Prove your lab cannot reach anything you do not own

short · 50 min

Task

Build the isolated network the rest of this course depends on, then prove — not assume — that a target machine on it has no path off the lab at all. This is the lab that makes the other forty safe, and the proof is the route table, not a hopeful ping.

Steps

  1. Create a host-only (or internal) virtual network in your hypervisor. Do not use NAT or bridged mode for the target machines.
  2. Build two VMs on it — one attacker (Linux), one target — and snapshot each the moment it boots cleanly, before anything else.
  3. From the target, prove there is no path off the lab by inspecting the routing table and interfaces rather than by contacting anything real: a host with no default route cannot reach the internet regardless of what it tries, and that is a stronger proof than one ping.
  4. From the attacker, confirm it can reach the target, then sweep the lab range (10.10.10.0/24) and confirm nothing you did not build answers.
  5. Record every result. A default route to a real gateway in step 3 means the isolation is not real and must be fixed before any later lab.

Verify

ip route | awk '/^default/{print "LEAK: default route via "$3} END{if(!/default/) print "isolated: no default route"}'
ip route | grep -qE '^default' && echo "isolated: FALSE" || echo "isolated: TRUE"
nmap -sn 10.10.10.0/24 -oG - | awk '/Up$/{c++} END{print c" host(s) up in lab range"}'

Run the first two from the target VM: the second must print isolated: TRUE. A default route is the usual way a "host-only" network is quietly not isolated, and without one the target has no way to reach anything real even by accident. The third, from the attacker, must equal the number of VMs you actually built — any extra is a host you do not own answering on your lab range, meaning the network is not what you think.

Notes

Re-run these checks after any hypervisor network change and after every host OS update; isolation is a configuration, and configurations drift. Keep the snapshots — exploitation breaks things, and a lab you can reset in seconds is one you will keep using, while one you have to rebuild is one you abandon after the third time. Proving isolation by the absence of a route, rather than by failing to reach a named host, is also why this lab names no real address.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.