Cybersecurity Practice Lab Environment using VirtualBox

Hardware Requirements

Ensure that CPU virtualisation is enabled in your computer's BIOS. My test computer has an i7-1360P processor and 16GB RAM which is sufficient for running a basic lab with 3 VMs (Kali, Ubuntu, and Windows 11). I also installed a Greenbone OPENVAS scanner VM as well.

I recommend buying a fast usb-c portable ssd with 512GB storage (256GB will also be enough). The ssd will get pretty warm when 3 VMs are running together with SIEM tools (Wazuh, Splunk). The vulnerability scanners (Greenbone OpenVAS and Nessus) will take their time to execute too.

VirtualBox

Download and install VirtualBox for your Host OS from:

https://www.virtualbox.org/wiki/Downloads 

Follow the instructions in the user guide: 

https://www.virtualbox.org/manual/ 

Kali Linux

Download the Kali VirtualBox image from kali.org 

https://www.kali.org/get-kali/#kali-virtual-machines 

Select the VirtualBox download option

Follow the instructions on how to import a pre-made Kali VirtualBox VM:

https://www.kali.org/docs/virtualization/import-premade-virtualbox/ 

Refer to the virtual hardware settings in the picture below  

Ubuntu Linux

Download the Ubuntu Linux iso from Ubuntu website

https://ubuntu.com/download/desktop 

Choose Ubuntu 24.04.4 LTS

Create a new VirtualBox image from the iso:

1. Open VirtualBox and click New.

2. Name the VM and select the folder for storage.

3. In the ISO Image field, click to locate and select your downloaded ISO file.

4. VirtualBox will attempt to detect the type and version automatically.

5. Configure Hardware: Allocate RAM and virtual CPUs based on your host machine's capacity.

6. Create Virtual Hard Disk: Allocate storage space for the guest OS, choosing between dynamic or fixed allocation.

7. Start the Installation: Click Start to power on the VM.

8. Follow the on-screen prompts to install the operating system, similar to a physical computer.

9. Post-Installation: Once completed, you may need to go back to Settings > Storage to remove the ISO file, so the VM boots from the virtual hard drive instead of the ISO.

10. VirtualBox Guest Additions: After installation, install Guest Additions for better performance, such as shared folders and screen resizing.

Refer to the virtual hardware settings in the picture below as a guide

Windows 11 Pro

Download the Windows 11 iso from Microsoft windows website

https://www.microsoft.com/en-au/software-download/windows11   

Create a new VirtualBox image from the iso using steps 1-10 above.

Refer to the virtual hardware settings in the picture below as a guide

Configuring the network settings in VirtualBox

Create a new NAT Network from the Network Tab. A NAT Network allows you to create a segmented network for your virtual lab VMs while alaso permitting connection to the internet. Assign the created NAT Network name to all your VMs. 

You can assign a static IP to a VM (e.g. on Ubuntu for Splunk, Wazuh, Nessus, etc) using the VBoxManage command 

You can assign a static IP to the Greenbone OpenVAS appliance VM by logging in via the terminal and navigating to the network settings from the setup menu.  

Download OpenVAS: https://www.greenbone.net/en/openvas-free/ 

Instructions to install .ova virtual appliance in VirtualBox: https://www.greenbone.net/en/openvas-free/#toggle-id-4 

Network Configuration and Connectivity Tests after Starting VMs

Network IP settings:

Linux: ip a

Windows: ipconfig

Ping to test connectivity

Testing SIEM Tools - Splunk

Splunk Enterprise:

Splunk Enterprise .deb package installed on the Ubuntu Dektop system. Download from Splunk website using the wget command and then install using dpkg command. Navigate to installation directory (/opt/splunk/bin). Start the splunk service with the bash command sudo ./splunk start. Follow the prompts to accept the license and create your admin credentials.

Open a web browser on your local Ubuntu machine or a remote machine that can access the Ubuntu server's IP address. Navigate to http://<your_ubuntu_ip_address>:8000. Log in with the administrator credentials created during setup to access the Splunk dashboard.

