Build a Penetration Testing Lab

Set up a cybersecurity lab and exploit real vulnerabilities using Kali Linux.

Introduction

30 Second Summary

Every time you log in to your bank, shop online, or check your email, there are security professionals working behind the scenes to keep your data safe. They do this by thinking like attackers, finding weaknesses before the bad guys do.

In this project, you will build a self-contained cybersecurity lab on your own computer, then use real hacking tools to scan for vulnerabilities and exploit them in a safe, legal environment.

What You'll Build

A complete penetration testing lab running inside a virtual machine, equipped with industry-standard tools for network scanning and web application exploitation.

By the end of this project, you'll have:

  • A running Kali Linux virtual machine inside VirtualBox, configured for penetration testing.
  • Completed a network reconnaissance scan using Nmap to discover services and open ports on a vulnerable target.
  • Intercepted and manipulated web traffic using Burp Suite to exploit a SQL injection vulnerability in DVWA.
  • Secret Mission: Use Nmap's Scripting Engine to automate vulnerability discovery against your target.

Are there any prerequisites?

None. This project includes full setup instructions for every tool you need. You just need a Windows computer with at least 8 GB of RAM and around 10 GB of free disk space.

Install VirtualBox on Windows

Every penetration testing tool you'll use in this project runs inside a virtual machine. A virtual machine is a computer running inside your computer, completely isolated from your real operating system.

To create and manage virtual machines, you need VirtualBox. In this step, you'll install Oracle VirtualBox 7.2.8 on your Windows machine and make sure hardware virtualization is enabled.

In this step, get ready to:
  • Check if VirtualBox is already installed on your machine.
  • Download and install VirtualBox 7.2.8 if needed.
  • Verify VirtualBox launches and hardware virtualization is enabled.
Check for an existing VirtualBox installation

Before downloading anything, check whether VirtualBox is already on your machine.

  • Press the Windows key to open your search bar.
  • Type VirtualBox and look at the results.

✔️ I see VirtualBox 7.2.8 or higher

VirtualBox is already installed and up to date. Skip ahead to the next substep to verify it launches correctly.

ⓧ I see VirtualBox but it's an older version

You have an older version of VirtualBox installed. You need to update to 7.2.8 to follow this project.

  • Open your browser and navigate to the official VirtualBox downloads page:
  • https://www.oracle.com/virtualization/technologies/vm/downloads/virtualbox-downloads.html
  • Download the Windows installer named VirtualBox-7.2.8-173730-Win.exe.
  • Run the installer. It will detect your older version and upgrade it automatically.
  • Accept the default settings on each page and click Next until you reach Install.
  • Click Install and wait for the process to finish.
  • Click Finish to close the installer.

What about my old VMs?

Upgrading VirtualBox preserves all your existing virtual machines and settings. Nothing is lost during the upgrade.

ⓧ VirtualBox doesn't appear in my search

VirtualBox is not installed yet. Follow the steps below to download and install it.

What will the installer ask me?

The installer walks you through a series of pages. Accept the defaults on each page. It will ask to install network adapters and may briefly disconnect your internet connection. Click Yes if Windows asks to allow the installer to make changes.

  • Click Next on each page to accept the default settings.
  • Click Yes when prompted about network interfaces.
  • Click Install to begin the installation.
  • Click Finish when the installation completes.
Verify VirtualBox launches successfully

Now that VirtualBox is installed, confirm it opens correctly.

  • Press the Windows key to open your search bar.
  • Type VirtualBox and press Enter to open it.

You should see the Oracle VM VirtualBox Manager window. The left pane shows a machine list (empty if this is your first time). The right pane displays a welcome message.

What is VirtualBox Manager?

VirtualBox Manager is the main window where you create, configure, and run virtual machines. Think of it as a dashboard for all of your virtual computers.

Enable hardware virtualization if needed

VirtualBox 7.2.8 requires a CPU feature called hardware virtualization (Intel VT-x or AMD-V) to run any virtual machine. Most modern computers support this, but it may be turned off in your BIOS by default.

