Recommended Free Tools
Build the lab as virtual machines on a computer you control, and decide how they will be networked before you boot any deliberately vulnerable target. For a contained beginner setup, put Kali and lab-only targets on a VirtualBox host-only network if you need the host to reach them, or an internal network if only the guests need to communicate. Do not bridge vulnerable machines to your home network. Use Ubuntu as a separate lab guest, verify Kali downloads from Kali’s official guidance, and take snapshots so you can restore a clean state.
What you need before building the lab
You need a host computer capable of running your chosen guest operating systems and a hypervisor that supports the network isolation you intend to use. Kali lists VMware, VirtualBox, Hyper-V, and QEMU as virtualization options, but there is no universal RAM, CPU, or storage minimum established for a Kali-and-Ubuntu lab: requirements depend on the host, guest configurations, and how many VMs run at once. Compare platforms by host compatibility, supported guests, host-only or internal networking, snapshot workflow, and resource needs rather than assuming one is best for everyone. Kali’s FAQ lists virtualization options.
As an Amazon Associate I earn from qualifying purchases.
Kali recommends that many users start with a VM and specifically recommends one for people installing Kali for the first time. Kali publishes prebuilt VM images for VMware and VirtualBox; these can make setup quicker, while an installer image gives you more control over the installation. VMs also have higher system requirements than some alternatives and may provide limited direct access to hardware. See Kali’s official download page for current choices and details.
Choose network isolation before starting the guests
A VM’s network adapter determines what it can contact. Set the intended network mode on every guest before starting a vulnerable target, and check for extra adapters: a second NAT or bridged adapter can undermine an otherwise isolated setup. The following distinctions are for VirtualBox; menu labels and behavior should be checked against the version you install. Oracle’s cited manual is version 7.0.4, so its interface details may not match current releases.
#1 Best Overall
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
| Mode | What it allows | When it fits this lab |
|---|---|---|
| Host-only | Guests on the virtual segment can communicate with the host. In the documented VirtualBox model, they cannot reach the outside world through a physical network interface. | Use when you need to manage or access the lab guests from the host. |
| Internal network | Provides a guest-only virtual segment without a physical network interface; the host is not a participant. | Use when the lab guests need to communicate with each other but not with the host. |
| Bridged | Connects a VM through an existing physical network interface. | Do not use for deliberately vulnerable targets in a beginner lab; it can expose them to the home LAN. |
| NAT | Can provide outbound connectivity. | It is not equivalent to an air gap. Use connectivity deliberately, such as for updates, then restore the intended isolated setup. |
These descriptions follow the networking distinctions in the Oracle VM VirtualBox User Manual, version 7.0.4. Network-mode behavior is the reason to plan isolation before running tools or insecure software, not after.
Build the Kali and Ubuntu guests
- Choose and install a hypervisor. Select one that works with your host and lets you configure the planned isolated network. Kali lists VMware, VirtualBox, Hyper-V, and QEMU, but does not establish a current feature-by-feature ranking. Check the hypervisor’s current documentation for its network and snapshot controls.
- Download Kali from Kali’s official site. Prefer a prebuilt VM image if it supports your hypervisor; otherwise use the official installer image. Before importing or installing, verify the download against Kali’s currently published SHA256 value or signed-hash guidance. Do not rely on a checksum copied from an older release. Kali warns that unofficially modified images may contain malware or exploits. Follow Kali’s instructions for downloading and verifying official images.
- Install Ubuntu as a separate guest. Treat it as another lab participant or a development and test machine. Choose a current Ubuntu release from Ubuntu’s official source and follow its current download and verification instructions; the cited sources here do not establish release-specific Ubuntu download details or checksum values.
- Configure adapters before booting a target. Assign Kali and any lab-only targets to the host-only or internal network you chose. Inspect every adapter on every VM and remove or disable any unintended NAT or bridged connection, especially on deliberately vulnerable targets.
- Start guests and check the intended connectivity. Confirm that the guests can communicate where required, then confirm that a target has no unintended path to your home network or the internet before beginning an exercise. Record each VM’s name, purpose, network mode, address, and snapshot state so you can spot accidental configuration changes.
Plan a deliberate update path
A host-only network, as described in the VirtualBox manual, does not give guests internet access through a physical interface. If a guest needs updates, make the connectivity change deliberate rather than treating an isolated network as if it were online. For example, connect only the guest that needs updating using a mode that provides outbound access, perform the update, then return its adapter to the intended isolated configuration and check the adapter list again before working with a vulnerable target. NAT can provide outbound connectivity; it should not be described as an air gap. The available source documents the network modes, not a vendor-prescribed update procedure.