Configure the receiving indexer port on the Splunk dashboard. Click Settings > Forwarding and Receiving. Under the "Receive Data" section, click Configure Receiving. On the "Forwarding and Receiving" page, check if there are any existing receiver ports open. You cannot create a duplicate port.

Click New. In the "Listen on this port" field, enter the desired port number (default 9997). Click Save

Splunk Universal Forwarder:

Ubuntu: 

Download the .deb package from the Splunk website using the wget command and then install using the dpkg command.  Navigate to the installation directory bin folder (/opt/splunkforwarder/bin). Start the service with the bash command: sudo ./splunk start --accept-license. Follow the prompts to create an administrator username and password. 

Configure the receiving indexer with the bash command: sudo /opt/splunkforwarder/bin/splunk add forward-server <ubuntu_ip_address>:9997. After this add data to be monitored (e.g. /var/log). Bash command: sudo /opt/splunkforwarder/bin/splunk add monitor /var/log.

Note: you can modify the data (folders) monitored by editing the inputs.conf file. The file is located at: /opt/splunkforwarder/etc/apps/search/local/inputs.conf

Windows:

Go to Microsoft Edge, type in the following URL: https://www.splunk.com/en_us/download/universalforwarder/ 

Log into Splunk. Navigate to the Windows Server download. Click the Dowload Now icon.

Navigate to the Downloads Folder. Click on the .msi file and follow Wizard options

Picture below shows Splunk Enterprise on Ubuntu collecting logs from the Windows 11 machine

Testing SIEM Tools - Wazuh

Wazuh Server:

Installed on the Ubuntu Desktop system. Follow the Quickstart instructions for a simple straightforward installation: https://documentation.wazuh.com/current/quickstart.html 

Wazuh Agent;

Agent installed on the Windows 11 machine. Powershell script to install agent is generated from the Wazuh Dashboard on Ubuntu. 

1. Access the Dashboard: Log into the Wazuh dashboard and go to Wazuh > Agents.

2. Deploy New Agent: Click Deploy new agent in the upper-right corner.

3. Configure Parameters:

   • Operating System: Select Windows.

   • Architecture: Select 64-bit (or 32-bit if needed).

   • Wazuh Manager Address: Enter the IP address or hostname of your Wazuh manager.

   • Agent Name (Optional): Define a custom name or leave blank for the default hostname.

4. Run Installer Command:

   • Copy the generated PowerShell command.

   • Open PowerShell as an Administrator on the target Windows endpoint.

   • Paste and run the command.

5. Start the Agent: Once installation finishes, the command generally starts the service automatically, but if not, run: Start-Service wazuhsvc

Testing Vulnerability Scanning Tools:

Greenbone OpenVAS scan of the Ubuntu and Windows 11 VMs

Install and Configure Web Applications for Security Testing

Two open-source, intentionally insecure web applications designed to practice web application security testing in a legal, safe, and controlled environment are:

1.      Damn Vulnerable Web Application (DVWA) - https://github.com/digininja/DVWA

2.      Buggy Web Application (bWAPP) - http://www.itsecgames.com/

DVWA includes a range of common, real-world vulnerabilities with different difficulty levels (Low, Medium, High, and Impossible). It includes Brute Force, Command Injection, CSRF, File Inclusion, File Upload, Insecure CAPTCHA, SQL Injection (including blind), and XSS vulnerabilities.

bWAPP is known for having a very large set of vulnerabilities—over 100 in total—covering all major known web bugs, including the OWASP Top 10. bWAPP covers a wide spectrum of vulnerabilities including SQL Injection, Code Injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), Heartbleed, and Shellshock.

 Note: It is highly recommended to only download and configure these on VMs or your EC2 instances. AVOID installing on your host machine and AVOID hosting on a publicly accessible server.

Windows Installation (if Windows is the vulnerable device)

1. Install XAMPP (Required for Both DVWA and bWAPP)

Step 1 – Download XAMPP

1. Go to:
   https://www.apachefriends.org/index.html

2. Download XAMPP for Windows (PHP 7.x or 8.x).

Step 2 – Install

1. Run the installer.

2. Select components:

   • Apache

   • MySQL

   • PHP

   • phpMyAdmin

3. Install to the default directory: C:\xampp

Step 3 – Start Services

Open XAMPP Control Panel and start:

Apache
MySQL

Test the installation:

http://localhost

You should see the XAMPP dashboard.

