2

How can I add vulnerable VMs in AWS instance of Kali? Do I need to install VMware or Virtualbox on top of the Kali instance in the cloud and then install the vulnerable VMs or is there any other approach?

schroeder
  • 123,438
  • 55
  • 284
  • 319
cradlr
  • 23
  • 1
  • 4

1 Answers1

6

First, a word of caution: AWS requires that you inform them of any security related test you plan on running to their infrastructure [link].

Second, Kali is not a vulnerable operating system, it is an operating system that comes with pre-installed tools so you can perform security tests on other machines.

And third, an AWS EC2 is already a virtual machine, yes you can install virtualbox in an EC2 but there is hardly ever a need for that.

Now, the type of EC2 machine you need depends on the type of test you want to run, for example if you want to probe a vulnerable web server you can run an EC2 with Ubuntu and install Webgoat or any other intentionally vulnerable web server. If you want to probe the actual server then you need to install the specific version of the operating system that you're targeting.

If you want to run both the attacker and the victim inside AWS then I suggest you create 2 separate EC2 instances, in my opinion its a bit odd to install a virtualization manager inside a virtualized machine

Related question: "Securely building a local pentest lab in a VM"

Update:
Vulnhub gives you an ISO/VMWare/Virtualbox image, you can convert this image to an AWS AMI image and create an EC2 with your custom AMI, I found this tutorial on how to do it.

Community
  • 1
Purefan
  • 3,560
  • 19
  • 26
  • 1
    Thanks for a detailed description,appreciate that,specifically I want to test the vulnhub VM's using kali as an attacking machine and the VM's provided by Vulnhub have a static IP,so is there anything which I need to do to import the VM's? – cradlr Jan 13 '17 at 09:45
  • I would say that if you install a VM-Host inside a AWS container and host your vulnerabe OS instance there, this is the way to go if you want to simulate an prone network. Since you do not directly attack AWS infrastructure/products, you and AWS should be O.K. – Gewure Jan 13 '17 at 13:24