Setting Up Your Security Lab

Why You Need a Lab

Security is a hands-on skill. A lab is a safe, legal environment where you can run tools, break things, and make mistakes without harming anyone. Never practise on systems you do not own or have written permission to test.

You need three things:

1. A virtual machine running Kali Linux (your toolbox)
2. A TryHackMe account (legal targets to practise on)
3. A handful of essential tools you will learn over this course

Part 1: Kali Linux on VirtualBox

Kali Linux is a free Linux distribution that comes with hundreds of security tools pre-installed. VirtualBox lets you run it inside a window on your normal computer, so it cannot damage your main system.

What you need

• 8 GB RAM or more (4 GB minimum)
• 40 GB of free disk space
• A 64-bit computer with virtualisation enabled

Steps (Windows, Linux, or Intel Mac)

1. Download and install VirtualBox from virtualbox.org.
2. Go to kali.org/get-kali and choose Virtual Machines. Download the pre-built VirtualBox image (it is large, so use a good connection or a cybercafe with fast internet).
3. Extract the downloaded archive.
4. In VirtualBox, choose File > Import Appliance (or double-click the .vbox file) and select the Kali image.
5. Give it 4 GB RAM and 2 CPUs if you can.
6. Start the VM. The default login for pre-built images is username kali and password kali. Change the password after first login by running passwd.
7. Open a terminal and update: sudo apt update && sudo apt full-upgrade -y.

Apple Silicon Macs (M1, M2, M3)

VirtualBox does not run the standard Kali images on Apple Silicon. Use UTM (free) with the ARM64 Kali image from the same download page instead, or skip the VM and use TryHackMe's AttackBox, a Kali-like machine in your browser.

If your laptop is too weak

Use the TryHackMe AttackBox (browser-based). It works on nearly any computer and needs no installation. Free users get limited AttackBox time per day, which is enough for this course.

Lab safety rules

• Keep the VM's network on NAT (the default) so it is isolated.
• Take a snapshot after setup so you can roll back.
• Only scan machines you own or that a platform gives you as targets.

Part 2: Create a TryHackMe Account

TryHackMe offers guided, browser-based rooms with legal targets, ideal for beginners.

1. Go to tryhackme.com and sign up (free).
2. Choose a username that does not reveal personal information.
3. Complete the Tutorial room to learn the interface.
4. Start the Pre Security learning path.

Part 3: Essential Tools

You do not need to master these today, just know what they are for:

Try these commands in your Kali terminal to confirm things work:

whoami            # shows your username
ip a              # shows your network interfaces
nmap --version    # confirms Nmap is installed

PRACTICE LAB

Complete these on TryHackMe. Each one applies what you learnt in this module.

Lab 1: Get comfortable with the platform

• Room: Tutorial (tryhackme.com/room/tutorial)
• Goal: Learn how to start a machine, use the AttackBox, and submit answers.
• What to do: Deploy the machine, follow the tasks, and answer the questions.

Lab 2: Connect to the network

• Room: OpenVPN (tryhackme.com/room/openvpn)
• Goal: Understand how your machine reaches TryHackMe's lab network.
• What to do: Follow the instructions to connect, or skip if you are using the AttackBox.

Lab 3: Spot phishing

• Room: search TryHackMe for Phishing Emails (for example "Phishing Emails 1")
• Goal: Analyse suspicious emails and identify red flags in headers and links.
• What to do: Work through the tasks and note the indicators you find.

Lab 4: Start the learning path

• Path: Pre Security (tryhackme.com/path/outline/presecurity)
• Goal: Build networking and Linux foundations that the next modules rely on.
• What to do: Complete the first two rooms before moving on.

Room names and links can change. If a link does not open, search for the room name on TryHackMe.

Deliverable

Write five sentences in a notes file: what you learnt, one tool you used, and one thing that confused you. Keep it. You will use these notes as a portfolio.

Interactive Exercise: Spot the Phishing Email

The editor beside this lesson contains a fake email. Click every suspicious element (sender, link, greeting, urgency, and so on), then press Check my answers. The email is fictional and uses a made-up look-alike domain for teaching purposes.

Try to find all the red flags before checking. In real life, you will often have seconds to decide.

Checklist Before Module 2

• VirtualBox (or UTM / AttackBox) working
• Kali Linux boots and is updated
• TryHackMe account created
• Tutorial room completed
• Phishing exercise completed