Kali Linux and DVWA on VirtualBox: Build Your First Hacking Lab

Every practical skill in offensive security has the same starting requirement, and it is not a certificate or an expensive course. It is a place to practise that is entirely yours. You cannot learn to attack web applications by attacking real websites, because doing that is a crime no matter how curious or well intentioned you are. So the first thing any serious learner builds is a lab, an isolated environment where the targets belong to you, the network belongs to you, and nothing you do can spill out onto anyone else.

In this guide we build exactly that. By the end you will have Kali Linux running as your attacking machine and DVWA, the Damn Vulnerable Web Application, running as a target, both wired together on a private network inside VirtualBox on your own computer. Then you will land your first real attacks against it. This lab is the workbench for the rest of the hacking series, so it is worth taking the time to set up properly.

One rule sits above everything else here, and I am not going to soften it. Everything you practise in this lab stays in this lab. The reason you build an isolated environment in the first place is so you never have to test against systems you do not own. Keep that line clean and this hobby stays a career. Cross it and it becomes a criminal record.

Why a virtual lab beats every other option

When people first get into hacking they often want to install Kali as their main operating system, or dual boot it alongside Windows. I understand the appeal, but for learning it is the wrong move. Virtual machines give you three things that matter enormously when you are experimenting with tools designed to break things.

The first is isolation. Your attacking tools and your deliberately vulnerable targets live inside sealed boxes that cannot touch your real files or, more importantly, the public internet. A vulnerable application exposed to the open internet gets compromised by someone else within minutes, and you do not want to be the person who accidentally hosted an attacker’s foothold.

The second is snapshots. A snapshot is a frozen copy of a machine’s exact state that you can return to whenever you want. Break something, misconfigure a tool, infect a target with a payload that got out of hand, and you simply roll back. This single feature turns nervous, careful experimentation into fearless play, and fearless play is how you actually learn.

The third is convenience. You can run the attacker and the victim on the same laptop at the same time, watch traffic flow between them, and tear the whole thing down when you are done. No spare hardware, no reinstalling your operating system, no risk to your daily machine.

What you are building

Three pieces fit together in this lab, and it helps to understand the role each one plays before you start clicking through installers.

VirtualBox is the free virtualisation software from Oracle that lets you run whole operating systems as guests inside your normal desktop. It is the foundation everything else sits on.

Kali Linux is a Linux distribution built for security work, preloaded with hundreds of offensive tools including Burp Suite, Nmap, sqlmap, Hydra, and the whole toolkit you will grow into. In this lab it plays the attacker.

DVWA is a web application that is full of vulnerabilities on purpose. SQL injection, cross site scripting, command injection, file upload flaws, broken access control, and more, all sitting there waiting for you to exploit them legally. It plays the target.

The plan is simple. Install VirtualBox, drop Kali and a DVWA host into it, connect them on a private network that has no path to the internet, then start attacking.

Step one: confirm your machine can virtualise

Before downloading anything, make sure hardware virtualisation is available and switched on, because nothing else works without it.

On Windows, open Task Manager, go to the Performance tab, select CPU, and look for a line that reads Virtualization. If it says Enabled you are ready. If it says Disabled you need to turn on Intel VT-x or AMD-V in your firmware settings. Reboot into your BIOS or UEFI, usually by pressing F2, F10, Del, or Esc during startup depending on your manufacturer, find the virtualisation option under CPU or Advanced settings, enable it, save, and reboot.

For resources, 8 GB of RAM lets you run both machines together comfortably. With 4 GB you can still learn, you just run one machine at a time. Set aside 40 to 50 GB of free disk space, because virtual disks grow as you use them.

Step two: install VirtualBox

Download VirtualBox only from the official site at virtualbox.org. I cannot stress this enough. Virtualisation software from a random mirror or a search advert is exactly the kind of thing attackers backdoor, and it would be a grim irony to get compromised while setting up a security lab. While you are on the site, grab the matching Extension Pack, which adds USB and other device support.

Run the installer and accept the defaults. It will briefly interrupt your network adapters partway through, which looks alarming but is completely normal. Once it finishes, open VirtualBox, go to File, then Tools, then Extension Pack Manager, and install the Extension Pack you downloaded.

Step three: install Kali Linux, your attacking machine

You have two ways to get Kali running, and I strongly recommend the easier one for your first lab. The Kali team publishes a prebuilt VirtualBox image, which saves you from performing a full operating system installation by hand.

Head to kali.org and choose the get Kali option, then pick Virtual Machines. Download the VirtualBox image, which arrives as a compressed archive containing a virtual disk and a machine definition file. Extract it, then in VirtualBox choose Add rather than New, and select the extracted machine file. Start the virtual machine.

The official image ships with a default username of kali and a default password of kali. Change that password immediately by opening a terminal and running the passwd command. Default credentials are one of the most common ways real systems get compromised, so building the habit of changing them now serves you well later.

Once Kali boots, update everything before you do anything else. Open a terminal and run:

sudo apt update && sudo apt full-upgrade -y

When that finishes, take your first snapshot. In the VirtualBox menu for the machine, choose Take Snapshot and name it something like clean-updated-kali. From now on, if anything goes wrong you can return to a fresh, fully updated Kali in seconds rather than reinstalling.