You will not see an error in VirtualBox Manager itself right now. The error appears later when you try to start a VM. If you hit a virtualization error in Step 2, come back here to fix it.

Seeing a virtualization error when starting a VM?

If VirtualBox shows an error mentioning VT-x or AMD-V when you try to start a virtual machine, hardware virtualization is disabled. Follow these steps to enable it:

  • Shut down your computer completely (do not use Sleep or Hibernate).
  • Power it back on and press the BIOS key during startup. This is usually F2, F10, Del, or F1 depending on your computer manufacturer.
  • Navigate to the CPU, Security, or Advanced menu.
  • Look for a setting called Intel Virtualization Technology, VT-x, AMD-V, or SVM Mode. Enable it.
  • Save changes and exit the BIOS. Your computer will restart.
  • Open VirtualBox again and try starting the VM.

If Hyper-V is enabled on your Windows machine, it can also block VirtualBox from accessing virtualization. Open a Command Prompt as Administrator and run:

bcdedit /set hypervisorlaunchtype off

Restart your computer after running this command.

Still stuck? Help me troubleshoot VT-x or AMD-V not being available in VirtualBox on my Windows machine.

VirtualBox is installed and ready. Next up, you'll import a pre-built Kali Linux virtual machine packed with penetration testing tools.

Import the Kali Linux Virtual Machine

VirtualBox is installed and ready to host virtual machines. Now you need an operating system to run inside it.

Kali Linux is the industry-standard operating system for penetration testing. It comes pre-loaded with hundreds of security tools, so you do not need to install anything extra once it is running.

In this step, get ready to:
  • Download the pre-built Kali Linux VirtualBox image.
  • Extract and import the virtual machine into VirtualBox.
  • Boot the VM and log in to the Kali desktop.
Download the Kali Linux VirtualBox image

Kali provides a pre-built VirtualBox image so you can skip a full OS installation. The image is a compressed archive that contains a ready-to-run virtual machine.

  • Open your web browser and navigate to https://www.kali.org/get-kali/.
  • Scroll down to the Pre-built Virtual Machines section.
  • Find the VirtualBox row and click the download link for the 64-bit image.
  • The file is called kali-linux-2026.1-virtualbox-amd64.7z and is approximately 3.6 GiB. The download may take several minutes depending on your internet speed.

Why a pre-built image instead of a full install?

A pre-built image saves you 30+ minutes of manual OS installation. It already includes all the tools you need for this project, like Nmap and Burp Suite, pre-installed and configured.

Download taking too long?

At 3.6 GiB, this download can take a while on slower connections. Make sure your computer does not go to sleep during the download. If the download fails partway through, try using the torrent link on the same page for a more reliable transfer.

help me troubleshoot a slow or failed download of the Kali Linux VirtualBox image

Extract the archive and import the VM

The downloaded file is a .7z archive. Windows does not extract this format natively, so you need 7-Zip (a free file archiver) to unpack it.

  • If you do not already have 7-Zip installed, download it from https://www.7-zip.org/.
  • Download the 64-bit Windows x64 .exe installer and run it with the default settings.
  • Once 7-Zip is installed, navigate to the folder where you downloaded kali-linux-2026.1-virtualbox-amd64.7z in File Explorer.
  • Right-click the file, select 7-Zip, then click Extract Here.
  • Wait for the extraction to complete. This creates a folder containing a .vbox file and associated disk image files.

What is a .vbox file?

The .vbox file is a VirtualBox configuration file. It tells VirtualBox the VM's hardware settings (RAM, CPUs, disk paths) so it can boot the machine without any manual configuration on your part.

Now you will add the extracted VM to VirtualBox.

  • Switch back to the VirtualBox Manager window.
  • Click Machine in the top menu bar.
  • Click Add.
  • In the file browser that opens, navigate to the folder where you extracted the archive.
  • Select the .vbox file (it will be named something like kali-linux-2026.1-virtualbox-amd64.vbox) and click Open.

