Metasploitable & DVWA: Safe Targets for Practicing Exploits

By Mason Goulding · Aug 18, 2025 Updated Sep 2, 2025

You need vulnerable boxes that won’t get you arrested. These two are industry staples—here’s how I wire them up, keep traffic sealed tight, and practice like the pros do.

Disclaimer: The information in this article is provided for educational and informational purposes only and does not constitute legal, financial, or professional advice. All content is offered “as-is” without warranties of any kind. Readers are solely responsible for how they choose to use this information and must ensure that any actions comply with all applicable local, national, and international laws and regulations. We expressly disclaim liability for any losses, damages, or consequences that may arise from misuse or misinterpretation of this material. Always apply the information only within authorized, ethical, and legal contexts.

For more details, see our Terms of Service.

Why Metasploitable and DVWA?

Practicing on random IPs is a one-way ticket to a CFAA violation. You need intentionally vulnerable systems designed for training. That’s where Metasploitable and Damn Vulnerable Web Application (DVWA) shine. Both are built to break safely. Together they cover OS-level and web-app vulnerabilities—the bread and butter of penetration testing.

Rule #1: Practice only on boxes designed to be hacked. No permission, no testing.

Prerequisites

A hypervisor (VirtualBox, VMware Fusion, or UTM).
Kali Linux as your attacker VM.
Metasploitable ISO/VM and DVWA (installable on Ubuntu or in a prebuilt VM).
Host-only or NAT network configured. Never bridge to the internet.

Step-by-Step Setup

Configure host-only network. In VirtualBox, create a new host-only adapter (default: 192.168.56.0/24).
Spin up Kali Linux. Give it at least 4GB RAM and attach it to the host-only adapter.
Launch Metasploitable. Default creds: msfadmin/msfadmin. Keep it host-only.
Deploy DVWA. Either via Docker image or a LAMP stack on Ubuntu.
Verify connectivity. Run ip addr on each VM and ping across. Kali should see both targets.

Kali Linux with vulnerable VMs in a host-only lab — My go-to setup: Kali on the left, Metasploitable and DVWA on the right, all inside an isolated subnet.

What You Can Practice

Metasploitable: SSH brute force, vulnerable services, outdated daemons, weak default credentials.
DVWA: SQL injection, XSS, CSRF, file upload vulns—classic web app attacks.

Pair this with Nmap scanning basics and how to package results for recruiters. Each vuln you exploit is raw material for a professional-quality writeup.

Legal Guardrails

Metasploitable and DVWA are designed for training, but only in isolation. Keep them off public networks. No bridging, no external interfaces, no cloud hosting unless scoped and approved. Remember: unauthorized scanning or exploitation outside your lab falls under the CFAA or the Computer Misuse Act.

Quickstart: 30 Minutes to First Exploit

Download Metasploitable, boot it in VirtualBox on 192.168.56.101.
Install DVWA with Docker: docker run -it -p 80:80 vulnerables/web-dvwa.
Run nmap -sV 192.168.56.0/24 from Kali to discover both targets.
Login to DVWA and set security level to “low.”
Attempt a basic SQLi: ' OR '1'='1 on the login form.
Write a one-page report: target, vuln, exploit, remediation.

Helpful References

Where to Go Next

Level up your lab with: Best Hypervisors for Ethical Hacking Labs, Best Legal Platforms to Practice Ethical Hacking, and From Home Lab to Job-Ready.

Important Notice