Virtual Machine (VM) 

It is used to host your preferred OS, test servers, vulnerable machines, etc. You can choose hypervisors by VMware, Oracle, Microsoft, or any other option. 

Recommended:

• VMware workstation or vSphere

• Oracle VirtualBox 

• Microsoft HyperV

• Citrix Xenserver

Unpatched OS

Along with your preferred OS, you will also need an unpatched operating system for testing the vulnerabilities. 

Vulnerable VMs

The role of having vulnerable virtual machines is to help you apply your skills to find and fix the vulnerabilities. You can go for popular vulnerable VMs like BadStore, DVWA, OWASP broken web application, or Metasploitable.

• Desktop/laptop with a minimum of 4GB of RAM. 

• A host OS for your computer system. It can be Windows, Linux( any family, any flavor) or Mac OS depending on your choice. 

• A large HDD or SSD to store your tools and other important files.

• Wi-fi connectivity. 

• Latest security patches must be installed on your guest OS before you start.

After having the required hardware and software in place, it is time for you to install some tools on your system to implement your skills.

Kali Linux

It is one of the best-operating systems when it comes to practicing ethical hacking and learning penetration testing. You will find various types of tools in Kali Linux to fulfill most of your requirements. 

John The Ripper

It is free software for cracking passwords. John The Ripper is the preference of numerous ethical hackers for penetration testing because it supports fifteen platforms. 

OWASP ZAP

This is a good tool for penetration testing of web apps. You can practice how to hack web applications in an ethical way.

Burp Suite

It is another tool to prefer for application security testing. You can choose one from Burp Suite and OWASP ZAP. 

Metasploit Framework (MSF)

Metasploit is an open-source project in the cybersecurity field, offering information about various vulnerabilities. It is also available as a tool that helps you in penetration testing and developing IDS signature. 

WireShark

This tool is mostly used by network admins for troubleshooting network issues, analysis, capturing traffic on local networks like Ethernet, Bluetooth, etc. You can use the WireShark tool for network pentesting to find and fix issues in the network that may cause loss of confidential data over an unencrypted network.

Nmap

It is a free-to-use and open-source network scanner. You can use it for security auditing and discovering networks. It can also perform detection of operating systems and network ports.