Phase 0: Setting Up Your Lab

🤔 What Even IS Cybersecurity / Pentesting?

If you're here, you probably think hacking is cool. You're right — it is. But before you touch a single tool, let's talk about what you're actually getting into.

What Penetration Testing Actually Is

Penetration testing (pentesting) is the practice of authorized simulated attacks against computer systems, networks, and web applications. The goal is simple: find vulnerabilities before real attackers do, then help the organization fix them.

Think of it like this — a company hires you to break into their building. Not because they want to be robbed, but because they want to know if their locks, cameras, and alarms actually work. You test the defenses, write a report about what you found, and they fix the weaknesses. That's pentesting, but for computers.

Why This is Legal (And When It's Not)

The difference between a pentester and a criminal is one thing: authorization.

• Professional pentests — Companies sign a "Rules of Engagement" document that explicitly states what you're allowed to test, when, and how far you can go. This is a legal contract that protects you.
• Bug bounty programs — Companies like Google, Microsoft, and thousands of others run public programs that say "try to hack us, and we'll pay you for bugs you find." Platforms like HackerOne and Bugcrowd manage these programs. Each one defines a scope (what's fair game) and out-of-scope targets (don't touch these).
• CTF platforms — HackTheBox, TryHackMe, and other platforms provide intentionally vulnerable machines that you have permission to attack. That's what this learning path focuses on.
• ⚠️ Without authorization = illegal. Scanning or exploiting systems you don't own or have explicit permission to test is a criminal offense in most countries (Computer Fraud and Abuse Act in the US, Computer Misuse Act in the UK, etc.). "I was just learning" is not a legal defense.

The Ethical Dimension

You're learning skills that can cause real damage if misused. The cybersecurity community takes ethics seriously — and so should you. Everything you learn here is meant to help you protect systems, not attack them. The best hackers in the world work on the defensive side, making the internet safer for everyone.

🧭 Remember: With great power comes great responsibility. Seriously. The skills you're about to learn are powerful. Use them to build a career, earn bug bounties, protect organizations, and compete in CTFs — never to harm others.

What You'll Actually DO as a Pentester

A typical penetration test follows a methodology. Here's the high-level flow of what you'll be learning throughout this path:

1. Reconnaissance — Gather information about the target. What's the IP? What services are running? What technologies are in use? (Phase 2)
2. Enumeration — Dig deeper. What versions are those services? Are there default credentials? Hidden directories? Misconfigurations? (Phase 2–3)
3. Exploitation — Use the vulnerabilities you found to gain access. Maybe it's a web exploit, maybe it's a default password, maybe it's an unpatched service. (Phase 3)
4. Privilege Escalation — You're in, but as a low-privilege user. Now find a way to become root/admin. (Phase 4)
5. Post-Exploitation — Steal credentials, pivot to other machines, maintain access, exfiltrate data — all to show the client how bad it could get. (Phase 5)
6. Documentation — Write everything up. A pentest without a report is just unauthorized hacking.

Where This Path Can Take You — Career Paths

Learning these skills opens doors to multiple career paths:

• Penetration Tester — The core role. Companies hire you to hack them. Typical salary: $80K–$150K+ depending on experience and specialization.
• Red Teamer — Advanced pentesting. You simulate sophisticated, multi-stage attacks (like a real nation-state or criminal group would conduct). Often includes social engineering, physical security, and long-term campaigns.
• Bug Bounty Hunter — Freelance hacking. Find bugs in companies' systems through their bug bounty programs and get paid per vulnerability. Some hunters earn $500K+/year. Flexible schedule, but inconsistent income starting out.
• Security Researcher — Discover new vulnerabilities (zero-days), develop exploits, publish advisories. Often academic or working for security vendors.
• SOC Analyst (Blue Team) — The defensive side. Monitor networks for intrusions, investigate alerts, respond to incidents. Understanding offensive techniques makes you a much better defender.
• Security Engineer / Architect — Design and build secure systems. Knowing how things break helps you build things that don't.
• GRC / Compliance — Governance, Risk, and Compliance. More business-focused, but technical knowledge is a huge differentiator.

