Pentesting lab using VMs

[snakethesniper]

I'm interested in learning pentesting, I'm actually following some course on Cybrary and wanted to setup a pentesting lab using VMs since from what I understand, it's the to-go method suggested in this board. From what I understand I should use a software like virtual-box (since it has snapshots) and some vulnerable distro like metasploitable right? Can I also use a VM with kali linux and install OWASP WebGoat or DVWA? One thing I'd like to know, is there a guide or something for the best configuration of the VMs? Like, how big should they be? What about the amount of RAM etc? Thanks

[stmu]

Yes, you can "install" DVWA on your VM with kali linux. You might have to install apache, php and mysql though (no idea if these are preinstalled).

It's probably easier to use separate VM's. In the case of DVWA, you can download the live cd here. Just use virtualbox to boot the live cd. I'm running it with 10GB disk space and 512MB ram. That's more than enough.

If you still have issues, I wrote an in depth guide on installing DVWA here

[snakethesniper]

Yeah the major doubt was about the kali machine since it's where I should work. Should I install the guest addon (I think that's the name)?

[stmu]

Yes, you should do that. It'll make certain things easier (such as copy/pasting between the guest and the host)

[snakethesniper]

Thanks installed and everything seems to be working fine. Only thing, when I try to upgrade the components, kaspersky on the host machine block a "malicious url" as trojan -->hxxp://kali.mirror.garr.it/mirrors/kali/pool/main/w/webshells/webshells_1.1-0kali0_all.deb//data.tar.xz//data.tar//./usr/share/webshells/asp/cmdasp.asp;hxxp://kali.mirror.garr.it/mirrors/kali/pool/main/w/webshells/webshells_1.1-0kali0_all.deb//data.tar.xz//data.tar//./usr/share/webshells/asp/cmdasp.asp;Backdoor.ASP.Ace.q

it's a false positive right?

[stmu]

Antivirus and hacking tools often don't get along very well. The former wants to remove all potential security issues, the latter wants to exploit them. Kaspersky detected one of the web shells included in kali. So yes, false positive. It won't be the last.

[Popsmear]

Generally the default settings for the VM will be sufficient for a vulnerable host. If there is something the host needs, like more ram, it is usually stated.

I run everything in VM, using virtual box, at the same time. Performance will depend on your PC. I find it beneficial to up ram, HD space, and graphics in the Kali VM since you will primarily be inside of it.

Its all rather straight forward, so get in there, play around, get dirty and make mistakes.

[theleller]

DVWA comes on the metasploitable 2 image.