Appendix: Setting Up a Practice Environment

The complete core route is the paper-based Defender’s Dossier. Its observations and rules are fictional. You can learn the reasoning without scanning a device, cracking a password or capturing anyone’s traffic.

Permission before practice

For optional hands-on work, obtain explicit written permission for the systems, accounts, techniques and time window involved. Owning a laptop does not authorise testing the shared network, a cloud provider or other users. If scope is unclear, stop and ask the responsible owner.

Use synthetic data and test accounts. This book does not ask you to handle live malware, attack a public website or upload real logs to an assistant.

Isolation is a property to check

A VM is a separate guest operating system. A container shares more of its host’s underlying environment. Either can be useful; neither name proves that a mistake cannot reach real systems.

With VirtualBox, NAT allows outbound access to the host/LAN and internet. Host-only connects guests to the host. An internal network can connect selected guests without attaching that network to the host or outside world. Additional adapters, routing, forwarding and shared resources can change the boundary. These distinctions are explicit in Oracle’s networking table.

Before using a deliberately vulnerable environment, check every adapter, published port, shared folder and credential. Keep personal files and production credentials outside it. Use only an environment whose maintainer documents the isolation and reset procedure for your platform. A container with a published port or mounted host directory is not an isolated playground merely because it starts in a container.

A safe optional route

Choose a maintained teaching environment with explicit authorisation and setup instructions. OWASP Juice Shop is one example of an intentionally insecure training application; read its own setup and safety documentation before installing anything. Do not treat its public demonstration or someone else’s installation as an authorised target.

Write down the intended boundary, confirm what can reach what using the environment’s documented checks, and verify its reset procedure before an exercise. If a service is exposed beyond that boundary, a test reveals real data, or you cannot explain a connection, stop. Disconnect the exercise environment and ask its maintainer or your instructor for help.

A snapshot helps reset state; it does not remove data that has already escaped. Record the environment version and your observations so another authorised learner can reproduce the exercise. Tool-specific installation is deliberately outside this book; if you cannot establish the boundary, use the paper route.

Tools by capability

Names provide anchors, not required installations.

Capability	Examples
Inspect authorised host/service exposure	Nmap
Study synthetic password hashes	John the Ripper, Hashcat
Inspect supplied or authorised packet captures	Wireshark
Work with keys and signatures	OpenSSL, GnuPG
Test a permitted firewall policy	nftables
Examine supplied forensic evidence	Autopsy, Volatility

Follow the official documentation and scope for the chosen environment. Successful setup is not the learning outcome: explaining an observation, its limitations and the defensive decision it supports is.