Starting a cybersecurity home lab may sound expensive, but the reality in 2026 is quite the opposite. A three-module, hands-on course walks you through installing a hypervisor, creating an attacker VM, and populating the environment with deliberately vulnerable targets—all without buying a single piece of hardware. The curriculum aligns with the Department of Defense’s 8140 work role 451 (System Administrator) and concludes with a graded capstone called the Lab Proof Packet. Successful completion awards the Foundations 3 certificate and 4.5 CPE hours, which can be verified at /verify.
Pick a free hypervisor and lay the groundwork
The first brick of any lab is the hypervisor the software that hosts multiple virtual machines on a single physical computer. Three options are truly free in 2026:
- VirtualBox – works on Windows, macOS (Intel and Apple Silicon) and Linux; ideal for beginners.
- VMware Workstation Pro / Fusion – free for personal use since; offers better performance for heavier workloads.
- Proxmox VE – a type-1, Debian-based hypervisor that runs directly on bare metal, perfect for a dedicated spare PC.
For most newcomers, installing VirtualBox and its Extension Pack is the quickest path. Remember to enable VT-x or AMD-V in the BIOS and aim for at least 8 GB of RAM and 60 GB of free disk space so the lab runs smoothly.
Build the attacker box and the vulnerable targets
The attacker machine most users adopt is Kali Linux a Debian-derived distro packed with tools such as nmapMetasploitBurp Suite and Wireshark. Download the pre-built VirtualBox image (e.g, kali-linux-2026.1-virtualbox-amd64.7z), import it, change the default password, and perform a full system upgrade. If you prefer a deeper learning experience, install Kali from the ISO; the process teaches partitioning and disk encryption.
Next, add at least two vulnerable targets so you have something to attack:
- Metasploitable 2 – an intentionally insecure Linux VM full of outdated services, perfect for enumeration and exploit practice.
- DVWA (Damn Vulnerable Web Application) – a PHP/MySQL web app exposing classic flaws like SQL injection and XSS; run it via Docker.
- OWASP Juice Shop – a modern JavaScript SPA that covers the entire OWASP Top 10; also Docker-based.
When you outgrow these, explore free boot-to-root images on VulnHub or the free tier of Hack The Box for more complex scenarios.
Isolate, snapshot, and start attacking
Isolation is the single most critical safeguard. Configure every VM to use a host-only adapter in VirtualBox so the attacker and targets can talk to each other but never reach the internet or your home LAN. Verify isolation by pinging an external address from a target – the request must fail.
After each VM is configured, create a snapshot. Snapshots capture the exact disk and memory state, letting you roll back instantly after a successful exploit. In VirtualBox, select the VM, open the Snapshots pane, and click “Take”. Naming conventions like clean-baseline-2026-06 keep things organized.
With networking sealed and snapshots taken, launch your first exercise. From the Kali console, discover the target subnet with nmap -sn 10.10.10.0/24run a full service scan (nmap -sV -p- 10.10.10.10), and fire up msfconsole to locate an appropriate exploit. After gaining a foothold, practice post-exploitation techniques, then simply restore the target’s snapshot and repeat.
Earn the certificate and explore next scenarios
The three-module course ends with a graded capstone called the Lab Proof Packet. Submit it to receive the Home Lab Setup certificate (Foundations 3) and 4.5 CPE hours. The credential can be verified online, adding tangible value to your résumé.
If you crave a more realistic environment, the same lab can be used in First Watch a free seven-day Security Operations Center (SOC) simulation, or in First Shell a guided penetration-testing introduction. Both extensions are offered by Cover6 Solutions, whose CEO and instructor, Tyrone E. Wilson, also serves as a practicing virtual CISO.
Finally, consider modest hardware upgrades only if you need persistent or wireless practice. A Raspberry Pi 5 makes an excellent always-on host for lightweight targets, while a dedicated USB Wi-Fi adapter (e.g, Alfa AWUS036AXML) provides reliable monitor-mode access for authorized wireless testing. Neither purchase is required to master the fundamentals; the software stack alone is completely free.
