Guided Lab: Kali and Metasploitable Service Discovery

Lesson plan

Level

Beginner

Time

About 60 minutes; the steps below add up to 62

Learners first decide what they must be certain of before switching on a deliberately vulnerable machine, and which target is suitable, so that scope and authorisation come before any step. Each group of lab steps is then preceded by a prediction (the main safety check, which interface is on the lab network, what to check before the scan, whether a matching advisory proves anything) and followed by a check. The lab is instructional: nothing in the session records the lab as done, and it stops at discovery and research.

Objectives

• Explain why the lab’s topology is its main safety control
• Find each machine’s lab address by comparing networks
• Run service and version discovery against the lab target only
• Record observations and research them with a stated level of confidence
• Explain why the lab stops before exploitation

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Service Discovery and Inspecting Network Configuration lessons first.
• This is a plan for future practice. If learners carry it out, it must be on hosts they own, with Metasploitable on a host-only network only.
• The lesson takes about 62 minutes. To teach it in two parts, stop after “Find the lab addresses”; the second part opens with “Discover and record”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Explain why the lab’s topology is its main safety control
   • Find each machine’s lab address by comparing networks
   • Run service and version discovery against the lab target only
   • Record observations and research them with a stated level of confidence
   • Explain why the lab stops before exploitation

   Purpose: Learners first decide what they must be certain of before switching on a deliberately vulnerable machine, and which target is suitable, so that scope and authorisation come before any step. Each group of lab steps is then preceded by a prediction (the main safety check, which interface is on the lab network, what to check before the scan, whether a matching advisory proves anything) and followed by a check. The lab is instructional: nothing in the session records the lab as done, and it stops at discovery and research.

2. 1. Before you touch anything Think 5 min

   Purpose: Put scope and authorisation before any step.

   Ask

   • What must you be certain of first?
   • Which target is suitable?

   Responses to expect

   • Isolation comes quickly; authorisation needs a prompt.
   • On screen in turns: the opening question, its answer; then the question on a suitable target, and its answer.

   Discussion pause: Ask who else could reach the machine on a home network before revealing.

   In the lesson window

   • Think it through: You are about to practise scanning a computer that is deliberately full of weaknesses. Before switching anything on, what would you want to be certain of, and why?
   • Think it through: Which of these is a suitable target for this lab?

3. 2. Objective Explain 3 min

   Purpose: Set out the seven aims and where the lab stops.

   Ask

   • Where does it stop?

   Responses to expect

   • Before any exploitation: discovery and research only.
   • On screen in turns: the opening; then the seven things a learner should be able to do; the check question on where the lab stops, and its answer; the lab stops at discovery and research.

   In the lesson window

   • Check your understanding: Where does this lab stop?

4. 3. What you need Explain 3 min

   Purpose: List the requirements and why the host must be the learner’s own.

   Ask

   • Why your own host?

   Responses to expect

   • Control and the right to run the lab on it.
   • On screen in turns: the opening question, its answer; then what you need, starting with the host; the two VMs; the host-only network; the lessons to read first.

   In the lesson window

   • Think it through: Why must the host computer be one you own?

5. 4. Required topology Predict 6 min

   Purpose: Explain the two-machine topology and why the target has no NAT or bridged adapter.

   Ask

   • What could go wrong if it reached other networks?
   • Why no NAT or bridged adapter?

   Responses to expect

   • Some think NAT is harmless for the target.
   • On screen in turns: the opening question, its answer; then the topology this lab requires; the check question on Metasploitable’s adapters, and its answer; why Metasploitable gets no NAT or bridged adapter.

   Misconceptions to challenge

   • A learner may believe: “NAT keeps a vulnerable machine safe.” Respond: It lets the machine reach the internet; the target stays host-only.

   In the lesson window

   • Think it through: Metasploitable is deliberately full of weaknesses. If it could reach the internet or your home network, what could go wrong?
   • Check your understanding: Why does the diagram give Metasploitable no NAT or bridged adapter?

6. 5. Check and start the lab Predict 8 min

   Purpose: Make the adapter check the first safety control, then start and sign in.

   Ask

   • Which single check matters most?
   • When is a published password acceptable?

   Responses to expect

   • Learners often want to start the machines first.
   • On screen in turns: the opening question, its answer; then step 1: check the VirtualBox adapters; step 2: start both machines; step 3: log in to Metasploitable; the check question on the default password, and its answer; weak credentials only in an isolated lab.

   If the explanation does not land: Ask learners to read the adapter list aloud and match it to the diagram, line by line.

   In the lesson window

   • Think it through: Before starting either machine, which single check would do most to keep the lab safe?
   • Check your understanding: Metasploitable signs in with a published default password. When is that acceptable?

7. 6. Find the lab addresses Predict 8 min

   Purpose: Find each machine’s lab address by comparing networks.