💡 Pro tip: You don't need a degree to break into cybersecurity. Many top pentesters are self-taught. What matters is demonstrable skill — CTF rankings, bug bounty findings, certifications (OSCP, CPTS, CEH), a portfolio of writeups, and a GitHub full of tools. This learning path is designed to build exactly that kind of portfolio.

💻 Installing Kali Linux

Kali Linux is the industry-standard penetration testing distribution. It comes pre-loaded with hundreds of tools. You have three main options for running it:

VM vs Bare Metal — Which Should You Choose?

• Virtual Machine (recommended for beginners): Run Kali inside VirtualBox or VMware on your existing OS. Safe — you can snapshot, restore, and break things without consequences. Slight performance overhead but more than enough for 99% of CTF work.
• Bare metal: Install Kali directly on a dedicated laptop. Maximum performance, native hardware access (useful for Wi-Fi hacking with compatible adapters). But mistakes can brick your system and you lose your daily driver.
• WSL2 (Windows Subsystem for Linux): Quick to set up on Windows, but limited networking capabilities. Fine for basic tool usage, not ideal for HTB/THM VPN tunnels or network-level attacks.

VMware vs VirtualBox

• VirtualBox (free, open-source): Works great for most people. Slightly more manual setup for shared folders and clipboard. Runs on Windows, macOS, and Linux hosts.
• VMware Workstation Player (free for personal use): Generally smoother performance, better USB passthrough, easier shared folders. VMware Workstation Pro (paid) adds snapshots and clones.
• VMware Fusion (macOS): If you're on an Apple Silicon Mac, Fusion with the ARM Kali ISO is your best bet. VirtualBox ARM support is still experimental.

Recommended VM Settings

# Minimum specs for a Kali VM
RAM:        2 GB minimum, 4 GB recommended (8 GB ideal for Burp + browser + tools)
CPU:        2 cores (4 is better)
Disk:       20 GB minimum, 80 GB recommended (you'll fill 40 GB fast with wordlists and tools)
Network:    NAT (for internet) + Host-Only (for lab networks)
Display:    Enable 3D acceleration, 128 MB video RAM

💡 Pro tip: Download the official Kali VM image from kali.org/get-kali/#kali-virtual-machines instead of installing from the ISO. It's pre-configured with VMware Tools or VirtualBox Guest Additions — saves 30 minutes of setup.

VM Network Modes — When to Use Which

Your VM's network adapter settings control how it connects to networks. Getting this wrong is a common source of "why can't I reach the target?" frustration. Here's what each mode does:

┌─────────────────────────────────────────────────────────────────────┐
│                     VM NETWORK MODES                                │
├──────────────┬──────────────────────────────────────────────────────┤
│  NAT         │  VM shares host's IP. VM → internet works.          │
│              │  Host → VM doesn't work without port forwarding.    │
│              │  Other VMs can't see this VM.                       │
│              │  USE FOR: General internet access, updates.         │
├──────────────┼──────────────────────────────────────────────────────┤
│  Bridged     │  VM gets its own IP on your real network.           │
│              │  Appears as a separate device on your LAN.          │
│              │  USE FOR: When target is on your local network.     │
├──────────────┼──────────────────────────────────────────────────────┤
│  Host-Only   │  Private network between host and VMs only.         │
│              │  No internet access. Isolated.                      │
│              │  USE FOR: Lab networks, VM-to-VM communication.     │
├──────────────┼──────────────────────────────────────────────────────┤
│  NAT Network │  Like NAT, but VMs on the same NAT Network can      │
│              │  talk to each other. Best of both worlds.           │
│              │  USE FOR: Multi-VM labs that need internet.         │
└──────────────┴──────────────────────────────────────────────────────┘

Typical CTF setup: Use NAT for your main adapter (so you can update tools and connect to VPN), then add a second adapter as Host-Only if you need to communicate with other local VMs. For HackTheBox/TryHackMe, NAT is usually all you need — the OpenVPN tunnel creates a virtual adapter that routes to the lab network through your internet connection.

Snapshots — Your Safety Net

Before you start modifying your Kali VM, take a snapshot. Snapshots save the exact state of your VM so you can roll back if something breaks. Think of them as save points in a video game.

