Building a home lab for pentesting practice

You don't need a rack of servers to practice offensive security skills legally — a single machine with a hypervisor and a couple of VMs is enough to get started, as long as it's properly isolated from your real network.

Isolation first

Put the lab on its own virtual network with no route to your home LAN or the internet, except through a controlled gateway VM if you need updates. The goal is that nothing you run inside the lab — even something that misbehaves — can touch anything outside it.

A minimal stack

• Hypervisor: VirtualBox or a type-1 hypervisor like Proxmox if the hardware supports it.
• Attacker VM: a Linux distro with the usual toolchain (network utilities, a proxy for intercepting traffic, scripting languages).
• Targets: intentionally-vulnerable VMs built for practice, or your own small app deployed for self-testing.
• Snapshots: take one before you start each session so a broken VM is a two-minute revert, not a rebuild.

What to practice

Rotate through phases deliberately instead of jumping straight to exploitation: enumeration and service identification, reading source or config where available, trying one hypothesis at a time, and writing down what worked and why. The writeup is often more valuable than the exploit.

Everything above assumes targets you built or explicitly licensed for practice — the isolation matters precisely so nothing leaks outward.