INDEPENDENT SECURITY LEARNING
Kioptrix downloads.
Your first working lab.
Practical guides for setting up training VMs, checking observations and keeping evidence. Looking for the Kioptrix training VMs? Start with the download and setup guide, then follow the lab checks and optional walkthrough hints.
Download & set up Level 1 →Find compliance planning guides →
What do you need help with?
Not sure what to search for? Browse by task or choose the problem you are seeing.
PATH 01 · HANDS-ON LABS
Your first Kioptrix lab, from setup to a useful report
Work through these stages in order. If a stage fails, repair that layer before continuing. Each stage ends with a concrete record; completing a command alone does not prove you understood its result.
| Stage | Open this guide | Leave with |
|---|---|---|
| 1 · Choose & install | Level 1 download and setup All releases · Level 3 | Image identity, compatible host and recovery snapshot. |
| 2 · Check the environment | Symptom-based troubleshooting | Confirmed target identity, isolated network and exact error if blocked. |
| 3 · Practise deliberately | Seven-session roadmap Choose the next testable question | One observation, one hypothesis and one bounded next check. |
| 4 · Check your reasoning | Level 1 walkthrough and hints | A comparison between your evidence and the documented path. Solution spoilers apply. |
| 5 · Review & report | Pause-and-review decision record Lab report guide | What happened, why you believe it, what failed and what remains unverified. |
Before you start: use an isolated, authorized lab; confirm the actual target rather than copying a walkthrough address. Keep intentionally vulnerable VMs away from public exposure and everyday devices.
Already stuck? Pick the symptom.
- Import or boot fails: VM import checklist. Preserve the original archive and check host/guest architecture.
- No address or connection: network and protocol diagnosis. Save the exact error before changing settings.
- Plenty of output, no next step: turn an observation into a question.
- Repeating the same failed idea: classify the failed result and record what it actually rules out.
- The current VM state is unclear: preserve evidence and choose a recovery action before rebooting or restoring a snapshot.
Browse Kali Linux, practice labs and tools, or certification study guides when you know the skill you need.
Choose practice. Keep evidence. Explain your work.
Pick the task you need now. These guides include comparison criteria, copyable records and conditional examples; they do not require a completed lab to be useful.
| Your task | Open these guides | Make this decision or record |
|---|---|---|
| Choose a practice environment | Full VM or focused CTF task? Choose an exact VulnHub release · Compare Metasploitable versions | A permitted, compatible environment matched to a specific practice question. |
| Keep a traceable lab record | Copy a session note Organize evidence files · Review your reasoning | Observed facts, separate interpretations, assistance used and what remains unknown. |
| Present a learning project | Build an evidence-based portfolio entry Write a supported resume bullet · Prepare a factual STAR outline | A description that matches your actual role and result, including guided or unfinished work. |
PATH 02 · BUSINESS SECURITY
Security standards & compliance planning
Choose your framework before comparing budgets or checklists. These are independent educational planning resources, written by a security enthusiast. They do not certify compliance or replace your contract, the current official rules, or a qualified assessor.
| Your task | Start here | Useful follow-up |
|---|---|---|
| Prepare CMMC evidence | Assessment preparation checklist | Remediation budget · Control gaps |
| Plan a FedRAMP engagement | 20x vs Rev5 pathway decisions | Scope, quote exclusions and recurring costs |
| Budget an ISO 27001 audit | Audit cost drivers | Document the ISMS boundary and compare equivalent assessor scopes. |
| Prepare ecommerce PCI DSS work | PCI DSS v4.0.1 checklist | QSA quote comparison |
Browse all compliance guides → · Security guides for founders
Use the evidence labels: official requirements come from the linked authority; suggested workflows and example budgets are editorial aids. Verify time-sensitive requirements against the original source and your actual scope before commissioning work.
A site built with care for the person learning
I run Kioptrix Labs as a cybersecurity enthusiast with substantial hands-on lab experience. I care about helping you leave with a clearer understanding and a useful next step. Your time matters: the aim is to explain the reasoning, help you work through setbacks, and be honest about what is known.
Important claims should be traceable to their sources. Practical tests, documentation reviews and illustrative examples have different limits; a revision date alone does not prove a successful test. See how to read the evidence labels.
Something unclear or out of date? You do not need to be an expert to help improve a guide. Ask a question, report a broken link or suggest a correction. Please include the page and the step that needs attention.
All articles · Read the author, evidence and corrections policy · Privacy · Terms & disclaimer
Navigation and editorial structure reviewed October 23, 2026. No new VM execution is claimed by this homepage update.