The Kali Linux VM now appears in your VirtualBox Manager sidebar.

Don't see the .vbox file?

Make sure you extracted the .7z archive first. If you only see the .7z file in the folder, right-click it and use 7-Zip to extract it. The .vbox file is inside the extracted folder, not inside the archive directly.

help me find the .vbox file after extracting the Kali Linux archive

Boot the VM and log in to Kali Linux

With the VM imported, you can now start it up and verify you can reach the Kali Linux desktop.

  • In VirtualBox Manager, click on the Kali Linux entry in the left sidebar to select it.
  • Click the green Start arrow in the toolbar at the top.
  • A new window opens showing the VM booting up. Wait for the login screen to appear.
  • Enter the username kali and press Enter.
  • Enter the password kali and press Enter.

You should now see the Kali Linux desktop with a dark theme and a dragon logo wallpaper. This confirms the VM is running correctly.

Why are the default credentials kali/kali?

All pre-built Kali VirtualBox images ship with the same default username and password for convenience. Since this VM runs in an isolated environment on your machine, these simple credentials are safe for a practice lab.

VM won't start or shows a black screen?

Make sure hardware virtualization (Intel VT-x or AMD-V) is enabled in your BIOS settings. You verified this in the previous step. If the VM window stays black for more than 60 seconds, try powering it off (Machine > Power Off) and starting it again.

Also confirm your computer has at least 8 GB of total RAM. The Kali VM needs 2 GB allocated to it, and your host operating system needs the rest to function smoothly.

help me fix my Kali Linux VM that won't boot in VirtualBox

Your penetration testing operating system is up and running. Next up, you will set up a deliberately vulnerable web application inside this VM to use as your hacking target.

Set Up DVWA as Your Vulnerable Target

Your Kali Linux VM is running and ready for action. Now you need something to attack.

In a real penetration test, you would have a client's system as your target. For practice, you need a deliberately vulnerable application that is safe and legal to hack. DVWA (Damn Vulnerable Web Application) is a PHP web app designed with common security flaws built in on purpose.

In this step, get ready to:
  • Install DVWA and start it inside your Kali VM.
  • Initialize the DVWA database.
  • Log in and configure the security level for testing.
Install and start DVWA

DVWA is available directly from Kali's package repository. The package handles all the dependencies for you, including Apache, MariaDB, and PHP.

  • Open a terminal inside your Kali VM by right-clicking the desktop and selecting Open Terminal Here.
  • Install DVWA by running this command:
sudo apt install dvwa

What does this command do?

The sudo prefix runs the command with administrator privileges. apt install dvwa downloads and installs DVWA along with all its dependencies: a web server (Apache), a database (MariaDB), and PHP.

Will it ask for a password?

The pre-built Kali VM typically has passwordless sudo configured. If prompted for a password, enter kali (the default password for the kali user).

You may also see a confirmation prompt asking to continue. Press Y then Enter to confirm the installation.

  • Once the installation finishes, start DVWA by running:
dvwa-start

You should see messages indicating that the web server and database services have started successfully.

Seeing an error when starting DVWA?

If you see a message about the database already existing, run dvwa-stop first, then try dvwa-start again. Make sure your Kali system is up to date by running sudo apt update && sudo apt upgrade before retrying.

Help me troubleshoot DVWA not starting in my Kali VM.

Initialize the DVWA database

DVWA needs a database to store its vulnerable user accounts and test data. You initialize this through the DVWA web interface.

  • Open the web browser inside your Kali VM (click the browser icon in the taskbar, or find Firefox ESR in the applications menu).
  • Navigate to http://127.0.0.1/dvwa in the address bar.
  • You will be redirected to the DVWA setup page. Scroll down to find the Create / Reset Database button.
  • Click Create / Reset Database.

After a moment, DVWA creates its database and redirects you to the login page.

What just happened?

Clicking that button created a MySQL database called dvwa and populated it with vulnerable user accounts and test data. This is the data you will extract later using SQL injection.

