the $0.30 Hacking Lab

About this video

Chuck builds a complete ethical hacking lab in AWS so learners can practise on intentionally vulnerable machines without needing a powerful home computer — anything with a web browser can access it. The design pairs a Kali Linux attacking machine with a target downloaded from VulnHub, using the Breach machine for the demonstration. Because Breach has DHCP disabled and a hardcoded address, he first creates a VPC with a 192.168.110.0/24 network to contain it, then launches Kali as an EC2 instance, choosing a T2 medium with two virtual CPUs and four gigabytes of memory and creating a key pair for SSH access. Next he extracts the downloaded OVA file, uploads it to an S3 bucket in the same AWS region, uses CloudShell to create containers.json, trust-policy and role-policy files, grants the VM import permission, converts the OVA into a custom machine image, and launches it in the private subnet with protections deliberately opened for lab use. He verifies the lab by pinging the target, running Nmap to confirm port 80 is open, and opening its website from Kali. He stresses shutting instances down when finished, noting running costs of about four cents an hour and only tiny storage charges while stopped.

Key takeaways

• A cloud lab removes the home-hardware barrier: a Kali attacker and a VulnHub target run in AWS and are reached through a browser or SSH
• Match the AWS VPC network to the target first; Breach had DHCP disabled and a hardcoded IP, so the lab used a 192.168.110.0/24 network
• Cost is usage-based: about four cents an hour while running, about 30 cents for eight hours, with stopped instances leaving only small storage charges
• Converting a VulnHub OVA for AWS involves S3 upload, CloudShell policy and container files, VM import permission, and launching the resulting custom image
• Verify before hacking: ping the target, use Nmap to check for open ports such as port 80, then browse to the target service

Episode details: published June 3, 2022 · 30:07 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: let’s play with a ZERO-DAY vulnerability “follina” · Next: i KILLED my Linux computer!! (to teach you something) →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube