Penetration Testing with Kali Linux

Build a homelab to exploit real vulnerabilities using Nmap, Metasploit, and Wireshark.

Introduction

30 Second Summary

Every time you hear about a data breach or ransomware attack, someone on the defense team had to understand exactly how those attacks work. The best way to learn cybersecurity defense is to practice offense in a safe, legal environment.

In this project, you will build an isolated penetration testing lab on your own Windows machine using virtual machines. You will scan a target for vulnerabilities, exploit a real backdoor to gain root access, capture the attack traffic, and document everything in a professional GitHub portfolio.

What You'll Build

A complete cybersecurity homelab that demonstrates the penetration testing kill chain from reconnaissance through exploitation and traffic analysis.

By the end of this project, you'll have:

  • Two configured virtual machines (Kali Linux attacker + Metasploitable 2 target) running on an isolated host-only network.
  • A successful Metasploit exploitation of the vsftpd 2.3.4 backdoor achieving root access on the target.
  • A Wireshark packet capture of the full attack traffic for forensic analysis.
  • A professional GitHub repository documenting your findings with screenshots, scan results, and a structured README.
  • Secret Mission: Exploit a second vulnerability (Samba usermap_script) and compare two distinct attack patterns in your documentation.

Are there any prerequisites?

You need a Windows PC with at least 8 GB of free RAM, 15 GB of free disk space, and an internet connection for downloading the VM images. No prior cybersecurity experience is required.

Install VirtualBox, Import VMs, and Configure Network

Penetration testing requires a safe, isolated environment where you can attack a target without risking real systems. You need two virtual machines: an attacker (Kali Linux) and an intentionally vulnerable target (Metasploitable 2).

In this step, you will install VirtualBox to run both machines, import the pre-built VM images, and wire them together on a private network that cannot reach the internet.

In this step, get ready to:
  • Install Oracle VirtualBox 7.2.
  • Import Kali Linux and Metasploitable 2 VMs.
  • Configure a host-only network and verify connectivity.
Download and install your tools

You need three downloads before you can start: VirtualBox itself, the Kali Linux attacker VM, and the Metasploitable 2 target VM.

These downloads are large (combined ~4.5 GB) so start them now.

  • Download the VirtualBox Windows hosts installer from the official downloads page.
  • Download the Kali Linux pre-built VirtualBox image (kali-linux-2026.1-virtualbox-amd64.7z, ~3.6 GB) from the Kali Virtual Machines page.
  • Download Metasploitable 2 (metasploitable-linux-2.0.0.zip, ~833 MB) from SourceForge.

Why three separate downloads?

VirtualBox is the engine that runs virtual machines on your PC. Kali Linux is a purpose-built OS loaded with hacking tools. Metasploitable 2 is a deliberately vulnerable Linux server created by Rapid7 for safe exploitation practice.

While the downloads are in progress, check whether VirtualBox is already on your machine.

  • Press the Windows key to open your search bar.
  • Type VirtualBox and check what appears.

✔️ I see VirtualBox 7.x or higher

You already have a compatible version. Skip ahead to extracting the VM files below.

ⓧ I see an older version of VirtualBox

You need version 7.0 or higher for this project.

  • Uninstall your current VirtualBox from Settings > Apps > Apps & features.
  • Run the VirtualBox 7.2 installer you just downloaded.
  • Accept all defaults and click Install when prompted.
  • Allow any Windows network driver prompts that appear during installation.

ⓧ VirtualBox is not installed

  • Run the VirtualBox 7.2 installer you downloaded earlier.
  • Accept all defaults and click Next through each screen.
  • Click Install when prompted.
  • Allow any Windows network driver prompts that appear during installation.
  • Click Finish to close the installer.

Installer fails or hangs?

Make sure Hyper-V is disabled in Windows Features. VirtualBox can conflict with Hyper-V on some systems. Also ensure no other VMs or emulators are running.

help me troubleshoot VirtualBox installation issues on Windows

Now extract the downloaded VM files so they are ready to import.

  • Extract the kali-linux-2026.1-virtualbox-amd64.7z file using 7-Zip (free from 7-zip.org) or any archive tool that supports .7z format.
  • Extract metasploitable-linux-2.0.0.zip using Windows File Explorer (right-click > Extract All).
  • Note the location of the extracted folders. You will need them in the next substep.

Keep extraction paths simple

Extract both archives to your Desktop or Documents folder. Avoid deeply nested paths or folders with special characters.

Import the virtual machines into VirtualBox

With VirtualBox installed and both archives extracted, you can now bring the VMs into VirtualBox Manager.

  • Press the Windows key, type VirtualBox, and press Enter to open it.

First, import the Kali Linux VM.

  • In VirtualBox Manager, click File in the top menu bar.
  • Select Import Appliance.
  • Click the folder icon and navigate to the extracted Kali folder.
  • Select the .vbox file inside the extracted folder and click Open.
  • Review the settings on the Appliance Settings page. Leave the defaults.
  • Click Finish to import the VM. This may take a few minutes as it copies the disk image.

