Adding More VMs & Operating Systems

Overview

A two-VM lab (Kali + Ubuntu) is enough to get started, but the real value of a home lab comes from expanding it to reflect the diversity of real enterprise environments. Adding more VMs — different operating systems, intentionally vulnerable machines, network devices — dramatically increases what you can practice.

Intentionally Vulnerable Machines

VulnHub (vulnhub.com) and HackTheBox (hackthebox.com) provide pre-built vulnerable virtual machines designed specifically for practice. VulnHub machines are downloadable and can run offline in your local lab. These range from beginner-friendly to expert-level and cover every type of vulnerability — web application flaws, misconfigured services, privilege escalation paths, and more.

Metasploitable2 and Metasploitable3 are purpose-built vulnerable Linux and Windows machines from Rapid7 that pair directly with Metasploit. They are free to download and ideal for practicing exploitation fundamentals covered later in this course.

Adding Windows to Your Lab

Real enterprise environments run Windows — Active Directory, Windows Server, Windows 10/11 endpoints. Microsoft provides free evaluation ISOs for Windows Server at microsoft.com/en-us/evalcenter with 180-day trial periods. Adding a Windows Server VM to your lab allows you to practice Active Directory attacks and defenses, which are among the most in-demand skills in both red team and blue team roles.

Managing Resources

As you add VMs, memory becomes the constraint. Snapshot your VMs before starting new attack scenarios so you can roll back to a clean state. Power off VMs you are not actively using. Use lightweight distros (Alpine, Ubuntu Server with no GUI) for support roles like logging or network monitoring to conserve RAM.

Key Takeaways

Your lab grows as your skills grow. Start simple — Kali plus one target. Add a Windows VM when you reach the Active Directory module. Add Splunk when you reach the SIEM module. Build intentionally, and your lab will reflect exactly where you are in your learning path.

Part of the free Intro to Cyber course by Cover6 Solutions.