2. Install DVWA (Damn Vulnerable Web Application)

Step 1 – Download DVWA from GitHub

Go to: https://github.com/digininja/DVWA 

Click Code → Download ZIP

Step 2 – Extract to XAMPP Web Directory

Extract the folder to:

C:\xampp\htdocs\

Final structure:

C:\xampp\htdocs\DVWA

Step 3 – Create Database

1. Open: http://localhost/phpmyadmin

2. Click New

3. Create database: dvwa

Step 4 – Configure DVWA

Navigate to:

C:\xampp\htdocs\DVWA\config

Copy: config.inc.php.dist

Rename to: config.inc.php

Edit the file and confirm save:

$_DVWA['db_server'] = '127.0.0.1';
$_DVWA['db_database'] = 'dvwa';
$_DVWA['db_user'] = 'root';
$_DVWA['db_password'] = '';

Step 5 – Launch DVWA

Open: http://localhost/DVWA

Click: Create / Reset Database

Step 6 – Login

Default credentials:

username: admin
password: password

DVWA will now be running.

3. Install bWAPP (Buggy Web Application)

Step 1 – Download bWAPP

Download from: http://www.itsecgames.com

Download: bWAPP_latest.zip (You may need to temporarily disable Windows Defender to successfully download)

Step 2 – Extract to XAMPP

Extract to: C:\xampp\htdocs\

Folder structure: C:\xampp\htdocs\bWAPP

Step 3 – Configure bWAPP files

Navigate to:

C:\xampp\htdocs\bWAPP

Locate: install.php

Edit the file as follows and confirm save:

Insert the following text in the line below $db=0 (2nd line after the header comments);

mysqli_report(MYSQLI_REPORT_OFF);

Navigate to:

C:\xampp\htdocs\bWAPP\admin

Configure database credentials in the settings.php file to use a valid MySQL user with correct privileges.

example:

                             $db_server = "localhost";       // your database server (IP/name), here 'localhost'

                             $db_username = "root";          // your MySQL user, here 'root'

                             $db_password = "";

Step 4 – Install

Open in browser: http://localhost/bWAPP/install.php

Click: Install bWAPP.

Step 5 – Login

Open: http://localhost/bWAPP/login.php

Default credentials:

username: bee
password: bug

4. Verify Both Applications Can Open and You Can Log In

DVWA: http://localhost/DVWA

bWAPP: http://localhost/bWAPP

5. Recommended Lab Settings

For penetration testing practice:

DVWA Security Level

Go to:

DVWA Security → Low

Then gradually increase to:

Medium → High → Impossible

Enable Vulnerable PHP Settings

Edit: C:\xampp\php\php.ini

Ensure these are enabled:

allow_url_fopen = On
allow_url_include = On
display_errors = On

Restart Apache after changes.

Tools to attack the apps (use your Kali Linux VM or EC2 for this):

Burp Suite
OWASP ZAP
SQLMap
Nikto
Gobuster
Dirbuster
Nmap

Note: Make sure you have enabled incoming connections on ports 80, 443, and 3306 on the Windows firewall.

Linux Installations

Both web applications can also be installed on Linux e.g. Ubuntu or Kali.

The easiest way is to use docker. This method is the fastest and avoids complex LAMP configuration LAMPP: setting up a LAMP stack (Linux, Apache, MySQL, PHP)

Install Docker and Docker Compose if not already installed. The easiest way to install both Docker and Docker Compose is by installing Docker Desktop, which is available for Windows, macOS, and Linux and bundles both tools.

DVWA: Open a terminal window and type in the following command

docker run --rm -it -p 80:80 vulnerables/web-dvwa

bWAPP: Open a terminal window and type in the following command

docker run -d -p 80:80 raesene/bwapp

NMap Scanning of the Web Application Host

sudo apt update

sudo apt install nmap

Nikto Scanning of the Web Application Host

sudo apt install nikto

ZAP Scanning of the Web Application Host

sudo apt install zaproxy