That may be the case, but until it loses its stigma with hiring managers, is it really worth anything?  (understanding that any training/education is obviously good for you)

Just wanted to say that this is very great advise for anybody wanting in the security field.  I work in the profession and several months back I was contacted by our programming department when their website was a victim of SQL Injection.

First, they didn't realize how it happened and secondly wanted to know how to fix it.  The site was built with ASP and I was asked to look at the code and help them find the security hole.

So, to the OP, if you plan on working in the profession, you kind of have to be a jack of all trades when it comes to security.  If you plan on Freelancing, you can specialize in certain fields of security, but in most cases, an employer expects you know how to fix any security problem once you get CEH, ECSA, LPT or some other security cert by your name.  Just be prepared for that.

Nothing wrong with finding a DB vulnerable to this. The problem is that they (DBA, SA, NA) don't know that they don't know how to fix it. So instead of asking the question, it's easier to just roll back to the last backup. Which as RR pointed out, leaves them open for round 2. got to love the admins....

Anyone want to lend a hand here?  What should i be looking to accomplish when building a hack box?  Should i just throw some spare parts together, put *nix on it and network into everything else at home?  Then what? 

Sorry if it seems like a 'duh' question, but i really do mean whats next?

A good processor and a decent amount of memory will help. All of our boxes here run on Linux. As dale pointed out, Linux runs light freeing more system resources for what you want to do. there are also many tools out there written just for just for Linux. Aircrack -ng for instance can be compiled to run on Windows, but the developer basically said that you are on your own for the required drivers for Windows. Good luck and happy hunting.