What does Import Appliance do?

Import Appliance reads the VM definition file and copies all the associated disk images into VirtualBox's managed storage. Once imported, the VM appears in the left sidebar of VirtualBox Manager ready to configure and boot.

Next, create the Metasploitable 2 VM manually using the extracted disk file.

  • In VirtualBox Manager, click New in the toolbar to create a new VM.
  • In the Name field, type Metasploitable2.
  • Set Type to Linux.
  • Set Version to Ubuntu (64-bit).
  • Click Next.
  • Set the memory (RAM) to 512 MB.
  • Click Next.
  • Select Use an existing virtual hard disk file.
  • Click the folder icon, then click Add.
  • Navigate to the extracted Metasploitable folder and select Metasploitable.vmdk.
  • Click Choose, then click Next.
  • Review the summary and click Finish.

Why create Metasploitable 2 manually?

Metasploitable 2 is distributed as a raw disk image (.vmdk), not a pre-packaged appliance. You create a new VM shell and point it at the existing disk. This gives you full control over the VM settings.

You should now see both VMs listed in VirtualBox Manager: the Kali Linux VM and Metasploitable2.

Don't see both VMs listed?

If the Kali import failed, make sure you selected the correct file from inside the extracted folder. If Metasploitable2 does not appear, confirm you clicked Finish on the final summary screen.

help me troubleshoot importing VMs into VirtualBox

Configure the isolated network and verify connectivity

Both VMs need to talk to each other on a private network that is completely cut off from the internet. A host-only network creates exactly this isolation.

Why host-only instead of NAT?

A host-only network ensures that the vulnerable Metasploitable 2 VM can never be reached from the internet or your real network. This is a critical safety requirement. NAT mode would give VMs internet access, which could expose Metasploitable 2 to real attackers.

Host-only networking creates a virtual switch that only connects the VMs to each other and your host machine. Nothing outside can see or reach these machines.

First, create the host-only network.

  • In VirtualBox Manager, click File in the top menu bar.
  • Select Tools, then click Network Manager.
  • Click the Host-Only Networks tab.
  • Click Create. A new network (vboxnet0) appears in the list.
  • Click Properties to expand the network settings.
  • On the Adapter tab, confirm the IPv4 Address is 192.168.56.1 and the Network Mask is 255.255.255.0.
  • Close the Network Manager window.

What is 192.168.56.1?

This is the IP address of the virtual network adapter on your host machine. VirtualBox's built-in DHCP server will assign addresses in the 192.168.56.0/24 range to any VMs connected to this network.

Now assign both VMs to use this host-only network.

  • Right-click the Kali Linux VM in the sidebar and select Settings.
  • Click Network in the left panel.
  • Under the Adapter 1 tab, change Attached to to Host-Only Adapter.
  • In the Name dropdown, select the host-only network you just created (vboxnet0).
  • Click OK.
  • Repeat the same steps for the Metasploitable2 VM: right-click > Settings > Network > Adapter 1 > Host-Only Adapter > select vboxnet0 > OK.

Boot both VMs and verify they can communicate.

  • Select the Kali Linux VM and click Start in the toolbar.
  • Select the Metasploitable2 VM and click Start in the toolbar.
  • Wait for both VMs to finish booting. This may take a minute or two.
  • Log into the Kali Linux VM using the credentials kali / kali.
  • Log into the Metasploitable 2 VM using the credentials msfadmin / msfadmin.

In the Metasploitable 2 terminal, find its IP address by running:

ifconfig

What am I looking for?

Look for the eth0 interface. The inet addr value should be in the 192.168.56.x range. Note this IP address. You will use it throughout the project as your target IP.

Now verify connectivity from Kali. In the Kali terminal, ping the Metasploitable 2 IP by running:

ping -c 4 [[METASPLOITABLE_IP="Metasploitable 2 IP from ifconfig output"]]

You should see four successful replies with no packet loss.

Finally, confirm that Metasploitable 2 is isolated from the internet. In the Metasploitable 2 terminal, run:

ping -c 4 8.8.8.8

This should fail with no replies. That confirms your lab is properly isolated.

Ping between VMs fails?

Make sure both VMs have Adapter 1 set to Host-Only Adapter with the same network (vboxnet0) selected. Double-check by right-clicking each VM and opening Settings > Network.

If Metasploitable 2 shows no IP address on eth0, try restarting the VM. The DHCP server may not have assigned an address on the first boot.

help me fix network connectivity between my Kali and Metasploitable 2 VMs in VirtualBox

Your isolated penetration testing lab is ready. Both VMs can talk to each other on the 192.168.56.0/24 subnet, and neither can reach the internet. Next up, you will scan the target with Nmap to discover every vulnerable service running on Metasploitable 2.

Run Nmap Reconnaissance

Your lab environment is up and running with both VMs communicating on an isolated network. Now it's time to think like an attacker and discover what's running on your target.

