Setting Up Your Web Hacking Lab

Introduction

Before hacking anything, you need a safe and legal environment — a sandbox where you can learn, break, and fix without consequences.

In this part, we’ll guide you through setting up a complete Web Hacking Lab with vulnerable web apps, intercepting tools like Burp Suite, and a browser configured for testing.

🧰 What You’ll Set Up

🐧 Kali Linux (Virtual Machine or native)
🐞 Vulnerable apps: DVWA, bWAPP, Juice Shop
🔎 Tools: Burp Suite, OWASP ZAP, browser plugins
🌐 Local or isolated environment (for safety)

📦 Step 1: Install Kali Linux (Preferred OS)

You can use Kali via:

Virtual Machine (recommended): Download from Offensive Security
Live USB or bare metal install

Why Kali?

Pre-installed tools (Burp Suite, Nmap, SQLMap)
Built for penetration testing

📝 Tip: You can also use Parrot OS or Ubuntu + manual tools.

🧱 Step 2: Install Vulnerable Web Apps

🧨 DVWA (Damn Vulnerable Web App)

sudo apt install apache2 mariadb-server php php-mysqli git
cd /var/www/html
sudo git clone https://github.com/digininja/DVWA.git

Set up the configuration file:

cd DVWA/config
sudo cp config.inc.php.dist config.inc.php

Start the necessary services:

sudo service apache2 start
sudo service mysql start

Access DVWA in your browser:

http://localhost/DVWA

🐝 bWAPP (Buggy Web App)

Clone the bWAPP project into your web root:

cd /var/www/html
sudo git clone https://github.com/rajeshkumarkhadka/bWAPP.git

Configure check.php and database settings manually if needed.

Then open the app in your browser:

http://localhost/bWAPP

🍹 Juice Shop (OWASP Juice Shop)

Install Juice Shop using Node.js:

npm install -g @juice-shop/juice-shop
juice-shop

Once started, open the app in your browser:

http://localhost:3000

Alternative deployment options:

Docker
Heroku

Try online (no setup required):

https://demo.owasp-juice.shop

🕵️ Step 3: Install Burp Suite

🧰 Burp Suite – Web Proxy Tool

Burp Suite is a powerful tool used for:

Intercepting HTTP/HTTPS traffic
Modifying requests on the fly
Scanning for web vulnerabilities

📦 Already pre-installed in Kali Linux. If not, install it manually:

sudo apt install burpsuite

🔧 Setup Instructions:

Open Firefox
Go to Preferences → Network Settings
Choose Manual Proxy Configuration
Set:
- HTTP Proxy: 127.0.0.1
- Port: 8080
Enable: Use this proxy for all protocols
Import Burp’s CA certificate to avoid HTTPS warnings

🧩 Bonus Tools & Browser Setup

Install these Firefox extensions:

HackBar – for manual payload testing
Wappalyzer – detect web technologies
Cookie Editor – manipulate cookies
User-Agent Switcher – disguise your browser

✅ Final Checklist

Tool	Purpose
Kali Linux	Base OS for hacking tools
DVWA / bWAPP / Juice Shop	Targets for practice
Burp Suite	Request interception & modification
Firefox (hardened)	Testing browser
Proxy extensions & plugins	Improve speed & workflow

🔚 Wrapping Up

You now have your own ethical hacking lab, where you can safely practice and master every web attack technique we’ll cover next.

👉 Up next:
Part 3 – Information Gathering: Mapping the Web Attack Surface

You’ll learn how to fingerprint websites, find subdomains, detect input points, and build a hacker’s understanding of a target.