Rank #2
- Includes Raspberry Pi 5 16GB with 2.4Ghz 64-bit quad-core CPU (16GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Save clean states and recover safely
After installing, updating, and configuring each guest, create a baseline snapshot. Take another snapshot before an exercise likely to change software or break the guest. Name snapshots so they identify the machine and state, such as “Kali — baseline after updates” or “Ubuntu — before exercise.” If a guest becomes unusable, revert to the appropriate snapshot and confirm its network settings before continuing. Kali lists snapshots among the features of VM installations; a snapshot is a recovery aid, not a backup against failure of the host or its storage. Kali’s VM information describes its prebuilt virtual-machine options and snapshot capability.
Keep practice authorized and contained
Use the lab only for systems and networks you own or have permission to test. Keep intentionally vulnerable targets disconnected from bridged networking and the home LAN. Before each exercise, verify the network mode and adapters on all relevant VMs, confirm that only the intended guests can reach one another, and ensure the target has no unintended internet or home-network route. These checks make isolation an active configuration choice rather than an assumption.
Quick Recap
Best Value
- 【What you Get】You will get 1*Pi 5 8GB Single Board,1*RasTech Case,1*Active Cooler,1*Screwdriver,1*Installation instructions,12-month free warranty, lifetime service, 24-hour prompt and friendly response.
- 【More Connectors】There are two USB 3.0 ports(5Gbps simultaneously) and two USB 2.0 ports, which triple total bandwidth ,support any combination of up to two cameras or displays. Peak SD card performance is doubled through support for the SDR104 high-speed mode. It provides a smooth desktop experience for you. Offer Gigabit Ethernet and a PCIe interface, along with dual-band Wi-Fi and Bluetooth 5.0/BLE wireless capability. The RasTech Pi 5 Kit use the new 27W 5.1V 5A USB-C power connector.
- 【 Support Dual 4Kp60 Display 】Each of the two microHDMI sockets can control a 4K display at 60 Hertz, now support HDR, offering super HD video for media streaming projects. RPi 5 is the first RPi model that comes with a PCI Express port (PCIe 2.0 x1 with 500 MB/s) to attach SSDs (requires separate M.2 HAT).
- 【 Excellent Chips And Applications】Pi 5 is a full-size Pi computer using silicon built in-house at Pi. The RP1 “southbridge” provides the bulk of the I/O capabilities for Pi 5. Pi 5 is more friendly and convenient in the development of Internet of Things, Web development, machine identification, automatic control and other electronic equipment applications and network.
- 【 Faster CPU, Better GPU 】 Pi 5 features a Broadcom BCM2712 64-bit quad-core Arm Cortex-A76 processor running at 2.4GHz, it delivers a 2–3× increase in CPU performance relative to RaspberryPi 4. The 800MHz VideoCore VII GPU is compatible to OpenGL ES 3.1 and Vulkan 1.2, substantial uplift in graphics performance. Pi 5 Offers lightning-fast CPU speed, a PCI Express interface, a Real Time Clock (RTC) and a power button and runs significantly cooler than Pi 4.
Rank #4
- All-in-One Complete Kit: This SANOOV RPi 5 bundle comes with Raspberry Pi 5 4GB RAM single board, active cooler, durable ABS case and screwdriver. No extra parts needed, ready to use right out of the box for beginners and hobbyists
- Powerful Single Board Computer: Equipped with 4GB RAM and high-performance processor, delivers fast running speed for 4K playback, AI projects, programming and daily computing tasks. SANOOV for raspberry pi 5 4GB is equipped with broadcom 64 quad-core Arm Cortex A76 processor with gigabit ethernet and upgraded with IEEE 802.11ac Wi-Fi, Bluetooth 5.0 dual-band 2.4Ghz and 5Ghz and Power Over Ethernet (POE). Upgrading delivers 2-3 x speed vs Pi 4, redefining the experience
- Efficient Active Cooler: Effectively lowers operating temperature and prevents performance throttling. Runs quietly even under long-time heavy load, ensures stable operation all day long. SANOOV RPi 5 4GB kit offer an active cooler, which combines an aluminium heatsink with a high-performance PWM fan. Active cooler is fully compatible with the Pi OS, which can effectively reduce the temperature of RPi5 and ensure its good performance during long-term high load operation
- Sturdy ABS Protective Case: Well-fitted for Raspberry Pi 5 board, can be secured with 4 screws to effectively protect the Pi 5 motherboard from damage, reserves full access to all ports and buttons. SANOOV uses ABS material to produce the case, which has a softer texture and feel. Meanwhile, SANOOV case adopts a layered design for easy disassembly and installation. (Tip: The Case cannot install M.2 HAT Add on Board and Solid State Drive!)
- Wide Application & Full Compatibility: Seamlessly compatible with official OS and mainstream peripheral accessories for Raspberry Pi 5. Whether you are a beginner, student, electronics hobbyist or professional developer, this all-in-one kit meets your diverse needs. It excels in IoT projects, robotics design, retro gaming devices, home media servers and other DIY creations. Backed by a large global community, you can easily find guides, technical support and shared projects online
Rank #3
- CanaKit Raspberry Pi 5 Essentials Starter Kit
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