In a real penetration test, the first phase is always reconnaissance. You'll use Nmap to scan the Metasploitable 2 machine and map every open port and service, looking for weaknesses to exploit.

In this step, get ready to:
  • Run a host discovery scan to confirm your target is online.
  • Perform a full service version scan across all 65535 ports.
  • Review and document the vulnerable services you find.
Run a host discovery scan

Before scanning individual ports, you need to confirm which hosts are alive on the network. A host discovery scan sends lightweight probes to every IP on the subnet and reports which ones respond.

  • In your Kali Linux terminal, discover all live hosts on the network by running this command:
nmap -sn 192.168.56.0/24

What does this command do?

  • nmap is the network scanning tool pre-installed on Kali.
  • -sn tells Nmap to perform a ping scan (host discovery only, no port scan).
  • 192.168.56.0/24 is the subnet range of your host-only network, covering all addresses from 192.168.56.1 to 192.168.56.254.

You should see output listing 2-3 live hosts: your Kali machine, the Metasploitable 2 target, and possibly the VirtualBox host adapter (192.168.56.1).

  • Note the IP address shown for Metasploitable 2 in the output. You will use this IP for the rest of the project.

Not seeing any hosts?

  • Make sure both VMs are powered on and fully booted. Metasploitable 2 should show a login prompt.
  • Verify both VMs are set to Host-Only Adapter (vboxnet0) in their network settings. Right-click the VM in VirtualBox, select Settings > Network, and confirm Adapter 1 is attached to Host-Only Adapter.
  • Try pinging the target first with ping 192.168.56.x (using the IP you noted during setup). If the ping fails, your network configuration needs fixing.

Help me troubleshoot why my Nmap host discovery scan is not finding any hosts on the 192.168.56.0/24 network.

Run a full service version scan

Now that you know the target is alive, you need to find out exactly which services are running and what versions they use. This is how attackers identify exploitable software.

  • Run a comprehensive scan against your target by running this command:
nmap -sV -sC -p- [[TARGET_IP="your Metasploitable 2 IP address"]] -oN nmap_full_scan.txt

What do these flags mean?

  • -sV probes open ports to determine service/version info.
  • -sC runs default NSE scripts for additional enumeration.
  • -p- scans all 65535 ports (not just the default 1000).
  • -oN nmap_full_scan.txt saves the output to a file in normal format so you have a record of your findings.

Together, these flags give you a complete picture of every service running on the target, including exact version numbers that you can cross-reference against known vulnerabilities.

This scan takes a few minutes

Scanning all 65535 ports with version detection takes time. On your local host-only network this typically finishes in 2-5 minutes. You can press any key during the scan to see a progress update.

Once the scan completes, you should see a long table of open ports, service names, and version numbers in your terminal.

Scan seems stuck or taking too long?

  • On a host-only network between VMs, the full scan should complete within 5 minutes. If it takes longer than 10 minutes, press any key to check progress.
  • Make sure you replaced the target IP placeholder with the actual Metasploitable 2 IP address from the host discovery scan.
  • If the scan hangs completely, press Ctrl+C to cancel, then retry with a smaller port range first: nmap -sV -p 1-1000 <target-ip> to confirm the target is responding.

Help me troubleshoot why my Nmap full port scan against Metasploitable 2 is taking too long or not completing.

Review and document your findings

Your scan results reveal the attack surface of the target machine. Each open port represents a potential entry point for an attacker.

  • Scroll through the scan output in your terminal. You should see 20+ open ports.
  • Look for these key services in the results:
  • Port 21: vsftpd 2.3.4 (your primary target for exploitation).
  • Port 22: OpenSSH.
  • Ports 139/445: Samba 3.0.20-Debian (your Secret Mission target).
  • Port 3306: MySQL.

Why is vsftpd 2.3.4 the primary target?

In 2011, an attacker inserted a malicious backdoor into the vsftpd 2.3.4 source code (CVE-2011-2523). When someone connects to the FTP server with a username ending in :), the backdoor opens a listening shell on port 6200. This gives the attacker full root access.

Metasploitable 2 intentionally runs this vulnerable version so you can practice exploiting it safely.

  • Take a screenshot of the full scan output showing the open ports and service versions.
  • Confirm the file was saved by running:
ls nmap_full_scan.txt

You should see nmap_full_scan.txt listed in the output, confirming your scan results are saved to disk.

Don't see the file?

  • The file is saved in whatever directory your terminal was in when you ran the scan. Run pwd to check your current directory, then ls to list files there.
  • If the scan was interrupted before completing, the file may be empty or missing. Re-run the full scan command to generate it.

Help me find my nmap_full_scan.txt file on Kali Linux after running a scan.

You now have a complete map of the target's attack surface. Next up, you'll use Metasploit to exploit the vsftpd 2.3.4 backdoor and gain root access to the target machine.