Page not loading?

Make sure you ran dvwa-start in the terminal before opening the browser. If the page still doesn't load, try waiting 10-15 seconds for the web server to fully start, then refresh the page.

Help me get DVWA loading in my browser.

Log in and set the security level to Low

DVWA has multiple security levels that control how much input filtering is applied. Setting it to Low removes all defenses, making vulnerabilities easy to exploit for learning.

  • On the DVWA login page, enter admin in the Username field.
  • Enter password in the Password field.
  • Click Login.
  • In the left sidebar, click DVWA Security.
  • Change the security level dropdown from its current setting to Low.
  • Click Submit.

You should see a confirmation that the security level has been set to Low.

Why set security to Low?

DVWA has four security levels: Low, Medium, High, and Impossible. At Low, the application applies zero input filtering, so SQL injection and XSS payloads work without any tricks.

This lets you see the vulnerability concept clearly before learning how defenses work at higher levels.

Your vulnerable target is live and ready. Next up, you will use Nmap to scan this target and discover what services are running on it.

Scan Your Target with Nmap

Your vulnerable target is live and waiting to be attacked. Before you can exploit any system, you need to discover what services are running on it and what doors are open.

This discovery process is called reconnaissance. Nmap is the industry-standard tool for network reconnaissance. It probes a target to find open ports, identify running services, and fingerprint the operating system.

In this step, get ready to:
  • Run a service detection scan against your DVWA target.
  • Interpret the scan results to identify open ports and services.
  • Run an OS detection scan to fingerprint the system.
Run a service detection scan

The first phase of any penetration test is figuring out what's running on the target. A service detection scan connects to each open port and identifies the exact software behind it.

  • In your Kali VM, right-click the desktop and select Open Terminal Here to open a terminal.
  • Run a service detection scan against your localhost target by running this command:
nmap -sV 127.0.0.1

What does this command do?

  • nmap launches the Nmap network scanner.
  • -sV tells Nmap to probe open ports and determine the service name and version number running on each one.
  • 127.0.0.1 is the target IP address. This is your localhost, where DVWA is running.

The scan takes a few seconds. You should see a table of results with columns for PORT, STATE, SERVICE, and VERSION.

  • Look for port 80/tcp listed as open with the service identified as http running Apache httpd.
  • You may also see port 3306/tcp listed as open, running MariaDB. This is the database that DVWA uses behind the scenes.

What is a port?

A port is a numbered endpoint on a computer that a specific service listens on. Port 80 is the standard port for web traffic (HTTP). When Nmap finds port 80 open, it means there's a web server accepting connections there.

Think of ports like doors on a building. Each door leads to a different service. Nmap checks which doors are open and identifies who's behind them.

Not seeing any open ports?

  • Make sure DVWA is still running. In your terminal, run dvwa-start to restart it if needed.
  • Confirm you typed the target address as 127.0.0.1 (localhost), not a different IP.

Still stuck? Why is my Nmap scan not finding any open ports on localhost?

Run an OS detection scan

The service detection scan told you what software is running. Now you can go deeper and ask Nmap to fingerprint the entire operating system and enumerate detailed version information for every service.

  • Run a comprehensive scan with OS detection enabled by running this command:
nmap -A 127.0.0.1

What does the -A flag do?

The -A flag enables OS detection, version detection, script scanning, and traceroute all in one command. It gives you the most complete picture of a target in a single scan.

Compared to -sV (which only does version detection), -A adds the operating system fingerprint, runs default Nmap scripts against discovered services, and maps the network path to the target.

This scan takes slightly longer than the first one. When it finishes, you should see additional sections in the output beyond just the port table.

  • Look for a Device type line identifying the target as a general purpose machine.
  • Look for OS details showing the Linux kernel version that Kali is running.
  • Notice that the port 80 entry now includes additional script output, such as the page title or HTTP methods the server supports.

Why does this matter for penetration testing?

