Home Lab Setup
A home lab is your own isolated environment to attack and defend safely. You do not need expensive hardware; a modest laptop running virtual machines is enough to start, and free tier cloud covers the rest. The lab matters because it is where you turn reading into skill, and a documented lab is strong portfolio evidence.
Why a home lab is non negotiable
You cannot practise attacks on systems you do not own, and you should not. A home lab is the legal, safe place to break things, and breaking things is how you learn. It is also the project that most impresses interviewers, because it proves you do this voluntarily.
What you actually need
| Component | Minimum |
|---|---|
| A host machine | A laptop with 8 GB RAM, 16 is better |
| Virtualisation | VirtualBox or VMware, both have free options |
| Attacker VM | Kali or Parrot Linux |
| Target VMs | Deliberately vulnerable machines |
| Isolation | A host only network, no bridge to your real network |
Isolation is the safety rule: put your lab on a host only or internal network so vulnerable and malicious machines cannot reach your real network or the internet unintentionally. Set this up before you download a single vulnerable VM.
The offensive lab
An attacker VM plus vulnerable targets. Practise the full chain: reconnaissance with Nmap, exploitation with Metasploit, and privilege escalation. Introduce misconfigurations yourself so you learn to recognise them.
The defensive lab
Add a SIEM like Wazuh, generate attack telemetry from the offensive side, and write detections for it. This single setup teaches both sides and answers most SOC interview questions. See SIEM explained.
Building an Active Directory lab
For serious offensive practice, a small Windows domain with two machines lets you practise the attacks that decide real engagements: Kerberoasting, DCSync and lateral movement. It is the highest value lab you can build.
No hardware? Use free tier cloud
If your laptop cannot run several VMs, cloud free tiers let you build a small lab online for almost nothing. It also doubles as hands on cloud experience, which is a paid skill in itself.
Document everything
Write up your lab: what you built, what you attacked, what you found, how you fixed it. That document is portfolio material that outperforms a certificate with nothing behind it. See projects that get you interviews.
Or skip the setup and start free
If you just want to start practising today without building anything, Hacklido is a free browser based lab, no setup required.
Enroll in VAPT
Live instructor led training with hands on labs and a verifiable certificate. Or start free on Hacklido.
Enroll in VAPT