# Take snapshots at these milestones:
1. "Fresh Install"    → Right after initial setup + updates
2. "Tools Installed"  → After installing your extra tools
3. "Pre-Engagement"   → Before starting a new CTF box or assessment

# In VirtualBox: Machine → Take Snapshot (Host+T, default Host key is Right Ctrl)
# In VMware:     VM → Snapshot → Take Snapshot

⚠️ Warning: Snapshots consume disk space — each one stores the delta from the previous state. If you have 5 snapshots and your VM is heavily modified, that's a lot of extra disk. Delete old snapshots you don't need. Keep 2-3 max.

Lab Network Diagram — What Your Setup Looks Like

┌─────────────────────────────────────────────────────────────────────┐
│                    YOUR PENTESTING LAB                               │
│                                                                     │
│  ┌───────────────┐        ┌──────────────────────────────────┐      │
│  │  Your Host OS │        │  Kali Linux VM                   │      │
│  │  (Windows/Mac)│◄──────►│  192.168.56.2 (Host-Only)        │      │
│  │               │NAT     │  10.0.2.15    (NAT — internet)   │      │
│  └───────┬───────┘        │  10.10.14.X   (VPN — HTB labs)   │      │
│          │                └──────────┬───────────────────────┘      │
│          │                           │ OpenVPN tunnel               │
│  ┌───────┴───────┐        ┌──────────┴───────────────────────┐      │
│  │   Internet    │        │  HTB/THM Lab Network             │      │
│  │               │────────│  10.10.10.0/24 (target machines) │      │
│  └───────────────┘        └──────────────────────────────────┘      │
│                                                                     │
│  Adapter 1: NAT ──────────► Internet access (updates, VPN)          │
│  Adapter 2: Host-Only ───► Talk to host + other local VMs           │
│  tun0:      VPN tunnel ──► CTF lab network (HTB/THM targets)        │
└─────────────────────────────────────────────────────────────────────┘

What's Pre-Installed on Kali

Kali Linux ships with several hundred security tools pre-installed (the exact count varies by installation profile and release). You don't need to install everything manually. Here are the categories you'll use most, with the key tools in each:

• Information Gathering: nmap, enum4linux, dnsenum, whois, theharvester
• Web Applications: burpsuite, nikto, gobuster, sqlmap, wfuzz
• Password Attacks: john, hashcat, hydra, wordlists (in /usr/share/wordlists/)
• Exploitation: metasploit-framework, searchsploit, msfvenom
• Wireless: aircrack-ng, reaver, wifite
• Forensics: autopsy, binwalk, foremost, volatility
• Reverse Engineering: ghidra, radare2, gdb (available via sudo apt install or the kali-tools-reverse-engineering metapackage if not pre-installed)
• Networking: wireshark, tcpdump, netcat, socat

💡 Don't get overwhelmed. You won't use most of these for months. Start with nmap, gobuster, burpsuite, and netcat. Add tools to your workflow as you need them — learning one tool deeply beats knowing 20 superficially.

Wordlists are critical for brute-forcing. Kali includes SecLists if you install it:

# Kali's built-in wordlist
ls /usr/share/wordlists/rockyou.txt.gz
gunzip /usr/share/wordlists/rockyou.txt.gz    # Unzip it first!

# Install SecLists — the gold standard collection
sudo apt install seclists -y
ls /usr/share/seclists/
# Discovery/  Fuzzing/  Passwords/  Payloads/  Pattern-Matching/  Usernames/

⚙️ Essential First-Time Kali Setup

Fresh Kali install? Do these things immediately. The sudo command runs things as root (the system administrator) — you'll see it a lot because installing software and changing system settings requires admin privileges.

