Security Notice & Lab Context
This documentation captures authentic hands-on lab exercises performed in a strictly isolated virtual environment during Day 1 of the Ethical Hacking and Penetration Testing Workshop at BugXploit (Koteshwor).
1. Workshop Kickoff & Objectives
Day 1 at BugXploit, led by instructors Birendra Sah and Bishal Shrestha, was focused entirely on practical offensive security foundations: provisioning hypervisors, sourcing verified penetration testing images, configuring virtual network adapters, and validating end-to-end host connectivity between our attacker machine and our target machine.
2. Virtual Machine Images & Downloads
To conduct real-world security assessments safely without causing harm to live production networks, we initialized two core virtual machines inside Oracle VM VirtualBox:
Metasploitable 2
An intentionally vulnerable Linux virtual machine configured for practicing exploitation, service auditing, and vulnerability testing.
Kali Linux (2026.2 Installer)
The industry-standard Debian-derived distribution equipped with pre-installed security auditing and penetration testing tools.
3. Step-by-Step Lab Setup in Oracle VirtualBox
-
Extracting Metasploitable 2: Downloaded the Metasploitable 2 zip package from
SourceForge, extracted the archive to get the virtual machine disk file (
.vmdk), and mounted it into Oracle VM VirtualBox. - Configuring Network Adapters: Configured the virtual network adapter settings for the Metasploitable 2 virtual machine so it properly receives an IP address and establishes network/internet communication within the subnet alongside Kali Linux.
- Spinning up Kali Linux: Mounted the Kali Linux 2026.2 installer ISO, started the attacker environment, and confirmed basic system packages and terminal tools were operational.
- Concurrent Machine Execution: Launched both virtual machines (Kali Linux Attacker + Metasploitable 2 Target) simultaneously inside VirtualBox.
4. Network Identification & Ping Connectivity Test
Once both machines were running, the first step was identifying the private IP assigned to the vulnerable target machine.
Step A: Checking Metasploitable 2 IP Address
Logged into Metasploitable 2 (default credentials: msfadmin / msfadmin) and
retrieved the active network interface details using:
ifconfig
This revealed the assigned inet addr (e.g. 192.168.x.x or
10.0.x.x depending on the adapter mode).
Step B: Testing Connectivity from Kali Linux via Ping
Switched over to the Kali Linux terminal and verified whether the attacker machine could reach Metasploitable 2 across the network:
# Replace metasploitable_ip with the actual IP obtained from ifconfig
ping metasploitable_ip
# Example ping with count flag:
ping -c 4 192.168.1.50Successful ICMP echo replies confirmed that both virtual machines were operating on the same virtual network and could communicate seamlessly without packet loss.
5. Introduction to Nmap
With network reachability confirmed via ICMP ping, we were officially introduced to Nmap (Network Mapper)—the industry-benchmark open-source utility for network discovery, port scanning, and vulnerability detection.
We discussed how Nmap sends raw IP packets to determine what hosts are available on the network, what services (application name and version) those hosts are offering, and what operating systems they are running.
# Basic target availability and port sweep introduced:
nmap metasploitable_ip
# Fast scan of the most common ports:
nmap -F metasploitable_ip6. Day 1 Key Takeaways
- Virtual Isolation: A properly configured virtual lab ensures safe experimentation without exposing target services to untrusted external networks.
- Pre-Exploitation Hygiene: Before attempting any scan or exploit, validating IP
assignments with
ifconfigand confirming ICMP round-trip reachability withpingis an essential prerequisite. - Tool Foundation: Setting up Metasploitable 2 and Kali Linux prepares our lab for the upcoming deep dive into Nmap scanning flags, service fingerprinting, and vulnerability identification in Day 2.
WARNING: Strictly For Educational & Defensive Purposes Only
Do not attempt any unauthorized scanning, enumeration, or exploitation against networks, servers, or devices that you do not own or lack explicit, documented authorization to test. Performing unauthorized penetration testing or cyberattacks is illegal under the Electronic Transactions Act (ETA) of Nepal and cybercrime statutes globally. TheWH2 and BugXploit promote strictly ethical security practices and white-hat security research.