Exploit vsftpd 2.3.4 with Metasploit

Your Nmap scan identified vsftpd 2.3.4 running on port 21 of the target. This specific version contains a notorious backdoor (CVE-2011-2523) that was secretly inserted into the vsftpd download archive in mid-2011.

The backdoor works by opening a root shell on port 6200 whenever a specially crafted username ending in :) is sent to the FTP server. In this step, you will use the Metasploit Framework to automate this exploit and gain full root access to the Metasploitable 2 machine.

In this step, get ready to:
  • Launch Metasploit and load the vsftpd exploit module.
  • Configure the exploit target and payload, then run the attack.
  • Verify root access and take a screenshot of the successful exploitation.
Launch Metasploit and load the exploit module

Metasploit Framework is a penetration testing platform pre-installed on Kali Linux. It provides hundreds of exploit modules targeting known vulnerabilities, and you interact with it through msfconsole.

  • In the Kali Linux VM, open a terminal window.
  • Launch the Metasploit console by running this command:
msfconsole

After 15-30 seconds, you will see an ASCII art banner and the msf6 > prompt. This means Metasploit is ready.

Taking a long time to load?

Metasploit loads hundreds of modules on startup. On the first launch it can take up to 60 seconds. If the terminal appears frozen, wait patiently. You will eventually see the banner and prompt.

help me troubleshoot msfconsole not loading

  • Search for the vsftpd exploit module by running:
search vsftpd
  • You should see exploit/unix/ftp/vsftpd_234_backdoor in the results. Select this module by running:
use exploit/unix/ftp/vsftpd_234_backdoor
  • View the module's configurable options by running:
show options

What does show options tell you?

The show options command displays every configurable parameter for the selected module. You will see two key fields:

  • RHOSTS (empty) is where you set the target IP address.
  • RPORT (set to 21) is the FTP port the module will connect to. This is already correct.
Configure and run the exploit

You need to tell Metasploit which machine to attack and which payload to deliver. The payload determines what happens after the backdoor opens.

  • Set the target IP address (your Metasploitable 2 IP from the previous step) by running:
set RHOSTS [[TARGET_IP="your Metasploitable 2 IP address"]]
  • Set the payload to an interactive command shell by running:
set PAYLOAD cmd/unix/interact

Why cmd/unix/interact?

The cmd/unix/interact payload gives you a direct interactive shell without needing a reverse connection back to your machine. This works perfectly here because the vsftpd backdoor opens a bind shell on port 6200 that you connect to directly.

  • Launch the exploit by running:
exploit

The module sends a specially crafted username containing :) to the FTP service. This triggers the backdoor, which opens a listening shell on port 6200. Metasploit then connects to that port automatically.

When successful, you will see Backdoor has been spawned! followed by Command shell session 1 opened. Your prompt will change to a blank line, indicating you are now inside a shell on the target machine.

Exploit failed or no session opened?

If you see a message about the backdoor port being already open or in-use, a previous exploit attempt may not have fully closed. Power off the Metasploitable 2 VM, restart it, wait for it to boot, then try the exploit again.

If the exploit times out, verify you can still ping the Metasploitable 2 IP from Kali. A failed ping means the VMs lost network connectivity. Check that both VMs still have their Adapter 1 set to Host-Only Adapter (vboxnet0).

help me troubleshoot the vsftpd exploit failing

Verify root access and document the exploit

You now have a command shell on the target. This shell does not show a visible prompt, but it accepts commands. You need to confirm you have root-level privileges.

  • Check your user identity by typing:
id

You should see uid=0(root) gid=0(root) confirming you have full root access on the target.

  • Run two more commands to confirm the compromise:
whoami
hostname

You should see root and metasploitable as the output of these two commands.

What just happened?

You exploited a real vulnerability in seconds. The vsftpd 2.3.4 backdoor gives an attacker instant root access without needing a password, valid credentials, or any authentication at all. This is why version detection during reconnaissance is critical.

In a real penetration test, this finding would be rated Critical severity. The remediation is simple: upgrade to a version of vsftpd that does not contain the backdoor.

  • Take a screenshot showing the successful exploitation output, including the id command and its uid=0(root) result. Save this screenshot for your GitHub portfolio later.
  • Exit the shell session by typing:
exit

You will return to the msf6 > prompt. The session is now closed.

Shell not responding to commands?

If typing id returns nothing or garbled text, the shell session may have dropped. Type exit to return to the Metasploit prompt, then run exploit again to re-establish the connection.

help me fix my Metasploit shell not responding

You just completed a full exploit chain, going from a version number in a scan to root-level access on the target. Next up, you will capture this same exploit in Wireshark to see exactly what the attack looks like on the network.

Capture Exploit Traffic with Wireshark

In the previous step, you exploited the vsftpd 2.3.4 backdoor and gained root access to the target machine. That proved the vulnerability is real.

Now you will see what that attack looks like on the network. Wireshark captures every packet flowing between your machines, letting you inspect the exact bytes that triggered the backdoor and opened the shell. This is the same forensic analysis a SOC analyst performs when investigating a breach.

