VirtualBox and VMware Basics: Add Any OS, Then Install Kali, Parrot and Windows 11

Part of our free Build Your Own Cyber Lab series. Work through it in order, or jump to the part you need.

1. Plan your lab: hardware, hypervisors and safe networking
2. VirtualBox and VMware basics, then Kali, Parrot and Windows 11 (you are here)
3. Beyond VirtualBox: Hyper-V, VMware Workstation and Proxmox
4. Dual boot Kali Linux and Windows safely
5. Ubuntu in your lab: desktop, server, SSH and Docker
6. Active Directory lab with Windows Server
7. Attack-and-defend network: firewall and vulnerable targets
8. Metasploitable 2 and 3: install and first exploits
9. Blue-team lab: Wazuh, Sysmon and Security Onion
10. Android app testing lab: emulator, MobSF, Frida and Burp
11. OT/ICS security lab: OpenPLC, Modbus and an HMI
12. Network lab: build it in Packet Tracer or GNS3, read it in Wireshark

Step 1: Install VirtualBox

1. Download the VirtualBox platform package for your host OS from the official VirtualBox downloads page.
2. Run the installer and accept the network driver prompts - the host-only and bridged adapters need them.
3. Optionally install the Extension Pack from the same page (File > Tools > Extension Pack Manager). It adds USB 2.0/3.0 passthrough and disk encryption. It is free for personal, educational and evaluation use under its own licence, so check the terms before using it at work.

Windows hosts: if Hyper-V, WSL 2 or Memory Integrity (Core Isolation) is enabled, VirtualBox runs on top of the Windows hypervisor and can be slower. That is fine for learning; if performance is poor, see part 3.

The basics: adding any OS to VirtualBox or VMware

Every VM in this series - Kali, Parrot, Ubuntu, Windows, Windows Server - is added the same way. Learn this once and the rest of the series is just choosing settings.

Three ways a VM arrives

• An installer ISO - you create an empty VM and install the OS into it, exactly like a physical PC. Works for every OS.
• A ready-made appliance (OVA/OVF) - a packaged, pre-installed VM. You import it and it is ready to boot.
• A pre-built VM folder - for example Kali's VirtualBox (.vbox + .vdi) or VMware (.vmx + .vmdk) images. You open it directly.

Always download from the vendor's official site and compare the published SHA256 checksum before use (Get-FileHash file.iso in PowerShell, or sha256sum file.iso on Linux).

Creating a VM from an ISO in VirtualBox

1. Machine > New. Give it a clear name, choose a folder on your SSD, and select the ISO.
2. Type and version: VirtualBox usually detects them from the ISO. If not, pick the closest (for example Linux / Debian 64-bit for Kali and Parrot, Linux / Ubuntu 64-bit, Windows 11 64-bit, Windows 2022 64-bit for Server).
3. Unattended installation: VirtualBox offers to install Windows and Ubuntu for you. It is convenient, but tick Skip Unattended Installation the first few times so you learn the real installer.
4. Hardware: memory and CPUs (2 CPUs and 2-4 GB for Linux, 4-8 GB for Windows). Tick Enable EFI for modern OSes.
5. Hard disk: create a new VDI, dynamically allocated (it only uses space as it fills), sized to the guidance in each part.
6. Finish, then open Settings before first boot to set the Network adapter to the right lab network and, for Windows, enable TPM 2.0 and Secure Boot under System.
7. Start the VM, install the OS, then remove the ISO (Devices > Optical Drives) so it boots from disk.

Creating a VM from an ISO in VMware Workstation

1. File > New Virtual Machine and choose Typical.
2. Select Installer disc image file (iso). If VMware detects the OS it may offer Easy Install; choose to install the OS later if you want the real installer.
3. Confirm the guest operating system and version.
4. Name the VM and choose its location.
5. Set the disk size. "Store virtual disk as a single file" performs slightly better; split files are easier to move.
6. Click Customize Hardware to set memory, processors and the Network Adapter (NAT, Host-only, a custom VMnet or a LAN segment).
7. For Windows 11, open VM > Settings > Options > Access Control to encrypt the VM, then add a Trusted Platform Module on the Hardware tab - VMware requires encryption before it allows a virtual TPM.
8. Power on and install.

Importing an OVA or OVF appliance

• VirtualBox: File > Import Appliance, choose the file, review the settings (rename it, adjust RAM and the network adapter, and choose Generate new MAC addresses so clones do not clash), then Finish.
• VMware: File > Open, select the .ova, give it a name and location, and click Import. If VMware warns about the OVF specification, choosing Retry with relaxed checks usually succeeds.

