The Ethical Hacker Network - Regarding Vulnerable Practice Vm's

Latest Additions

Who's Online

EH-Net > Ethical Hacking Discussions and Related Certifications > Network Pen Testing (Moderator: don) > Regarding Vulnerable Practice Vm's

Pages: [1] Go Down

« previous next »

	Author	Topic: Regarding Vulnerable Practice Vm's (Read 1591 times)
0 Members and 1 Guest are viewing this topic.

skorpinok

Newbie

Offline

Posts: 36

Regarding Vulnerable Practice Vm's

« on: October 19, 2012, 09:53:36 PM »

Hello,
I have read many times that when using vulnerable virtual machines like Metasploitable, Damn Vulnerable Linux, & DVWA that it should never be exposed to network, why ? so when i practice with these vulnerable vm's should i disconnect myself from internet ?
please share with me.

Regards
skorpinok


	Logged

tturner

Sr. Member

Offline

Posts: 432

Re: Regarding Vulnerable Practice Vm's

« Reply #1 on: October 19, 2012, 10:10:44 PM »

Just configure the VM's host only so only your computer can communicate with them. The reason is that a network is only as robust as it's weakest link and those VM's are pretty weak. An attacker could use a vulnerable VM as a pivot point to engage attacks against your inner network, and it's likely you will expose systems in other ways. All sorts of reasons to do it this way.


« Last Edit: October 19, 2012, 10:12:52 PM by tturner »	Logged

Certifications:
CISSP, CISA, GPEN, GWAPT, GAWN, GCIA, GCIH, GSEC, OPSE, CSWAE, CSTP, VCP

WIP: OSWP, GSSP-JAVA, GXPN

Udacity on hold, again. I suck.

http://sentinel24.com/blog @tonylturner http://bsidesorlando.org

chrisj

Hero Member

Offline

Posts: 1163

Re: Regarding Vulnerable Practice Vm's

« Reply #2 on: October 20, 2012, 01:32:04 PM »

tturner's got some good points.

Another reason, if you go in to a more research role later (like say malware analysis), you'll now have bad habits to break. You might leak data to people you're looking into and make yourself a target.

There is also always a chance you'll typo something and instead of attacking your vm, attacking another system on your network. If you have a dedicated network, without internet access not so much a problem. However, if you have boxes on the network that need to stay up...