Knowing the exact OS version and service versions tells you which known vulnerabilities might apply. An attacker would use this information to search for exploits targeting that specific software version.

In a real engagement, you would take these results and cross-reference them against vulnerability databases to find potential attack paths.

Seeing 'Running: Linux' but no detailed OS version?

  • OS fingerprinting against localhost can sometimes produce less detailed results than scanning a remote host. This is normal and expected.
  • The important thing is that you see the scan completed with service version details for port 80.

Need more help? Why is Nmap's OS detection less detailed when scanning localhost?

You have completed your first network reconnaissance. You now know exactly what's running on your target and which ports are accepting connections. Next up, you will intercept live web traffic using Burp Suite and use it to exploit DVWA's vulnerabilities.

Intercept Web Traffic with Burp Suite

Your Nmap scans revealed that port 80 is open and running an Apache web server. You know what services are running. Now it is time to see how those services communicate.

In this step, you will launch Burp Suite, a web application security testing tool that acts as a proxy between your browser and the target. Every HTTP request and response passes through Burp, letting you inspect, modify, and replay traffic at will.

In this step, get ready to:
  • Launch Burp Suite and open its built-in browser.
  • Browse to DVWA's SQL Injection page through Burp's proxy.
  • Capture an HTTP request and send it to Burp's Repeater tool.
Launch Burp Suite Community Edition

Burp Suite is pre-installed on your Kali VM. You need to launch it and get past the startup wizard before you can intercept any traffic.

  • In your Kali VM, click Applications in the top-left menu bar.
  • Navigate to Web Application Analysis and click Burp Suite.
  • Burp Suite will display a startup wizard. When asked to select a project file and configuration, click Next and then Start Burp to launch with a temporary project.

Burp Suite takes a few seconds to load. You should see the main Burp Suite dashboard appear with multiple tabs across the top.

What is a web proxy?

A web proxy sits between your browser and the internet. Instead of your browser talking directly to a web server, it sends requests through the proxy first. This gives you a chance to read, modify, or block any request before it reaches its destination.

Penetration testers use proxies like Burp Suite to understand exactly what data a web application sends and receives. This is how they find vulnerabilities that are invisible from the normal browser view.

Burp Suite not launching?

If Burp Suite does not appear in the Applications menu, try opening a terminal and running burpsuite to launch it from the command line. If you see a Java error, your VM may need more allocated RAM (at least 2 GB).

Help me troubleshoot Burp Suite not launching on my Kali VM.

Configure Burp's browser to use the proxy

Burp Suite includes a built-in Chromium browser that is already configured to route all traffic through Burp's proxy at 127.0.0.1:8080. This is the simplest way to start intercepting traffic without changing any Firefox settings.

  • In Burp Suite, click the Proxy tab at the top of the window.
  • Click the Intercept sub-tab to open the intercept view.
  • Make sure the intercept toggle says Intercept is off. If it says "Intercept is on", click the toggle to turn it off. You want traffic to flow freely for now so you can browse DVWA normally.
  • Click Open Browser. This launches Burp's built-in browser, which is preconfigured to work with Burp's proxy.

A Chromium browser window opens. All traffic from this browser automatically passes through Burp's proxy on port 8080.

Why use Burp's built-in browser?

Burp's built-in browser comes preconfigured to route traffic through the proxy and trust Burp's SSL certificate. If you used Firefox instead, you would need to manually set the proxy to 127.0.0.1:8080 and install Burp's CA certificate. The built-in browser skips all of that setup.

  • In Burp's browser, navigate to http://127.0.0.1/dvwa.
  • Log in with username admin and password password.
  • In the left sidebar, click SQL Injection. This opens the page you will attack in the next step.

You should see the DVWA SQL Injection page with a text field labeled "User ID" and a Submit button.

DVWA not loading in Burp's browser?

Make sure DVWA is still running. Switch back to your Kali terminal and run dvwa-start if you stopped it earlier. Also confirm the URL is exactly http://127.0.0.1/dvwa (not https).

Help me get DVWA working in Burp's browser.