In this step, get ready to:
  • Start a live packet capture in Wireshark on the host-only network interface.
  • Re-run the vsftpd exploit while Wireshark is recording traffic.
  • Filter and analyze the capture to identify the backdoor trigger and shell session.
Open Wireshark and start capturing on eth0

Wireshark is pre-installed on Kali Linux. You need to start it and begin capturing packets before you re-run the exploit, so you can record the entire attack from start to finish.

  • In your Kali VM, click the **Applications** menu in the top-left corner of the screen.
  • Navigate to the Sniffing & Spoofing category and click Wireshark.
  • Wireshark opens to its welcome screen, showing a list of available capture interfaces with sparkline activity graphs.
  • Double-click eth0 in the interface list to immediately start capturing packets on the host-only network.

You should see packets appearing in the packet list pane as Wireshark captures live traffic. Leave the capture running.

Why capture before exploiting?

Wireshark only records packets that arrive while a capture is active. If you start capturing after the exploit finishes, you miss the critical handshake and trigger packets. Starting first ensures you get the complete picture.

Don't see eth0 in the interface list?

Make sure your Kali VM's network adapter is set to Host-Only Adapter (vboxnet0) in VirtualBox settings. If the interface shows but has no activity, confirm the Metasploitable 2 VM is still running.

help me fix Wireshark not showing the eth0 interface on Kali Linux

Re-run the Metasploit exploit while capturing

With Wireshark actively recording, you will now repeat the vsftpd exploitation from the previous step. This time, every packet of the attack will be captured.

  • Open a new terminal window in Kali by right-clicking the desktop and selecting Open Terminal Here.
  • Launch Metasploit by running this command:
msfconsole
  • Once the Metasploit console loads, select the vsftpd module and configure it by running these commands:
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS [[METASPLOITABLE_IP="your Metasploitable 2 IP address"]]
set PAYLOAD cmd/unix/interact
exploit

What do these commands do?

  • use exploit/unix/ftp/vsftpd_234_backdoor loads the vsftpd backdoor exploit module.
  • set RHOSTS points the exploit at the Metasploitable 2 target IP.
  • set PAYLOAD cmd/unix/interact tells Metasploit to use a direct command shell once the backdoor opens on port 6200.
  • exploit launches the attack.
  • When you see a command shell prompt, verify you have root access by running:
id
  • You should see uid=0(root) gid=0(root) confirming root access.
  • Exit the shell by typing:
exit
  • Switch back to the Wireshark window.
  • Stop the capture by clicking Capture in the menu bar, then clicking Stop.

The packet list now contains every packet from the exploit session, frozen for analysis.

Exploit not working the second time?

The vsftpd backdoor binds to port 6200 on the target. If your previous session did not close cleanly, the port may still be occupied. Restart the Metasploitable 2 VM in VirtualBox, wait for it to boot, then try the exploit again.

help me troubleshoot the vsftpd exploit failing on second attempt

Filter and analyze the captured traffic

Your capture contains all network traffic during the exploit. You need to filter it down to just the FTP and backdoor traffic to see the attack clearly.

  • In Wireshark, locate the display filter bar at the top of the packet list (it says "Apply a display filter").
  • Type the following filter and press Enter:
tcp.port == 21 || tcp.port == 6200

What does this filter show?

This display filter isolates two types of traffic. Port 21 is the FTP connection where the backdoor trigger is sent. Port 6200 is the hidden shell that opens after the trigger succeeds.

Everything else on the network is hidden, letting you focus on just the exploit packets.

You should now see the filtered packet list showing the FTP handshake, the USER command containing the :) backdoor trigger, and the TCP connection on port 6200.

  • Look through the packet list for packets on port 6200.
  • Right-click on one of the port 6200 packets in the packet list pane.
  • Select Follow, then click TCP Stream.

A dialog window opens showing the full shell interaction in readable text. You should see the commands you typed (id) and the response showing root access.

What is Follow TCP Stream?

Follow TCP Stream reassembles all packets in a single TCP connection and displays them as a continuous conversation. This is the forensic view that proves exactly what happened during the exploitation.

Red text shows data sent by one side, blue shows the other. You can read the entire shell session as if you were watching over the attacker's shoulder.

  • Take a screenshot of the TCP Stream dialog showing the shell commands and root confirmation.
  • Close the TCP Stream dialog by clicking Close.
  • Save the capture file by clicking File in the menu bar, then Save As.
  • Name the file vsftpd_exploit.pcapng and save it to your home directory.

You now have a permanent record of the exploit traffic saved as vsftpd_exploit.pcapng.

Not seeing the :) trigger in the capture?

Make sure you started the Wireshark capture before running the exploit. If you started capturing after the exploit, the FTP USER command with the trigger was already sent and missed. Stop the capture, start a fresh one on eth0, and re-run the exploit.

help me find the vsftpd backdoor trigger in my Wireshark capture

You have now captured and analyzed the full attack at the packet level. Next up, you will document everything in a professional GitHub repository that showcases your penetration testing skills.

