Proxmox Pentesting Lab | Richard McLeish

Core stack

Proxmox VE on a dedicated custom-built server
Kali Linux attacker workstation
OWASP Broken Web Apps vulnerable web target
Ubuntu / Metasploitable vulnerable Linux target
Windows Server 2012 R2 target machine
Windows 10 target workstation
vmbr2 as the isolated pentesting bridge

What I built

Created a dedicated Proxmox Linux bridge for the pentesting lab so it stays separate from management and SOC traffic.
Imported VMware .vmdk virtual disks into Proxmox using qm importdisk.
Configured each VM with the correct CPU, RAM, network adapter, boot mode, and storage settings.
Assigned static IP addresses to each machine on the isolated 192.168.56.0/24 subnet.
Verified connectivity from Kali to each target machine.
Created clean initial snapshots so each VM can be restored after lab exercises.

Network design

vmbr0 handles management, vmbr1 handles SOC monitoring, and vmbr2 carries pentesting traffic on 192.168.56.0/24. Targets need no default gateway for local exercises. SOC v2 later added monitoring interfaces to selected targets.

vmbr0: Proxmox management / home network

vmbr1: Wazuh SOC lab

vmbr2: Pentesting lab network

Kali:              192.168.56.10

Ubuntu:            192.168.56.20

Windows 10:        192.168.56.30

Windows Server:    192.168.56.40

OWASP BWA:         192.168.56.50

Issues I had to solve

I troubleshot VM storage, boot settings, addressing, and firewall behaviour.

Recovered Proxmox access after an ISP/router change by switching the management bridge to DHCP and finding the new web UI address.
Resolved failed ARP/gateway access when the old static IP no longer matched the new network layout.
Worked around storage pressure by deleting already-imported source archives and extracted VMware folders.
Imported split VMware disks by selecting the main descriptor .vmdk file instead of the numbered disk chunks.
Configured persistent static IPs for Kali, Ubuntu, OWASP BWA, Windows Server, and Windows 10.
Enabled ICMP echo requests on Windows Server so Kali could verify connectivity with ping.
Fixed the Windows 10 boot loop by changing the VM from SeaBIOS to OVMF/UEFI and adding an EFI disk.

Lab Inventory

Virtual machines and roles

Each VM has a defined role in the lab and a predictable static IP address.

Kali Linux

Attacker workstation for authorized scanning, enumeration, web testing, and exploitation exercises.

192.168.56.10

Ubuntu / Metasploitable

Vulnerable Linux target used for service discovery, exploitation practice, and post-exploitation exercises.

192.168.56.20

Windows 10

Windows workstation target used for Windows-based testing and client-side lab scenarios.

192.168.56.30

Windows Server 2012 R2

Windows server target used for server-side enumeration, firewall testing, and Windows network practice.

192.168.56.40

OWASP Broken Web Apps

Vulnerable web application target used for web security testing inside the isolated lab network.

192.168.56.50

Security Lab Notes

Exercises completed inside this environment

Two completed exercises from this lab.

Client-Side Security

Client-Side Browser Exploitation Lab

A controlled Kali Linux and Windows 10 exercise focused on browser exploit reliability, sandboxing, payload delivery, evidence validation, and defender visibility.

Validated an isolated client-side attack chain
Documented browser architecture and version-matching issues
Verified payload retrieval and a remote lab session

Read Browser Lab Notes

OWASP WebGoat · Web Security

Web Application Security Lab

A controlled WebGoat and Burp Suite exercise focused on request inspection, exposed application logic, unsafe input handling, and defender-oriented analysis.

Analyzed HTTP requests and responses with Burp Suite
Validated common web-application weaknesses in an authorized lab
Connected offensive findings to secure-development and monitoring practices

Read WebGoat Lab Notes

Evidence

Proof snapshots

Bridge configuration, Kali connectivity tests, the Windows boot fix, and restore snapshots.

Proxmox network page showing the vmbr2 isolated pentesting bridge — Dedicated **vmbr2** bridge for isolated pentesting lab traffic.

Kali terminal showing successful ping tests to lab target machines — Kali successfully reaching target VMs on the isolated lab subnet.

Proxmox Windows 10 VM hardware settings showing OVMF UEFI configuration — Windows 10 boot issue resolved by switching the imported VM to OVMF/UEFI.

Proxmox snapshots page showing clean initial state snapshots for pentesting lab VMs — Clean initial snapshots created before beginning course testing.

Next Stage

What comes next

SOC integration

Linux and Windows endpoints now report to Wazuh in SOC v2. Next, compare controlled attack activity with the resulting telemetry.

Expanded lab targets

Import additional vulnerable machines to support more advanced penetration testing exercises.