad
105 and I'm just gonna enter let's see
what it is able to bring up let me
expand that as you can see it's gonna
scan the metas political to virtual
machine and it's gonna give me all this
information I essentially scanned for
the operating system version it's gonna
give you a MAC address all that good
stuff and this is just a simple nmap
scan to show you that you can now work
on your virtual machine alright so that
is how to configure Kali Linux with
Metasploit able to and again the great
features that I really like are that I
can you know suspend the guest I can
take snapshots and you know go back go
go go forward if I have a mock up and
you get the idea now this video has been
going on for a long while now and I'm
gonna end it right here by saying thank
you guys for all the support on the
channel a lot of you guys have been
asking me for this video and how to show
you how to configure your own virtual
penetration testing lab we're going to
be looking into CTS in the future and
I'm gonna be continuing the web
application penetration testing series
so that's gonna be it for this video I
hope you enjoyed it or you found value
in it if you did please leave a like
down below if you have any questions or
suggestions let me know in the comments
section or on my social networks on my
website and I'll be seeing you in the
next video
[Music]