Document Findings in a GitHub Repository

You have scanned the target, exploited a real vulnerability, and captured the attack traffic. Those are impressive accomplishments, but without documentation they exist only on your local machine.

In this step, you will create a professional GitHub repository that showcases your methodology, findings, and evidence. This is the kind of portfolio piece that hiring managers look for when evaluating cybersecurity candidates.

In this step, get ready to:
  • Install Git for Windows and create a GitHub account.
  • Organize your screenshots and findings into a repository structure.
  • Write a professional README and push everything to GitHub.
Install Git for Windows and create a GitHub account

Git is the version control tool that lets you track changes and push code to GitHub. You need Git for Windows installed on your host machine to interact with your GitHub repository.

  • Open your web browser on your Windows host and navigate to https://github.com/join to create a free GitHub account.
  • Fill in your username, email, and password, then complete the sign-up process.

Why GitHub?

GitHub is the standard platform for sharing technical portfolios in cybersecurity. A public repository with documented findings shows potential employers that you understand penetration testing methodology, not just tools.

  • Download Git for Windows from https://git-scm.com/download/win and run the installer.
  • The installer presents multiple configuration screens. Accept the default settings on each page and click Next until you reach the final screen, then click Install.
  • Once installation completes, check Launch Git Bash and click Finish.

What is Git Bash?

Git Bash is a terminal emulator for Windows that provides a Unix-like command line. It includes Git commands along with utilities like scp and ssh that you will use to transfer files from your Kali VM.

  • Configure your Git identity by running this command in Git Bash:
git config --global user.name "[[YOUR_NAME=\"Your Name\"]]"
  • Set your email address by running:
git config --global user.email "[[YOUR_EMAIL=\"your@email.com\"]]"

What do these commands do?

These commands tell Git who you are. Every commit you make is tagged with this name and email, so collaborators (or employers reviewing your repo) can see who authored the work.

Git command not recognized?

Make sure you are typing in the Git Bash window that opened after installation, not in Windows Command Prompt or PowerShell. If Git Bash did not open automatically, press the Windows key, type Git Bash, and press Enter to launch it.

Help me troubleshoot Git Bash not opening on Windows.

Create the repository and organize your project files

Now you will create a GitHub repository and bring all your evidence files together in an organized structure.

  • In your browser, go to https://github.com/new to create a new repository.
  • Enter cybersecurity-homelab in the Repository name field.
  • Select Public visibility.
  • Check the box for Add a README file.
  • Click Create repository.
  • Back in Git Bash, move to your Desktop by running this command:
cd ~/Desktop
  • Clone your new repository by running:
git clone https://github.com/[[GITHUB_USERNAME="yourusername"]]/cybersecurity-homelab.git

What does git clone do?

This downloads a copy of your GitHub repository to your local machine. It creates a folder called cybersecurity-homelab on your Desktop with the README file already inside.

  • Move into the cloned repository and create the directory structure by running:
cd cybersecurity-homelab
mkdir -p screenshots findings
  • Confirm the folders were created by running:
ls

You should see findings, README.md, and screenshots listed.

Now you need to transfer your evidence files from the Kali VM to this folder. Your Kali VM is reachable from Windows via the host-only network at its 192.168.56.x address.

  • In your Kali VM terminal, enable SSH so your Windows host can connect by running:
sudo systemctl start ssh

Why start SSH?

Kali Linux disables SSH by default for security. Starting it temporarily lets you use scp (secure copy) from Git Bash to pull files off the Kali VM over the host-only network.

  • Back in Git Bash on Windows, transfer the Nmap scan results by running:
scp kali@[[KALI_IP="192.168.56.x (your Kali IP)"]]:~/nmap_full_scan.txt findings/
  • When prompted, type yes to accept the SSH fingerprint, then enter the Kali password kali.
  • Transfer the Wireshark capture by running:
scp kali@[[KALI_IP="192.168.56.x (your Kali IP)"]]:~/vsftpd_exploit.pcapng findings/
  • Copy your screenshots into the screenshots folder. If you took screenshots using the Windows Snipping Tool (Win+Shift+S), save them as vsftpd_exploit.png and wireshark_analysis.png in the screenshots folder inside cybersecurity-homelab on your Desktop.

Screenshots from inside Kali?

If your screenshots are saved on the Kali VM instead of your Windows host, transfer them the same way using scp. For example: scp kali@<kali-ip>:~/Desktop/*.png screenshots/ to copy all PNG files from Kali's Desktop.

  • Verify all files are in place by running:
ls findings/
ls screenshots/

You should see nmap_full_scan.txt and vsftpd_exploit.pcapng in the findings folder, and your screenshot files in the screenshots folder.

SCP connection refused?

Make sure you ran sudo systemctl start ssh in the Kali VM terminal. Also confirm you are using the correct Kali IP address from the 192.168.56.0/24 subnet. You can check it by running ip addr in the Kali terminal.