# 1. Update everything first
# apt is Kali's package manager — it downloads and installs software.
# 'update' refreshes the list of available packages,
# 'full-upgrade' installs the latest versions of everything.
sudo apt update && sudo apt full-upgrade -y

# 2. Install additional tools not included by default
# seclists: huge collection of wordlists for fuzzing and brute-forcing
# gobuster/feroxbuster: tools that discover hidden directories on web servers
# bloodhound + neo4j: maps Active Directory networks to find attack paths
# pipx: installs Python tools in isolated environments (avoids dependency conflicts)
# jq: parses JSON output from APIs and tools
# tmux: terminal multiplexer — run multiple terminals in one window
# flameshot: screenshot tool for documenting your work
# cherrytree: note-taking app designed for pentesting
sudo apt install -y seclists gobuster feroxbuster bloodhound neo4j \
  pipx golang-go jq tmux flameshot cherrytree

# 3. Install Python tools via pipx (isolated environments)
# impacket: collection of Python tools for attacking Windows/AD networks
# certipy-ad: exploits Active Directory Certificate Services misconfigurations
pipx install impacket
pipx install certipy-ad
pipx install bloodhound

# 4. Clone essential GitHub repos to /opt
# These are collections of scripts and payloads you'll use during pentests:
# PEASS-ng: automated privilege escalation scanners (LinPEAS, WinPEAS)
# nishang: PowerShell scripts for Windows exploitation
# PowerSploit: another PowerShell offensive toolkit
# PayloadsAllTheThings: cheat sheets and payloads for every vulnerability type
sudo mkdir -p /opt/tools && cd /opt/tools
sudo git clone https://github.com/peass-ng/PEASS-ng.git
sudo git clone https://github.com/samratashok/nishang.git
sudo git clone https://github.com/PowerShellMafia/PowerSploit.git
sudo git clone https://github.com/swisskyrepo/PayloadsAllTheThings.git

# 5. Configure your terminal
# Add to ~/.zshrc:
alias ll='ls -la'
alias serve='python3 -m http.server 8888'
alias myip='ip addr show tun0 | grep "inet " | awk "{print \$2}" | cut -d/ -f1'
export PATH="$HOME/.local/bin:$PATH"

# 6. Set up Burp Suite certificate for browser
# Burp Suite is a web proxy — it sits between your browser and
# the target, letting you intercept, inspect, and modify HTTP
# requests. Installing its CA certificate lets Burp decrypt HTTPS
# traffic without your browser throwing security warnings.
# Open Burp → Proxy → Options → Import/Export CA Certificate
# Install in Firefox: Settings → Privacy → Certificates → Import

🎮 CTF Platforms — Where You'll Actually Practice

You've got your Kali VM ready. But where do you actually practice hacking legally? There are several platforms designed specifically for this. Here's everything you need to know about the big ones.

🟢 TryHackMe (THM) — "Duolingo for Hacking"

What it is: TryHackMe is a guided, browser-based cybersecurity training platform. Think of it as Duolingo for hacking — it breaks complex topics into structured "rooms" with step-by-step instructions, questions to answer, and virtual machines you can access directly from your browser. It was founded in 2018 by Ashu Savani, and has grown into one of the most popular platforms for learning cybersecurity from scratch.

How to sign up: Go to tryhackme.com, click "Get Started," and create a free account with your email. That's it — no invite code, no challenge to solve. You can start learning within minutes.

Free vs Premium ($14/month, or ~$10/month billed annually):

• Free tier: Access to ~40% of rooms, limited lab time, but still plenty of content to learn the basics. You can absolutely get started without paying a dime.
• Premium: All rooms unlocked, unlimited lab time, full access to all learning paths, certificates of completion, priority machine spawns. Worth it once you're committed, but not necessary to start.

Key features that make THM special:

• Browser-based AttackBox — This is huge for beginners. You can launch a full Kali-like desktop in your browser without installing anything. No VM needed to get started. Click a button, wait 60 seconds, and you have a hacking environment ready to go.
• Guided rooms with questions — Each room walks you through a topic step by step. After each section, you answer questions to prove you understood. It's like a textbook that checks your work as you go.
• Learning paths — Curated sequences of rooms organized by goal. The "Pre-Security" path teaches networking, Linux, and web basics. "Complete Beginner" covers your first real hacking skills. "Jr Penetration Tester" is a structured pentest course.
• Community writeups — When you're stuck, there are tons of community-written guides for most rooms.

Best for: Absolute beginners, people who want structure and hand-holding, anyone who doesn't want to set up a VM right away.