Step four: set up DVWA, your target

The cleanest way to get DVWA running quickly is Docker inside a small Linux target virtual machine. On a target VM, install Docker, then pull and run the DVWA image:

docker run --rm -it -p 127.0.0.1:8080:80 vulnerables/web-dvwa

Browse to the address you mapped, log in with the default DVWA credentials of admin and password, and click the button to create and reset the database on the setup page. That initialises the vulnerable application and you are ready.

If you would rather not use Docker, you can install DVWA by hand on a Linux VM running Apache, PHP, and MySQL. Clone the project from its GitHub repository, point your web server at the files, edit the configuration to match your database, and browse to the setup page. The project’s readme walks through every step. Either way, the target lives on a machine you fully control.

Step five: wire the network so nothing leaks

This is the step people rush, and it is the one that matters most. Do not, under any circumstances, expose a deliberately vulnerable machine to the internet.

The safe layout puts both machines on a private segment. In each virtual machine’s network settings, attach the adapter to a Host-Only or Internal Network. That lets Kali and the DVWA target talk to each other while keeping the target invisible to the outside world. If Kali needs internet access for updates, give it a second adapter set to NAT, but keep the vulnerable target on the isolated network only.

Find each machine’s address by running ip a inside it. From Kali, confirm you can reach the target with a quick ping to its address, then open Kali’s browser and load the target’s web page. If the DVWA login screen appears, your lab is connected and isolated, and you are ready to attack.

Step six: land your first attacks

Log into DVWA and set the security level to Low using the DVWA Security menu. Low leaves the vulnerabilities fully open so you can see how each one behaves before any defence gets in the way.

Start with SQL injection, because nothing makes the concept click like watching it happen. On the SQL Injection page, enter the number 1 in the user ID field and you get a single record back. Now enter this instead:

1' OR '1'='1

Suddenly the application returns every user in the database. What just happened is that your input broke out of the space the developer intended for it and became part of the database query itself. You told the database to return records where the ID is 1 or where one equals one, and since one always equals one, it handed over everything. That single moment, the application giving up data it was never meant to expose, teaches more than any diagram ever could. When you are ready to go deeper on this, my full guide to sqlmap shows how to automate and extend exactly this kind of attack.

From there, work through the rest of the DVWA menu. On the cross site scripting pages, try injecting a simple script payload and watch it execute in your browser, then read my breakdown of how cross site scripting actually works to understand why. On the command injection page, chain an extra system command onto the input and watch the server run it, which the command injection walkthrough explains in detail. Try the file upload and file inclusion pages, and poke at the broken access control examples, which connect directly to the ideas in my post on IDOR and broken access control.

Bring Burp Suite into the lab

Once you are comfortable clicking through DVWA in a browser, the next leap is to put a proxy between you and the target so you can see and manipulate every request. Kali comes with Burp Suite, and configuring your browser to route through it turns DVWA from a set of web pages into a laboratory where you control every byte that leaves your machine.

With Burp intercepting, you can catch a request, change a hidden field, replay it dozens of times with different values, and watch how the application reacts. This is where web hacking really opens up, and it is the workflow professional testers use every day. I wrote a complete guide to Burp Suite that pairs perfectly with this lab, and once you add tools like ffuf for content discovery you start to see how the pieces of a real engagement fit together.

Climb the security levels

After you have broken every page on Low, do not move on. Go back to the DVWA Security menu and switch to Medium, then High, then Impossible, and try the same attacks again.

On Medium you will find simple filters that you can often bypass with a little creativity. On High the defences get tougher and force you to think harder. On Impossible the code is written correctly and your attacks fail, which is the point. Seeing a vulnerability get progressively harder to exploit, and finally impossible, is one of the fastest ways to understand what secure code actually looks like. Attackers who understand defence are far more dangerous than those who only memorise payloads, and this exercise builds that understanding directly.

Habits that separate people who progress from people who stall

A few practices will make this lab pay off far more than the setup itself.

Snapshot before you experiment, every time. It costs nothing and it removes the fear that makes people cautious and slow.

Keep your targets isolated, always. The convenience of a quick internet connection is never worth the risk of hosting a compromised machine.

Reset the DVWA database between sessions so you always start from a known clean state.

Write things down. The single biggest difference I see between students who accelerate and students who plateau is note taking. Record what you tried, what worked, what failed, and why. Your notes become your personal playbook, and the act of writing forces you to understand rather than just copy.

Where this fits in your journey

This lab is not a one time exercise you complete and forget. It is the environment you will return to constantly as you learn subdomain enumeration, service enumeration, proxying, fuzzing, and every other skill in offensive security. Build it once, snapshot it, and it is always there waiting.

When you outgrow DVWA, OWASP Juice Shop is a modern JavaScript equivalent with a much broader set of challenges, and PortSwigger’s free Web Security Academy provides hosted labs you are explicitly allowed to attack. TryHackMe and Hack The Box go further into full network scenarios.

If you are still early in your journey and wondering how all of these skills connect, my roadmap on becoming an ethical hacker using free resources puts this lab in context alongside the platforms and study paths that took me from curious beginner to working professional. The barrier to learning practical hacking was never money or raw talent. It was having somewhere safe and legal to practise. You have just built exactly that, so go and break it.

This guide is for education and for use in a lab you fully control. DVWA is intentionally vulnerable and must never be exposed to the internet or any network you do not own. Only ever test systems you own or have explicit written permission to test.