VulnHub

VulnHub is a free repository of vulnerable virtual machines that you download and attack in your own lab, with no internet connection or VPN needed. It is one of the classic resources for practising pentesting legally: you import the machine into VirtualBox or VMware, find it on your local network and try to get root following a real methodology.

What is VulnHub?

VulnHub is a website hosting hundreds of community-made machines, each with its own page: author, rough difficulty, description, download format (usually OVA or VMDK disks) and often links to walkthroughs published by other users. Some series became legendary, such as Kioptrix, Mr-Robot, Stapler or the DC series. The platform has been part of OffSec for years, and many of its machines inspired that company's practice labs.

Unlike online platforms, everything runs on your computer. That has advantages (no time limits, no sharing the box with anyone) and some drawbacks (you need RAM and a bit of network configuration).

What VulnHub is used for

• Practising pentesting end to end: discovery, enumeration, exploitation, privilege escalation and post-exploitation.
• Preparing for hands-on certifications such as eJPT or OSCP, which require working unguided on full machines.
• Building an offline lab for training, workshops or classroom demos.
• Looking inside the machine: since it is yours, you can inspect the vulnerable configuration afterwards and understand the root cause.

How to get started with VulnHub

1. Install VirtualBox or VMware Workstation/Player.
2. Prepare an attacker machine, for example Kali Linux or Parrot OS.
3. Download an easy VulnHub machine and check the hash listed on its page.
4. Import the OVA and put both machines on the same host-only or internal NAT network. Avoid bridged mode: do not expose a vulnerable machine to your real network.
5. Boot the target and do not log into it: the goal is to get in from the attacker box.

Practical example: first steps on a machine

First, find the target's IP on your lab network:

sudo netdiscover -r 192.168.56.0/24
# or
sudo arp-scan --localnet

With the IP, enumerate ports and services:

nmap -p- --min-rate 1000 -T4 192.168.56.101
nmap -sC -sV -p 22,80 192.168.56.101 -oN services.txt

If there is a web server, look for hidden content:

gobuster dir -u http://192.168.56.101 -w /usr/share/wordlists/dirb/common.txt

From there every machine is different: vulnerable versions, default credentials, exposed files or misconfigured services. Once you get a shell, enumerate to escalate privileges:

id; uname -a
sudo -l
find / -perm -4000 -type f 2>/dev/null

Remember: these techniques are only for your own lab machines or systems you are explicitly authorised to test.

Suggested learning path

1. Machines marked beginner or easy to master nmap, web enumeration and basic escalation.
2. Progressive series (for example, the DC series) to see difficulty ramp up.
3. Machines with several entry points, to learn not to tunnel-vision on one.
4. Medium machines without walkthroughs, timing yourself as in an exam.

Pro tips

• Take a snapshot of the freshly imported target so you can restore it if you break it.
• Document each machine as if it were a pentest report: it pays off for certifications.
• If you get stuck, read a walkthrough only up to the next hint and close the tab.
• If a machine gets no IP, check the VM's network adapter settings; it is the most common issue.

Pros and cons

Pros	Cons
Completely free and offline	You have to build and maintain the lab
Huge and varied catalogue	New machines are no longer published as often as before
Lots of walkthroughs to learn from	Some old machines misbehave on modern hypervisors

VulnHub alternatives

• Hack The Box: online machines that are constantly refreshed.
• TryHackMe: guided rooms with in-browser machines.
• Root Me: challenges by category and virtual CTF environments.
• OffSec courses: if you want the formal path to OSCP.

Frequently asked questions

Is VulnHub free?

Yes. Every VulnHub machine can be downloaded for free, and you do not need an account to do it.

Is it legal to use VulnHub?

Yes. The machines are built to be attacked and run on your own computer. What would be illegal is using those techniques against other people's systems without permission.

How do I use VulnHub with VirtualBox?

Download the OVA, use File > Import Appliance, put the machine on a host-only network together with your Kali box and boot it. Then find it with netdiscover or arp-scan.

Is VulnHub good for OSCP preparation?

Yes, as a complement. Many prep lists include VulnHub machines similar in style to the exam, although it is worth mixing them with more up-to-date labs.

If you first want to get comfortable with Linux, networking and the command line, practise at the Hackers en Acción Academy.