Vulnarex | Elite Cybersecurity Learning Platform

#Building a Safe Environment for Learning#link

In the previous lesson, we explored how the web works at a fundamental level. Now it is time to get hands-on. You will set up an isolated security lab where you can safely practice attacking and defending web applications without risking real systems or breaking any laws.

STRICT SECURE AUDIT RULE

⚠️ Never test security techniques against systems you do not own or have explicit written permission to test. Unauthorized access to computer systems is a criminal offense in virtually every jurisdiction. Always work within your own lab environment or authorized bug bounty programs.

Why You Need an Isolated Lab

A security lab provides a controlled environment where you can intentionally vulnerable applications, intercept and modify traffic, and experiment with attack techniques. The key word is isolated — your lab should be completely separated from production systems and the public internet.

We will use Docker to containerize everything, making your lab portable, reproducible, and easy to reset. Docker ensures that even if something goes wrong, your host machine remains unaffected.

Installing Docker

Docker is the foundation of our lab. It allows us to run vulnerable web applications in isolated containers. Install Docker Engine for your operating system before proceeding.

Install Docker on Ubuntu/Debian

root@vulnarex:~#sudo apt update && sudo apt install -y docker.io docker-compose sudo systemctl enable docker sudo systemctl start docker sudo usermod -aG docker $USER

info

💡 On macOS and Windows, install Docker Desktop from docker.com. It includes Docker Engine, Docker Compose, and a graphical management interface.

Deploying DVWA (Damn Vulnerable Web Application)

DVWA is a deliberately vulnerable web application designed for learning. It covers all the major vulnerability categories we will study in this course, with adjustable difficulty levels so you can progress at your own pace.

Run DVWA in a Docker Container

root@vulnarex:~#docker run -d -p 80:80 --name dvwa vulnerables/web-dvwa

Once the container is running, open your browser and navigate to http://localhost. Log in with the default credentials (admin / password), then click 'Create / Reset Database' to initialize the application.

Installing Burp Suite Community Edition

Burp Suite is the industry-standard tool for web application security testing. It acts as an intercepting proxy between your browser and the target application, allowing you to inspect, modify, and replay HTTP requests and responses.

▪Download Burp Suite Community Edition from portswigger.net/burp/communitydownload
▪Install it following the standard process for your operating system
▪Launch Burp Suite and start a temporary project
▪Configure your browser to use Burp's proxy (127.0.0.1:8080)
▪Install Burp's CA certificate in your browser to intercept HTTPS traffic

Configure Browser Proxy (Firefox)

root@vulnarex:~## Navigate to Firefox Settings → Network Settings → Manual Proxy Configuration # HTTP Proxy: 127.0.0.1 # Port: 8080 # Check 'Use this proxy server for all protocols'

Installing Additional Vulnerable Targets

While DVWA is excellent, having multiple vulnerable applications gives you broader exposure. We will also deploy WebGoat and bWAPP for additional practice targets.

Deploy WebGoat

root@vulnarex:~#docker run -d -p 8081:8080 -p 9090:9090 --name webgoat webgoat/webgoat

Deploy bWAPP (Buggy Web Application)

root@vulnarex:~#docker run -d -p 8082:80 --name bwapp raesene/bwapp

Your Lab Architecture

Your complete lab environment now consists of several components working together. Understanding this architecture will help you troubleshoot issues and expand your lab as you progress.

bash

┌─────────────────────────────────────────────┐
│              YOUR HOST MACHINE              │
│                                             │
│  ┌──────────┐    ┌──────────────────────┐   │
│  │ Browser   │───▶│  Burp Suite Proxy    │   │
│  │(Firefox)  │    │  (127.0.0.1:8080)    │   │
│  └──────────┘    └──────────┬───────────┘   │
│                             │               │
│                    ┌────────▼────────┐      │
│                    │   Docker Host   │      │
│                    ├─────────────────┤      │
│                    │ :80  → DVWA     │      │
│                    │ :8081→ WebGoat  │      │
│                    │ :8082→ bWAPP    │      │
│                    └─────────────────┘      │
└─────────────────────────────────────────────┘

info

💡 Take a snapshot or backup of your Docker containers once everything is configured. If you accidentally break something during testing, you can quickly restore to a clean state without reinstalling everything.

Verifying Your Setup

Before moving on, verify that every component of your lab is working correctly. Run the following checks to ensure you are ready for the hands-on exercises ahead.

Verify All Containers Are Running

root@vulnarex:~#docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"

Test DVWA Is Responding

root@vulnarex:~#curl -s -o /dev/null -w "%{http_code}" http://localhost/login.php

callout

Your lab is now ready. Every vulnerability you learn in the coming lessons can be practiced safely in this environment. Remember: this lab is your playground — experiment freely, break things, and learn from every mistake.

challenge BLOCK (★ 100 XP)

Lab Verification Challenge

Select your proof vectors above

Setting Up Your Security Lab