This blog will guide you through the process of setting up a Penetration Testing (PenTest) lab on Oracle Cloud Infrastructure (OCI). A PenTest lab is like a playground where security professionals can learn and practice their skills for keeping cloud environments secure. With this lab, you can practice Penetration Testing in a secure and controlled environment before trying it out on real-world situations.
This blog post is intended for security professionals, Penetration Testers, Security Analysts, System Administrators, ethical hackers, and anyone interested in learning more about cloud security through hands-on practice in a simulated environment.
Here are the steps we will follow to set up the PenTest lab on OCI:
- Create a Virtual Cloud Network (VCN):
A VCN is a private network that spans the entire OCI infrastructure. It provides a secure and isolated environment for your cloud resources. We will create a VCN, a public subnet, and a private subnet for our PenTest lab.
- Provision Kali Linux and configure SSH and RDP for Kali Linux:
Kali Linux is a popular operating system for Penetration Testing. We will provision a Kali Linux instance on the public subnet, enable SSH and RDP, and configure inbound security rules to allow access.
- Setup Metasploitable VMs on a private subnet:
Metasploitable is an intentionally vulnerable virtual machine that can be used for Penetration Testing. We will download Metasploitable images for Ubuntu and Windows, upload them to OCI object storage, create custom images, and provision Metasploitable instances on the private subnet.
- Test the environment:
We will establish an SSH or RDP session for Kali Linux, retrieve the IP addresses of the Metasploitable instances, test connectivity by pinging them, and use nmap to gather information on open ports. This will help us verify that our environment is set up correctly and ready for Penetration Testing.
Posted from: https://blogs.oracle.com/oracleuniversity/post/penetration-testing-environment-on-oci