Rooms to start with (all free):

• "Tutorial" — Learn how the platform works
• "Starting Out in Cyber Sec" — Overview of offensive vs defensive security
• "Intro to Offensive Security" — Your first taste of real hacking
• "Linux Fundamentals Part 1" — Essential terminal skills

Network access: You can either use the in-browser AttackBox or download a .ovpn file to connect from your own Kali VM (more on VPN setup below). For beginners, the AttackBox removes all friction — for serious work, you'll want your own VM.

💡 Pro tip: Start with the "Pre-Security" learning path if you have zero technical background. If you're somewhat comfortable with computers and want to jump into hacking faster, go straight to the "Complete Beginner" path. Both are excellent.

🔴 HackTheBox (HTB) — The Real Challenge

What it is: HackTheBox is a more advanced, competition-style cybersecurity platform. Unlike TryHackMe, there's minimal hand-holding — you get vulnerable machines ("boxes") and it's up to you to figure out how to hack them. Each box has a user flag (proves you got initial access) and a root flag (proves you escalated to administrator). Finding both flags proves you've fully compromised the machine.

HTB was founded in 2017 by Haris Pylarinos. It started as a side project and grew into the go-to platform for serious CTF players and OSCP prep. Fun fact: it used to require solving a hacking challenge just to create an account — that's no longer the case, but it tells you something about the culture.

How to sign up: Go to hackthebox.com and create an account. It's straightforward now — no invite challenge required.

Free vs VIP ($14/month) vs VIP+ ($20/month):

• Free: 2 active machines at a time (the recently released ones), access to Starting Point (guided intro machines), some Academy content. Shared instances (other users are on the same box).
• VIP ($14/month): All active AND retired machines (huge library), your own dedicated box instance (no other users interfering), faster spawns, access to full machine catalog.
• VIP+ ($20/month): Dedicated server — even more isolation and performance. Best for serious grinders.

Key features:

• Active machines — New boxes released weekly, retire after ~5 months. No official writeups until retirement (the community challenge is to solve them yourself).
• Retired machines (VIP) — Huge back-catalog of hundreds of boxes with official writeups available. This is where most learning happens.
• Starting Point — Guided introductory machines for beginners. Step-by-step questions like THM, but on HTB's infrastructure. Start here if you're new to HTB.
• Challenges — Standalone problems in categories: web, crypto, forensics, reverse engineering, pwn (binary exploitation), etc.
• Pro Labs — Enterprise-level multi-machine scenarios that simulate real penetration tests (Dante, Offshore, RastaLabs, etc.). Premium add-on.
• Battlegrounds — Team vs team competitive hacking. Real-time CTF matches.
• Seasons — Competitive ranking system with points and leaderboards.

HTB Academy (separate product): HTB also has an "Academy" — structured courses similar to THM but with HTB's depth and rigor. Some modules are free, others require "cubes" (their currency, earned or purchased). Think of it as the educational wing of HTB. Particularly good for learning specific techniques in depth.

Best for: People who want to develop independent problem-solving skills, CTF competitors, OSCP preparation, anyone who's outgrown guided content.

Difficulty: Machines are rated Easy / Medium / Hard / Insane. Start with Easy and Starting Point. Don't touch Medium until you've done 5-10 Easy boxes comfortably. Hard and Insane are for experienced players.

Community: Active forums and Discord, official writeups released after machine retirement, Ippsec's YouTube walkthroughs (watch these — they're gold), community blogs and writeups.

💡 Pro tip: When you're stuck on an HTB box, don't immediately look at the writeup. Spend at least 2-3 hours struggling. Google specific error messages. Try different approaches. The struggle is where the learning happens. When you DO look at a writeup, read Ippsec's video for that box — he explains his thought process, not just the commands.

🆚 TryHackMe vs HackTheBox — Quick Comparison

Both platforms are excellent, and most people use both at different stages of their journey:

• Structure: THM is guided with step-by-step instructions → HTB drops you in and says "figure it out"
• Difficulty curve: THM starts from absolute zero → HTB's "Easy" still assumes some Linux/networking knowledge
• Learning style: THM teaches concepts then tests them → HTB tests you first and you learn by doing
• Browser access: THM has a full browser-based AttackBox → HTB requires VPN connection from your own machine (mostly)
• Content type: THM has "rooms" (topic-focused) → HTB has "boxes" (realistic machines) and "challenges" (focused puzzles)
• Community: Both have active communities, Discord servers, and forums
• Price: Both free tiers are usable. Both premium tiers are ~$14/month.
• OSCP prep: THM has OSCP-specific paths → HTB boxes are closer to actual OSCP exam difficulty