Help me troubleshoot SCP file transfer from Kali to Windows.

Write a professional README and push to GitHub

The README is the first thing anyone sees when they visit your repository. A well-structured README demonstrates your methodology and makes your work immediately understandable to a reviewer.

  • Open README.md in the cybersecurity-homelab folder using any text editor (Notepad, VS Code, or even Git Bash with nano README.md).
  • Replace the entire contents of the file with the following professional documentation:
# Cybersecurity Homelab: Penetration Testing Lab

## Objective

Built an isolated penetration testing lab to practice real-world ethical hacking techniques including network reconnaissance, vulnerability exploitation, and traffic analysis.

## Tools Used

- Kali Linux 2026.1 (attacker VM)
- Metasploitable 2 (target VM)
- Oracle VirtualBox 7.2 (virtualization)
- Nmap (network scanning)
- Metasploit Framework (exploitation)
- Wireshark (packet analysis)

## Lab Architecture

- Host-only network: 192.168.56.0/24
- Kali Linux (attacker): 192.168.56.x
- Metasploitable 2 (target): 192.168.56.x
- No internet access for target VM (fully isolated)

## Methodology

### 1. Reconnaissance

Performed full port scan with service version detection:

```
nmap -sV -sC -p- <target-ip> -oN nmap_full_scan.txt
```

Discovered 20+ open ports with vulnerable services.

### 2. Exploitation - vsftpd 2.3.4 Backdoor (CVE-2011-2523)

Used Metasploit module `exploit/unix/ftp/vsftpd_234_backdoor` to exploit a malicious backdoor in the FTP server. The backdoor is triggered by sending a username ending in `:)` which opens a shell listener on port 6200.

Result: Root shell obtained (uid=0).

![Exploitation Screenshot](screenshots/vsftpd_exploit.png)

### 3. Traffic Analysis

Captured exploit traffic in Wireshark. Key observations:
- FTP USER command contains the `:)` backdoor trigger
- New TCP connection established on port 6200
- Shell commands visible in cleartext on port 6200

![Wireshark Capture](screenshots/wireshark_analysis.png)

## Key Findings

| Service | Port | Vulnerability | CVE |
|---------|------|--------------|-----|
| vsftpd 2.3.4 | 21 | Backdoor command execution | CVE-2011-2523 |
| Samba 3.0.20 | 139 | Username map script RCE | CVE-2007-2447 |

## Lessons Learned

- Always scan with `-sV` to identify service versions, not just open ports
- Vulnerable services can be exploited in seconds with the right tools
- Packet captures provide forensic evidence of exactly how an attack works
- Isolated labs are essential for safe, legal security practice

## Files

- `findings/nmap_full_scan.txt` - Full Nmap scan results
- `findings/vsftpd_exploit.pcapng` - Wireshark capture of vsftpd exploitation
- `screenshots/` - Visual documentation of each step

What makes this README professional?

The structure follows a clear penetration testing methodology: objective, tools, architecture, methodology (recon, exploit, analysis), findings, and lessons learned. Each section tells a reviewer exactly what you did and why.

The Key Findings table is especially useful. It shows at a glance what vulnerabilities you found, mirroring how real pentest reports summarize results for stakeholders.

  • Save the file.
  • Back in Git Bash (inside the cybersecurity-homelab folder), stage all files by running:
git add .
  • Commit your changes with a descriptive message by running:
git commit -m "Add cybersecurity homelab pentest documentation"
  • Push your commit to GitHub by running:
git push origin main

What do these three commands do?

The git add . command stages every new and modified file in the current directory. The git commit command saves a snapshot of those staged changes with your message. The git push command uploads that snapshot to your GitHub repository so it becomes publicly visible.

  • When prompted for credentials during the push, enter your GitHub username and a personal access token (not your password). GitHub requires a token for command-line authentication.

Creating a personal access token

Go to GitHub Settings > Developer settings > Personal access tokens > Tokens (classic) and generate a new token with the repo scope checked. Use this token as your password when Git prompts you. Git Credential Manager will remember it for future pushes.

  • Visit your repository page in your browser at https://github.com/yourusername/cybersecurity-homelab.

You should see your professional README rendered on the main page, with the screenshots and findings folders visible in the file list above it.

Push rejected or authentication failed?

If you see an authentication error, make sure you are using a personal access token (not your GitHub password) when prompted. If the push is rejected because the remote contains work you do not have locally, run git pull origin main --rebase first, then try pushing again.

Help me fix a git push authentication or rejection error.

✔️ Awesome, I've got everything!

Great. Double check that you have saved README.md and that your push completed without errors. Your repository is now live.

ⓧ I'd like to double check the full README

Here is the complete README.md that should be in your repository:

# Cybersecurity Homelab: Penetration Testing Lab

## Objective

Built an isolated penetration testing lab to practice real-world ethical hacking techniques including network reconnaissance, vulnerability exploitation, and traffic analysis.

