Building a lab you own and cannot accidentally escape

This lesson maps to no PT0-003 objective. CompTIA does not examine building a lab, and this course will not pretend otherwise. It is here because every hands-on lesson that follows — 2.1 through 2.4, 3.1 through 3.3, 4.1 through 4.5 and 5.1 — needs somewhere to run, and the only somewhere this course will name is a machine you own. Build this once and the other forty have a target.

Why this matters

Every other course in this series could be read on a train. This one cannot, because the skills PT0-003 examines are things you do to a computer, and doing them to the wrong computer is a criminal offence in most of the world.

That is not a disclaimer bolted onto the front. It changes the shape of the course. A lesson on SQL injection cannot say "try this against a site you find"; a lesson on password spraying cannot hand you a wordlist and a login page. Each one has to assume you have somewhere safe, and this is where you get it.

There is a second reason, and it is the one that matters for the exam rather than for the law. A penetration tester who has never watched an attack from the defender's side writes bad reports. Domain 5 asks you to produce an attack narrative and remediation advice; both require knowing what the target logged while you were working. You only see that if you own both ends.

The lesson

An isolated network with no route to anything you do not own

The requirement is stronger than "a virtual machine". It is a network segment whose traffic cannot leave, so that a mistyped target or an overly broad scan range hits nothing real.

In practice that means a host-only or internal virtual network in your hypervisor — the mode where guests can reach each other and the host, and nothing else. Not NAT, which routes to the internet through your host. Not bridged, which puts your deliberately-vulnerable machine on the same network as your router, your phone and your neighbours.

Two rules follow, and they are worth writing on the lab itself:

• The vulnerable machines never get internet access. If one needs updates, it gets them once, on a different network setting, and then goes back.
• The attacker machine may need internet for tool installation. Give it two interfaces rather than changing the lab's mode: one internal for attacking, one NAT for downloading. Then a careless nmap against the wrong interface still cannot reach anything real.

Attacker and target virtual machines, and a snapshot to return to

Minimum viable lab: one attacker, two targets.

• Attacker — a security-focused Linux distribution, or any Linux with the tools installed by hand. The tools CompTIA names — Nmap, Wireshark, Nessus, Nikto, OpenVAS — all run here.
• A Linux target — something deliberately weak, for the privilege escalation and service exploitation work in Domain 4.
• A Windows target — because half of Domain 4's host material is Windows specific, and reading about tokens and SeImpersonate is no substitute.

Snapshot every machine the moment it is built and working, before you attack anything. This is the single habit that makes the rest of the course practical. Exploitation breaks things — that is what it is — and a lab you cannot reset becomes a lab you stop using after the third time you have to rebuild it. Take a second snapshot after each lesson's setup so you can return to a known state without redoing the install.

A deliberately weak application, installed locally and named

For the web material in 4.4 you need something with real vulnerabilities in it. There is a whole category of applications built to be attacked, published by their authors for exactly this purpose.

Two conditions this course puts on them:

1. It runs on your machine, not someone else's. Several of these projects also offer a hosted version. A hosted target is somebody else's infrastructure, and the fact that they invited attacks does not make their rate limits, their terms or their other users your business.
2. Read its licence and honour it. You are going to write about what you found. Knowing what the thing is and who made it is the same discipline that makes you cite a CVE properly in a report.

Proving the isolation before you attack anything inside it

Do not take the hypervisor's word for it. The check is thirty seconds and it is the difference between a lab and a liability.

From a target machine, confirm that it cannot reach:

• the internet by address, not just by name — a DNS failure can hide a working route
• your home router's management address
• any other device on your real network

From the attacker machine, confirm that it can reach the targets, and then confirm what its scanning interface sees: if a broad sweep of the lab range returns hosts you did not build, the interface is not the one you think it is.

Do this again after any change to the hypervisor's networking, and after every host OS update. Isolation is a configuration, and configurations drift.

Why every later lesson refuses to name a target outside this lab

You will notice, from here on, that no lesson in this course gives you a hostname, an IP address or a URL to attack. That is deliberate and it is not timidity.

A published target in a lesson is an instruction that thousands of readers may follow simultaneously, at a host that did not agree to it. It would also teach the wrong reflex for the job: on a real engagement, the scope document names your targets, and anything not in it is out of bounds no matter how interesting it looks. A tester's instinct should be to ask "am I authorised for this?" before "can I get in?" — and a course that handed out free targets would be training the opposite instinct while claiming to teach the first.

So the lab is the target, always. Where a lesson needs a specific weakness, it tells you how to create it on a machine you own.

What to take into the exam

• The exam will not ask you to configure a hypervisor. It will ask questions whose right answer depends on having seen what a scan, an exploit or a pivot actually does — and on knowing what the target recorded.
• Scope discipline is examinable and is tested in Domain 1. The habit starts here: the lab is the first scope document you will honour.