Metasploit › Module 1 › Lesson 3
Lab VM Only
Your vulnerable target lives on a host-only lab VM at $LAB — never bridged stranger networks.
Visual · msf_lab_vm_only
Lab VM on host-only networking. RHOSTS = $LAB only. Original Cyberlium.
Opening
Bridged Wi-Fi turns your lab into everyone else's problem. Host-only keeps MSF where it belongs.
RoE named the dest. This lesson names the network. A Metasploit lab belongs on a disposable VM attached to host-only or isolated vSwitch networking so packets never reach roommates, classmates, or café patrons. $LAB is the address of that VM — not the internet, not the dorm gateway. You verify connectivity to $LAB from your attacker VM on the same isolated segment. You do NOT bridge the victim to public Wi-Fi, do NOT scan 192.168.x.x for 'practice targets,' do NOT pivot into your host OS. Next: RoE Lab.
1. Host-only means the lab stays in the box
Hypervisors offer host-only or internal networks so VMs talk to each other without advertising on physical LAN. Your attacker Kali/Parrot and vulnerable target both attach there. $LAB is the target's address on that segment.
If ping to $LAB fails, fix the lab topology — do not 'fix' it by aiming at your router or a classmate.
Command guide
Try these commands — Host-only means the lab stays in the box
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Metasploit install — https://docs.rapid7.com/metasploit/install-instructions/ Kali Metasploit — https://www.kali.org/tools/metasploit-framework/
═══ INSTALL ═══
Linux (Debian/Ubuntu): Kali: preinstalled, or: sudo apt install metasploit-framework
Command — copy this
sudo apt install nmap
macOS: Prefer Kali/Linux VM — brew install metasploit (heavy)
Command — copy this
brew install nmap
Windows: Use Kali VM or WSL with metasploit-framework — not raw Windows host
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
nmap -sn "${LAB_HOST:-127.0.0.1}" 2>/dev/null | head -10 || echo 'Set LAB_HOST to YOUR lab VM IP'
msfconsole -q -x 'version; exit' 2>/dev/null || echo 'Use Kali/WSL lab VM for msfconsole'Primary tools to practice this lesson: msfconsole, nmap. Reference sites: Metasploit install (https://docs.rapid7.com/metasploit/install-instructions/); Kali Metasploit (https://www.kali.org/tools/metasploit-framework/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Snapshots and disposability
Take a snapshot before modules run so you can revert shell mess. A lab VM is cattle: break it, revert, continue literacy.
Real persistence on your daily driver or a family PC is out of scope forever in Cyberlium MSF modules.
3. Defender mirror
Blue teams isolate malware sandboxes the same way: no bridge, no sensitive data, heavy logging. Your lab is a miniature of that discipline.
Ship one line: network=host-only, RHOSTS=$LAB, never=LAN/internet strangers.
4. What you ship: host-only lab network rule
Document host-only networking and $LAB. Refuse bridged café lab setups. No LAN target discovery. chmod 600 note.
5. What you record before the next lesson
Date. Network mode. $LAB reachability test. NEVER bridged public Wi-Fi, NEVER LAN sweeps. File t14-m01-l03-lab-vm.txt chmod 600.
6. Wrong vs right: stranger hosts vs YOUR lab VM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Bridge the victim VM to dorm Wi-Fi so friends can watch. nmap the whole /24 for MSF targets.
Right
Write host-only rule and $LAB. Next: RoE Lab.
Mission: prove lab isolation before MSF
1) Document your hypervisor network mode (host-only/internal). 2) Record $LAB as the victim address. 3) Ping or connect test only $LAB — not the gateway, not LAN peers. Never use a production PC as the victim.
Stuck? Ask Cyberlium AI Mentor
If $LAB is unreachable, ask Mentor about vSwitch settings — not how to scan the dorm.
Knowledge Check
APPLY: Best network mode for a Metasploit victim VM in this course:
Multiple choice
Knowledge Check
APPLY: True or False: nmap 192.168.0.0/24 is acceptable MSF prep when bored.
True or False
Knowledge Check
APPLY: $LAB in Cyberlium means:
Multiple choice