## Tools Used

- Kali Linux 2026.1 (attacker VM)
- Metasploitable 2 (target VM)
- Oracle VirtualBox 7.2 (virtualization)
- Nmap (network scanning)
- Metasploit Framework (exploitation)
- Wireshark (packet analysis)

## Lab Architecture

- Host-only network: 192.168.56.0/24
- Kali Linux (attacker): 192.168.56.x
- Metasploitable 2 (target): 192.168.56.x
- No internet access for target VM (fully isolated)

## Methodology

### 1. Reconnaissance

Performed full port scan with service version detection:

```
nmap -sV -sC -p- <target-ip> -oN nmap_full_scan.txt
```

Discovered 20+ open ports with vulnerable services.

### 2. Exploitation - vsftpd 2.3.4 Backdoor (CVE-2011-2523)

Used Metasploit module `exploit/unix/ftp/vsftpd_234_backdoor` to exploit a malicious backdoor in the FTP server. The backdoor is triggered by sending a username ending in `:)` which opens a shell listener on port 6200.

Result: Root shell obtained (uid=0).

![Exploitation Screenshot](screenshots/vsftpd_exploit.png)

### 3. Traffic Analysis

Captured exploit traffic in Wireshark. Key observations:
- FTP USER command contains the `:)` backdoor trigger
- New TCP connection established on port 6200
- Shell commands visible in cleartext on port 6200

![Wireshark Capture](screenshots/wireshark_analysis.png)

## Key Findings

| Service | Port | Vulnerability | CVE |
|---------|------|--------------|-----|
| vsftpd 2.3.4 | 21 | Backdoor command execution | CVE-2011-2523 |
| Samba 3.0.20 | 139 | Username map script RCE | CVE-2007-2447 |

## Lessons Learned

- Always scan with `-sV` to identify service versions, not just open ports
- Vulnerable services can be exploited in seconds with the right tools
- Packet captures provide forensic evidence of exactly how an attack works
- Isolated labs are essential for safe, legal security practice

## Files

- `findings/nmap_full_scan.txt` - Full Nmap scan results
- `findings/vsftpd_exploit.pcapng` - Wireshark capture of vsftpd exploitation
- `screenshots/` - Visual documentation of each step

Secret mission

Exploit Samba usermap_script (CVE-2007-2447)

You've exploited one vulnerability. But a real penetration tester doesn't stop at the first finding. Can you exploit a completely different service on the same target, capture the traffic, and compare both attack patterns in your documentation?

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely on your local machine using VirtualBox VMs. There are no ongoing cloud costs or subscriptions to worry about.

Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

Resources you used:

  • Kali Linux VM (~10 GB disk space).
  • Metasploitable 2 VM (~8 GB disk space).
  • VirtualBox host-only network adapter (vboxnet0).

Keep everything running

No action needed. Choose this if you want to keep practicing penetration testing techniques against Metasploitable 2.

  • Your VMs consume no CPU or memory while powered off. They only use disk space (~18 GB total).
  • You can boot them anytime for future security labs or to practice new Metasploit modules.
  • The host-only network remains configured and ready to use.

Pause - I'll come back to this later

Shut down both VMs to free up memory. They consume no resources when powered off, and your configurations stay intact.

  • In VirtualBox Manager, right-click the Kali Linux VM and select Close > Power Off.
  • Right-click the Metasploitable 2 VM and select Close > Power Off.
  • Both VMs will appear in the list as powered off. Boot them again anytime you want to resume.

Delete - I don't want to use this again

Remove all project resources and reclaim ~18 GB of disk space. Make sure both VMs are powered off before proceeding.

  • In VirtualBox Manager, right-click the Kali Linux VM and select Remove.
  • In the confirmation dialog, click Delete all files to remove the VM and its virtual disk.
  • Right-click the Metasploitable 2 VM and select Remove.
  • Click Delete all files again to remove the second VM and its disk.
  • Remove the host-only network by going to File > Tools > Network Manager.
  • Select the vboxnet0 adapter and click the remove button to delete it.

Nice Work!

Nice Work!

You just built a fully functional penetration testing lab and executed a real attack chain from start to finish. That is the same methodology professional ethical hackers and SOC analysts use every day.

Here's what you accomplished:

  • Built an isolated penetration testing lab with Kali Linux and Metasploitable 2 on a host-only network, then exploited the vsftpd 2.3.4 backdoor (CVE-2011-2523) using Metasploit to gain root access.
  • Performed network reconnaissance using Nmap to discover 20+ vulnerable services with version detection and default scripts.
  • Captured and analyzed attack traffic in Wireshark, identifying the backdoor trigger mechanism, and documented everything in a professional GitHub repository with screenshots, scan results, and packet captures.
  • Secret Mission: Exploited the Samba usermap_script vulnerability (CVE-2007-2447) and compared two distinct attack vectors in your documentation.

Ready to quiz yourself?