🌐 Other Platforms Worth Knowing About

THM and HTB are the big two, but there are other excellent platforms for specific needs:

• PortSwigger Web Security Academy — 100% free, focused entirely on web vulnerabilities. Made by the creators of Burp Suite. If you want to learn web hacking, this is arguably the best resource on the internet. Covers SQL injection, XSS, CSRF, SSRF, and dozens of other web vulns with interactive labs.
• PentesterLab — Web-focused with structured exercises that progress from basic to advanced. Free tier available, Pro subscription for full access. Great for learning specific exploit techniques.
• VulnHub — Downloadable vulnerable virtual machines. You run them locally — no internet required, no VPN needed. Great for offline practice and for building your own lab environment.
• PicoCTF — Beginner-friendly CTF competitions run by Carnegie Mellon University. Excellent for students and people who want to dip their toes into competitive CTFs. Challenges stay available after the competition ends.
• OverTheWire — Wargames played over SSH. "Bandit" teaches Linux command-line basics through 34 progressively harder levels. "Natas" teaches web security. Completely free and a classic starting point.

🧭 "Which Platform Should I Start With?" — Decision Helper

Still not sure where to begin? Here's a quick guide based on your background:

• Complete beginner with no Linux experience → TryHackMe — start with the "Pre-Security" learning path. It teaches you Linux, networking, and web basics from scratch.
• Some IT/dev background, want to learn pentesting → TryHackMe "Jr Penetration Tester" path, then transition to HackTheBox Easy boxes once you're comfortable.
• Want challenge without hand-holding → HackTheBox — start with "Starting Point" machines, then move to Easy active boxes.
• Want to focus specifically on web security → PortSwigger Web Security Academy. It's free, it's excellent, and it's made by the people who built Burp Suite.
• Want offline practice or building a home lab → VulnHub + your local Kali VM. Download vulnerable VMs and hack them without any internet connection.
• Student or want competitive CTFs → PicoCTF for competition-style challenges, OverTheWire Bandit for Linux fundamentals.

🚀 Our recommendation: Start with TryHackMe to build foundations, then move to HackTheBox once you can comfortably navigate Linux, understand basic networking, and know what port scanning is. Use PortSwigger alongside either platform for web security depth. This isn't a competition — use whatever helps you learn.

🔐 Setting Up VPN Access

A VPN (Virtual Private Network) creates an encrypted tunnel between your machine and a remote network, as if you plugged a virtual cable directly into it. CTF platforms like HackTheBox and TryHackMe host their vulnerable machines on private lab networks that aren't on the public internet — a VPN is how you connect to those networks so you can interact with the target machines.

OpenVPN is the VPN software that creates this tunnel. When you sign up for HTB or THM, you download a .ovpn file — this is a configuration file containing the server address, encryption keys, and connection settings that OpenVPN needs to establish the tunnel. Think of it like a key card that grants you access to the lab network.

# Download your .ovpn file from the platform dashboard

# Connect to HackTheBox
# sudo is required because OpenVPN needs to create a virtual
# network interface (tun0) — that requires root privileges
sudo openvpn ~/Downloads/lab_username.ovpn

# Verify connection — you should get a 10.10.14.x address
# tun0 is the virtual network interface that OpenVPN creates.
# It's your "identity" on the lab network — this IP is what
# target machines see when you interact with them.
ip addr show tun0

# Test connectivity to a machine
ping 10.10.10.2

# Pro tip: Run VPN in background with tmux
tmux new -s vpn
sudo openvpn ~/htb/lab.ovpn
# Ctrl+B, D to detach — VPN stays running
# tmux attach -t vpn to reconnect

⚠️ Important: Never connect to HTB/THM VPN from your host machine or a work computer. Always use your Kali VM. Other players on the same VPN network can potentially see your traffic. Treat the lab network as hostile.