   Ask

   • How will you tell which interface is on the lab network?
   • What do matching network addresses show?

   Responses to expect

   • The NAT interface is the usual wrong pick.
   • On screen in turns: the opening question, its answer; then step 4: inspect Kali’s networking; step 5: inspect Metasploitable’s networking; the check question on the same network, and its answer; check yourself: one network, two machines.

   In the lesson window

   • Think it through: Kali has two network interfaces as well as the loopback interface. How will you tell which one is on the lab network?
   • Check your understanding: You apply each machine’s mask and get the same network address but different host addresses. What does that show?

8. 7. Discover and record Predict 9 min

   Purpose: Plan the version scan, keep it in scope, and record honestly.

   Ask

   • What do you check before pressing Enter?
   • What if What if the host seems down?
   • What do you record for a port with no version?

   Responses to expect

   • Widening the scan is a tempting wrong response.
   • On screen in turns: the opening question, its answer; then step 6: service and version discovery; the check question on a host that seems down, and its answer; check yourself: at least one open port; step 7: record observations; the question on a port with no version, and its answer; note anything uncertain; a finished record, starting with the observation; the research; why it is a good record.

   Misconceptions to challenge

   • A learner may believe: “If the target is not found, scan more widely.” Respond: Recheck the address; widening leaves the scope.

   In the lesson window

   • Think it through: You are about to run a scan against the target’s lab address. What should you check one last time before pressing Enter, and why?
   • Check your understanding: The scan reports that the host seems down. What is the right response?
   • Think it through: One open port shows no version at all. What should your record say for it?

9. 8. Research, then stop Predict 8 min

   Purpose: Research findings with stated confidence, and stop before exploitation.

   Ask

   • Does a matching advisory prove the machine is vulnerable?
   • May you try exploit code now?

   Responses to expect

   • Some argue that a deliberately vulnerable target makes exploitation fine.
   • On screen in turns: the opening question, its answer; then step 8: research vulnerabilities; step 9: stop before exploitation; the check question on trying exploit code, and its answer; shut down both machines.

   Misconceptions to challenge

   • A learner may believe: “A deliberately vulnerable machine may be exploited in any lab.” Respond: Only with its own explicit, written instructions and scope.

   To go further

   • What would a separate, authorised exploitation exercise need to say in writing before it began?

   In the lesson window

   • Think it through: Research finds an advisory whose affected versions include the version your scan reported. Is the lab machine vulnerable?
   • Check your understanding: You find a likely vulnerability. May you now try exploit code against Metasploitable as part of this lab?

10. 9. Recording findings responsibly Explain 3 min

    Purpose: Set out how findings are recorded and shared safely.

    Ask

    • What should you check before sharing a screenshot?

    Responses to expect

    • That nothing reveals the real network or host.
    • On screen in turns: the opening question, its answer; then four habits for a record, starting with confidence; separating report from research; keeping material to the lab; recording enough to repeat it.

    In the lesson window

    • Think it through: You want to share a screenshot of your scan notes. What should you check first?

11. 10. Completion status Explain 1 min

    Purpose: Restate that the lab is instructional and not yet completed.

    Ask

    • What would count as evidence that the lab had been done?

    Responses to expect

    • A separate record of the work, not these instructions.
    • The status paragraph is shown whole, on its own: it is not split into turns, and it must stay word for word.
    • On screen in turns: the opening.

12. 11. Apply it in a new situation Apply 4 min

    Purpose: Set up independent application, ideally on a later day.

    Ask

    • Who will try these now, and who later in the week?

    Responses to expect

    • Bridged mode tests topology; the wider scan tests scope; the record tests confidence.
    • On screen in turns: the opening; then the question on bridged mode for updates, and its answer; the question on scanning everything, and its answer; the question on record wording, and its answer.

    In the lesson window

    • Apply it: A classmate wants to switch Metasploitable to bridged mode to download updates. What do you advise?
    • Apply it: Someone suggests scanning the whole host-only network “to see what else is there”. Is that within this lab’s scope?
    • Apply it: Your scan reports a version inside an advisory’s affected range, but you have not checked its configuration. Which record is best?

13. 12. Check your understanding Check 2 min

    Purpose: Check the lab’s design against the approved revision-bank question.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The stop-point question links to the last lab step.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer.

14. 13. What to remember Consolidate 2 min

    Purpose: Summarise the five points.

    Ask

    • Without looking: the lab’s main safety control.

    Responses to expect

    • Checking the adapters against the topology.
    • On screen in turns: the opening; then the summary.

15. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Topology first.
    • Compare networks to find the lab address.
    • Scan only the target.
    • Matches are leads; state your confidence.
    • Stop before exploitation.

Consolidation

• Topology first.
• Compare networks to find the lab address.
• Scan only the target.
• Matches are leads; state your confidence.
• Stop before exploitation.