Capture a request and send it to Repeater

Every request you made while browsing DVWA was recorded by Burp's proxy. You can review this traffic in the HTTP history and send interesting requests to the Repeater tool for manual manipulation.

  • Switch back to the Burp Suite window.
  • Click the Proxy tab, then click the HTTP history sub-tab.
  • You should see a list of all HTTP requests that passed through the proxy. Look for a GET request to a URL containing /dvwa/vulnerabilities/sqli/. This is the SQL Injection page you just visited.
  • Right-click on that request and select Send to Repeater.
  • Click the Repeater tab at the top of Burp Suite. You should see the request waiting in its own numbered tab.

What is Burp Repeater?

Repeater lets you manually edit and resend individual HTTP requests as many times as you want. Each time you click Send, the modified request goes to the server and you see the response instantly.

This is the tool penetration testers use to craft and test attack payloads. You can tweak a single parameter, resend, and immediately see whether the server responds differently.

You should now see the full HTTP request in the left pane of the Repeater tab, with fields showing the host, headers, and any parameters.

Don't see the request in HTTP history?

Make sure you browsed to the SQL Injection page using Burp's built-in browser (the one you opened with Open Browser), not the regular Kali Firefox browser. Only traffic from Burp's browser passes through the proxy automatically.

If the history has many entries, look for the one with sqli in the URL column. You can also sort by the URL column to find it faster.

Help me find the DVWA SQL Injection request in Burp's HTTP history.

Your proxy is set up and you have a captured request ready for manipulation. Next up, you will use Repeater to inject a SQL payload and extract data from DVWA's database.

Exploit a SQL Injection with Burp Suite

You've captured live HTTP traffic and staged a request in Burp Suite's Repeater tool. Now it's time to weaponize that request.

SQL injection works by inserting database commands into input fields that the application trusts blindly. With DVWA's security level set to Low, there's zero input filtering. You'll modify the request's id parameter to trick the database into returning data it was never meant to show.

In this step, get ready to:
  • Test a basic SQL injection payload that bypasses query logic and dumps all user records.
  • Extract actual usernames and password hashes using a UNION-based injection.
Inject a basic OR-based payload

The simplest SQL injection test uses an OR condition that always evaluates to true. Instead of returning one user record, the database returns every record in the table.

  • Switch back to Burp Suite's Repeater tab where your DVWA SQL Injection request is loaded.
  • Find the id parameter in the request body or URL query string.
  • Replace the current value of the id parameter with the following payload:
1' OR '1'='1
  • Click Send in the top-left area of the Repeater panel.

What does this payload do?

The original query expects a single user ID like 1. By injecting 1' OR '1'='1, you're closing the original quote and adding a condition that's always true.

The database now reads the query as: give me the user with ID 1, OR give me everything where 1 equals 1. Since 1 always equals 1, the database returns every row in the table.

Look at the response panel on the right side of Repeater. You should see HTML containing multiple user records (not just one) from the DVWA database.

Only seeing one record or an error?

Make sure DVWA's security level is still set to Low. If it reset, navigate to DVWA Security in the sidebar and change it back.

Check your payload for typos. The single quotes and spacing must be exact: 1' OR '1'='1. A missing or extra quote breaks the injection.

Help me troubleshoot my SQL injection payload in Burp Repeater

Extract usernames and password hashes with a UNION injection

The first payload proved the injection works. Now you'll use a UNION-based attack to pull data from a completely different table in the database.

  • In Burp Repeater, find the id parameter again.
  • Replace the current payload with this more advanced UNION-based injection:
1' UNION SELECT user, password FROM users#
  • Click Send.

What does UNION SELECT do?

UNION lets you append the results of a second query to the first. Here, the original query selects from one table, but your injected UNION SELECT pulls the user and password columns from the users table.

The # at the end is a MySQL comment character. It tells the database to ignore the rest of the original query, preventing syntax errors.

Look at the response. You should see actual usernames (like admin) alongside long strings of letters and numbers. Those long strings are MD5 password hashes extracted directly from the database.