📁 Directory Structure for Pentesting

Organization matters. When you've done 50 boxes, you'll be grateful for a clean structure. Here's what works:

~/htb/
├── boxes/
│   ├── easy/
│   │   ├── lame/
│   │   │   ├── nmap/          # scan results
│   │   │   ├── exploits/      # scripts, payloads
│   │   │   ├── loot/          # creds, hashes, flags
│   │   │   └── notes.md       # your walkthrough
│   │   └── pilgrimage/
│   └── medium/
│       └── sandworm/
├── thm/                       # TryHackMe rooms
├── wordlists/                 # custom wordlists
└── vpn/
    └── lab.ovpn

/opt/tools/                    # shared tools (git repos)
├── PEASS-ng/
├── PayloadsAllTheThings/
├── nishang/
└── PowerSploit/

# Quick setup script
mkdir -p ~/htb/{boxes/{easy,medium,hard},thm,wordlists,vpn}
mkdir -p /opt/tools

# Create a new box workspace quickly:
mkbox() {
  mkdir -p ~/htb/boxes/$1/{nmap,exploits,loot}
  echo "# $1" > ~/htb/boxes/$1/notes.md
  cd ~/htb/boxes/$1
  echo "[+] Workspace ready: $(pwd)"
}

📝 Note-Taking Setup

Good notes are the difference between finishing a box in 2 hours and spending 8 hours retracing your steps. Pick one system and stick with it:

Option 1: CherryTree (GUI, built for pentesting)

• Hierarchical tree structure — perfect for organizing by box/phase
• Rich text with embedded images and code blocks
• Built into Kali, pentester favorite for years
• Downside: Not easily portable, single-file database format

Option 2: Obsidian (modern, Markdown-based)

• Markdown files — version-controllable with git, portable everywhere
• Graph view shows connections between topics
• Extensible with community plugins (Kanban, templates, etc.)
• Downside: Needs manual install on Kali, Electron-based (heavier)

Option 3: Simple Markdown + Terminal

• Just use vim or nano with .md files in each box directory
• Lightweight, always available, version-controllable
• Combine with grep to search across all notes instantly

What to Record for Every Box

# Template: notes.md
## Box Name — Difficulty — OS

### Recon
- IP: 10.10.10.x
- Open ports: 22, 80, 443
- Hostname: target.htb

### Enumeration
- [paste interesting findings]

### Foothold
- Vulnerability: [what you exploited]
- Payload: [exact command]

### Privilege Escalation
- Vector: [SUID, sudo, kernel, etc.]
- Command: [exact command]

### Flags
- user.txt: [hash]
- root.txt: [hash]

### Lessons Learned
- [What was new? What would you do differently?]

🖥️ Terminal Multiplexer — tmux Basics

You'll constantly juggle multiple terminals: one for VPN, one for listeners, one for exploitation, one for enumeration. tmux lets you manage all of them in a single window.

# Start a new session
tmux new -s htb

# Key bindings (Ctrl+B is the prefix)
Ctrl+B, C        # Create new window
Ctrl+B, N        # Next window
Ctrl+B, P        # Previous window
Ctrl+B, %        # Split pane vertically
Ctrl+B, "        # Split pane horizontally
Ctrl+B, Arrow    # Switch between panes
Ctrl+B, D        # Detach (session keeps running!)
tmux attach -t htb  # Reattach later

# Typical HTB tmux layout:
# Window 0: VPN connection
# Window 1: Nmap / enumeration
# Window 2: Exploit / shell
# Window 3: Notes (vim notes.md)
# Window 4: Listener (nc -lvnp 9001)

🏠 Building Your Own Vulnerable Lab

CTF platforms are great, but sometimes you want to practice offline, test without VPN lag, or build a specific scenario. Here are the most popular intentionally vulnerable targets you can run locally:

• OWASP Juice Shop — Modern single-page app with 100+ challenges covering the OWASP Top 10. Run with docker run -p 3000:3000 bkimminich/juice-shop. Best for web app pentesting practice.
• DVWA (Damn Vulnerable Web App) — Classic PHP/MySQL web app with adjustable security levels (Low/Medium/High/Impossible). Great for learning SQLi, XSS, file upload, command injection. Run with docker run -p 80:80 vulnerables/web-dvwa
• Metasploitable 2/3 — Full Linux VM loaded with vulnerable services (FTP, SSH, Samba, MySQL, Tomcat, etc). Download the VM image and run in VirtualBox/VMware. Best for network pentesting and Metasploit practice.
• VulnHub VMs — Hundreds of downloadable vulnerable VMs with varying difficulty. Import the .ova file into your hypervisor and attack from Kali.