After any install: guest tools and a snapshot

1. Install the guest tools: Guest Additions in VirtualBox (Devices > Insert Guest Additions CD image) or VMware Tools (VM > Install VMware Tools). Most current Linux distributions use the open-source open-vm-tools package or include the drivers already. Tools give you proper screen resizing, mouse integration and better performance.
2. Update the OS fully.
3. Take a snapshot named after its state ("Ubuntu - clean, updated"). Every exercise starts from here.

Step 2: Create the lab networks

Open File > Tools > Network Manager.

1. On the NAT Networks tab, create a network named LabNAT with the prefix 10.10.10.0/24 and DHCP enabled. VMs here can see each other and reach the internet for updates.
2. On the Host-only Networks tab, create an adapter (VirtualBox suggests a 192.168.56.0/24 range). Your host can reach VMs on it, but they have no internet.
3. Internal networks need no setup - you simply type a name such as isolated in a VM's network settings and every VM using that name shares the segment.

Step 3: Kali Linux from the ready-made image

Kali publishes pre-built VirtualBox images, which is faster than installing from the ISO.

1. Download the VirtualBox image from the Kali "virtual machines" page and extract the archive (you need 7-Zip on Windows).
2. In VirtualBox choose Machine > Add and select the .vbox file.
3. Before first boot, open Settings: give it at least 2 CPUs and 4 GB RAM, and under Network set Adapter 1 to NAT Network: LabNAT.
4. Start the VM and log in with the default credentials documented on the Kali download page (kali / kali at the time of writing). Change the password immediately with passwd.
5. Update the system:

sudo apt update && sudo apt full-upgrade -y

6. Take a snapshot named "Kali - clean".

Step 4: Parrot OS from the ISO

Parrot offers a Security edition (penetration-testing tools) and a Home edition (a privacy-focused daily driver). For a lab, choose Security. Parrot also publishes ready-made virtual images for some editions; if one is offered for VirtualBox, import it like Kali. Otherwise install from the ISO:

1. Machine > New, name it "Parrot", select the ISO, type Linux, version Debian (64-bit).
2. Give it 2 CPUs, 4 GB RAM and a 40 GB dynamically allocated disk.
3. Tick Skip Unattended Installation so you see the real installer.
4. Boot, choose the installer from the boot menu, and accept "erase disk" - it only erases the virtual disk.
5. After the reboot, eject the ISO (Devices > Optical Drives), update the system, and snapshot.

Kali or Parrot? Both are Debian-based with similar tool sets. Kali is the industry default and what most courses assume; Parrot is lighter on older hardware. Try both and keep the one you prefer.

Step 5: Windows 11 as a victim and analyst machine

1. Download the Windows 11 Enterprise evaluation ISO from the Microsoft Evaluation Center. It runs for a limited evaluation period, which is perfect for a lab you rebuild.
2. Machine > New, select the ISO, and let VirtualBox detect Windows 11.
3. Give it 4 GB RAM (8 GB is smoother), 2+ CPUs and a 64 GB disk.
4. Under System, make sure EFI, Secure Boot and TPM 2.0 are enabled - Windows 11 checks for them. Recent VirtualBox versions set these automatically for the Windows 11 template.
5. Install Windows, then install Guest Additions (Devices > Insert Guest Additions CD image) for screen resizing and a shared clipboard.
6. For a victim machine, disable the shared clipboard and drag-and-drop afterwards - they are a path between the VM and your host.
7. Snapshot "WIN11 - clean".

Step 6: Put them on the right networks

• Kali and any vulnerable target: Internal Network isolated for attack exercises, switched to LabNAT only when you need updates.
• Windows 11: LabNAT while you update it, then the corporate network you build in part 6.

Check connectivity from Kali with ip a and ping, and confirm the isolated network truly has no internet: ping 1.1.1.1 should fail.

Troubleshooting

• "VT-x is not available": enable virtualisation in firmware, or check whether another hypervisor holds it.
• Black screen or tiny resolution: install Guest Additions, or switch the graphics controller to VMSVGA for Linux and VBoxSVGA for Windows.
• Windows 11 says the PC does not meet requirements: confirm EFI, Secure Boot and TPM 2.0 are on, and allocate at least 4 GB RAM and 64 GB disk.

Keep it legal and contained

Only attack machines you own or have written permission to test. Vulnerable VMs and malware samples belong on an isolated network with no route to your home LAN or the internet, and never expose a deliberately vulnerable machine with a bridged adapter or a port forward.

Next step

Part 3 covers Hyper-V, VMware Workstation and Proxmox if you outgrow VirtualBox. Want to try attacks without building anything? The Kali-style terminal in our Linux lab runs in the browser.