Why is this so dangerous?

You just extracted credential data that was never supposed to leave the database. In a real application, an attacker could crack these hashes offline and gain access to user accounts.

This is exactly why input validation and parameterized queries exist. DVWA's Low security setting skips all of these defenses so you can see the raw impact.

Seeing an error instead of extracted data?

UNION requires that both SELECT statements return the same number of columns. DVWA's Low-security SQL Injection page returns 2 columns, which matches user, password. If you see a column count mismatch error, double check you haven't added extra fields.

Verify the table name is exactly users (lowercase, plural). A typo here causes a 'table doesn't exist' error.

Help me fix my UNION-based SQL injection payload

You just performed a complete SQL injection attack, from a simple logic bypass all the way to extracting credentials from the database. Next up, you'll push your skills further by automating vulnerability discovery with Nmap's scripting engine.

Secret mission

Nmap Scripting Engine (NSE) Vulnerability Scan

You just exploited a SQL injection manually using Burp Suite. But what if you could automate vulnerability discovery? Nmap's Scripting Engine can scan for known weaknesses without any manual effort. Run NSE scripts against your DVWA target and compare what automation finds versus what you discovered by hand.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely on your local machine inside a virtual machine. There are no cloud resources or ongoing costs.

Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

Resources you used:

  • Kali Linux 2026.1 virtual machine (including DVWA, Nmap, and Burp Suite inside it).
  • Oracle VirtualBox 7.2.8 installed on Windows.

Keep everything running

No action needed. Choose this if you plan to keep practicing penetration testing or want to revisit the lab later.

  • Your Kali VM stays in VirtualBox, ready to boot any time.
  • DVWA, Nmap, and Burp Suite all live inside the VM. Nothing runs in the background when the VM is powered off.
  • VirtualBox itself uses no resources when no VMs are running.

Pause - I'll come back to this later

Shut down the VM to free up RAM, but keep the files on disk so you can return later.

  • Inside the Kali VM, stop DVWA by opening a terminal and running:
dvwa-stop
  • Shut down the Kali VM by clicking the power icon in the top-right corner of the Kali desktop and selecting Shut Down.
  • Close VirtualBox Manager.
  • When you want to resume, open VirtualBox, select your Kali VM, and click Start. Then run dvwa-start in the terminal to bring DVWA back up.

Delete - I don't want to use this again

Remove all project resources from your machine completely.

  • In VirtualBox Manager, right-click your Kali Linux VM in the left sidebar.
  • Select Remove.
  • When prompted, click Delete all files. This removes the VM and its virtual hard disk (which contained DVWA, Nmap results, and Burp Suite configuration).
  • Delete the extracted Kali image folder you originally downloaded. If you saved it to your Downloads folder, open File Explorer, navigate to Downloads, and delete the kali-linux-2026.1-virtualbox-amd64 folder and the kali-linux-2026.1-virtualbox-amd64.7z archive.
  • To uninstall VirtualBox, press the Windows key and type Add or remove programs.
  • Press Enter to open the settings page.
  • Search for VirtualBox in the app list, click the three-dot menu next to it, and select Uninstall.
  • Follow the uninstall prompts to remove VirtualBox from your system.

Nice Work!

Nice Work!

Congratulations! You just built a professional-grade penetration testing lab from scratch and used it to perform real cybersecurity attacks against a vulnerable target.

You've learned how to:

  • Built an isolated penetration testing lab using VirtualBox and Kali Linux, then deployed DVWA as a safe, legal target for practicing web application attacks.
  • Used Nmap to perform network reconnaissance and service enumeration, discovering open ports and identifying running services on your target.
  • Intercepted web traffic with Burp Suite and exploited a SQL injection vulnerability to extract usernames and password hashes from a database.
  • Secret Mission: Used Nmap's Scripting Engine (NSE) to automate vulnerability discovery and compared automated scanning results against manual testing findings.

Ready to quiz yourself?