# Quick vulnerable lab with Docker
docker pull bkimminich/juice-shop
docker run -d -p 3000:3000 bkimminich/juice-shop
# Visit http://localhost:3000 from your Kali browser

# DVWA setup
docker pull vulnerables/web-dvwa
docker run -d -p 80:80 vulnerables/web-dvwa
# Default creds: admin / password

# Metasploitable — download from Rapid7, then in VirtualBox:
# Import Appliance → select the .vmdk
# Set network to "Host-Only" adapter
# Boot it up, find IP with: nmap -sn 192.168.56.0/24

💡 Pro tip: Use Docker for web app targets (Juice Shop, DVWA) — they start in seconds and you can trash and recreate them instantly. Use full VMs (Metasploitable, VulnHub) for network-level practice where you need real services running on real ports.

🛡️ Lab Safety & Isolation

You're running offensive tools and intentionally vulnerable software. If this stuff touches your home network or the internet, bad things can happen. Take isolation seriously:

• Network isolation: Run vulnerable VMs on a Host-Only network adapter only. Never give Metasploitable a NAT or Bridged adapter — it has open services with default credentials that could be exploited by anyone on your network.
• Firewall your host: If using Bridged mode for any VM, make sure your host firewall blocks inbound connections to the VM's services.
• Don't expose to the internet: Never port-forward vulnerable services to the internet. Docker services default to binding 0.0.0.0 — on a cloud server, this means the entire internet can access your DVWA instance.
• Separate from work: Never run pentesting tools on a work computer or work network without explicit written authorization. Even scanning your own company's network without permission can get you fired or worse.

# Check what's listening on your machine
ss -tlnp                                    # TCP listeners
ss -ulnp                                    # UDP listeners

# Make sure Docker only binds to localhost
docker run -p 127.0.0.1:3000:3000 juice-shop  # ✅ Only localhost
docker run -p 3000:3000 juice-shop             # ⚠️ Binds to 0.0.0.0

📋 Rules of Engagement — The Legal Checklist

Before you test anything that isn't an intentionally vulnerable lab or CTF platform, you need written authorization. This isn't just good practice — it's the law. The Computer Fraud and Abuse Act (CFAA) in the US and similar laws in other countries make unauthorized computer access a criminal offense, even if your intentions are educational.

• Written scope document: What IP ranges, domains, and services are in scope. What is explicitly out of scope (production databases, third-party services, etc.).
• Time window: When testing is authorized (business hours only? After hours? 24/7?).
• Stop conditions: When to stop immediately (data breach discovered, system crash, PII exposure).
• Contact info: Who to call if something breaks or you find something critical.
• Store this document: Keep the signed authorization somewhere safe. If someone questions what you're doing, this is your get-out-of-jail card. Literally.

⚠️ The bottom line: CTF platforms = always legal. Your own lab VMs = always legal. Bug bounty programs = legal within their scope. Anything else requires explicit written authorization from the system owner. "I was just learning" is not a legal defense.

🔒 Operational Security (OPSEC) for Learners

Even as a student, build good OPSEC habits. These will matter in your career:

• Separate accounts: Use a dedicated email for security platforms (HTB, THM, bug bounties). Don't use your work or personal email.
• Handle findings carefully: If you discover a real vulnerability during authorized testing, don't post it publicly, share it on social media, or tell friends the details. Report it through the proper channel (bug bounty platform, client contact).
• Screenshots and notes: Be careful what's visible in screenshots you share. Crop out sensitive data, IPs, credentials. Many CTF writeup authors have accidentally leaked SSH keys or tokens.
• Credential hygiene: Use unique, strong passwords for every security platform. Store them in a password manager (KeePassXC is popular in the security community). Never reuse passwords — you of all people should know why.
• Clean up after labs: When you're done with a vulnerable VM, shut it down. Don't leave Metasploitable running 24/7 on a network adapter it doesn't need to be on.