Guided Lab: Kali and Metasploitable Service Discovery

Why Metasploitable gets no NAT or bridged adapter: it is deliberately vulnerable. A NAT adapter would let it reach the internet, and a bridged adapter would place it on your real network, where other devices, and anyone else on that network, could reach its weaknesses. Host-only keeps it on a network that only the host and the lab VMs share.

Step 1 — Check the VirtualBox adapters

Before starting either VM, open each VM’s network settings in VirtualBox and compare them with the diagram:

• Kali: Adapter 1 attached to NAT; Adapter 2 attached to Host-only Adapter.
• Metasploitable: Adapter 1 attached to Host-only Adapter; every other adapter disabled.
• Both host-only adapters attached to the same host-only network.

If anything differs, fix it before going further. This check is the main safety control in the lab.

Check yourself: you can say, without looking, which single network Metasploitable is attached to. If the answer is anything other than “the host-only network”, do not start it.

Step 2 — Start Kali and Metasploitable

Start both VMs and wait for each to reach its login prompt or desktop. What you see depends on the versions you downloaded, so compare with each project’s own documentation rather than expecting a particular screen.

Check yourself: both VMs are waiting for you to sign in. If one will not start, a common cause is too little memory left on the host for two VMs at once.

Step 3 — Log in to Metasploitable

Log in with the username msfadmin and the password msfadmin, the known default credentials for that virtual machine.

These weak, published credentials are acceptable only because Metasploitable is a deliberately vulnerable training machine kept in an isolated lab. On any other system, default or guessable passwords are a vulnerability, not a practice to copy.

Step 4 — Inspect Kali’s networking

In a terminal on Kali, run:

ifconfig

Kali has two adapters, so it shows more than one interface, plus the loopback interface lo. Identify the interface on the host-only lab network and note its IPv4 address and netmask. The NAT interface is not the one used to reach Metasploitable. If ifconfig is not installed, ip addr shows the same information.

Check yourself: you have written down two different addresses for Kali and know which of them is on the lab network. If you see only one interface besides lo, Adapter 2 is not attached: go back to Step 1.

Step 5 — Inspect Metasploitable’s networking

On Metasploitable, run:

ifconfig

Identify its host-only IPv4 address. From here on, this address is written as <metasploitable-ip>. Apply each machine’s netmask to its address and check that Kali’s host-only interface and Metasploitable are on the same network. If they are not, return to Step 1.

Check yourself: the two network addresses you worked out are identical, and the two host addresses are different. Which interface matters? works through this comparison with invented addresses.

Step 6 — Service and version discovery

From Kali, run:

nmap -sV <metasploitable-ip>

Replace <metasploitable-ip> with the address from Step 5, and double-check it before pressing Enter: the scan must target only Metasploitable’s lab address.

In the output, look at each open port’s PORT, STATE, SERVICE and VERSION columns. Treat the VERSION column as Nmap’s best identification, not a verified fact; some services reveal little about themselves.

Check yourself: the scan lists at least one open port. If it reports that the host seems down, the address is wrong or the two machines are not on the same network: go back to Step 5, and do not widen the scan to look for it.

Step 7 — Record observations

Record what the scan reported, in your own table. The rows below are placeholders to show the structure; they contain no results.

On narrow screens, focus the table and use the arrow keys or swipe to read across.

Note anything uncertain, such as a service whose version was not identified.

Step 8 — Research vulnerabilities

For each service with an identified product and version, use trustworthy sources: the product’s CVE records, the NVD and the vendor’s security advisories. Record:

A match between the observed version and a CVE is a lead, not confirmation. Check product names, version ranges and configuration, and remember that vendors sometimes backport fixes without changing the version number.

Step 9 — Stop before exploitation

This lab ends here. Do not run exploit code or try to use any weakness you found, even though Metasploitable is designed to be vulnerable. Exploitation is a separate activity that would need its own explicit, written lab instructions and scope. Finding a possible vulnerability does not, by itself, extend what the lab authorises.

When you have finished, shut down both VMs.