Learning Offensive Security with Project V^3: VulnHub + VirtualBox + Vagrant

Anthony Radzykewycz and James Green introduce Project V^3, an effort to port machines from VulnHub, a collection of intentionally vulnerable virtual machines, to VirtualBox and publish them as Vagrant boxes on Vagrant Cloud. The aim is to make practice labs easier to set up for newcomers who lack virtualization or sysadmin experience, and to bring in authors of vulnerable machines that are not hosted on VulnHub.

The demo starts with the prerequisites: VirtualBox with its extension pack, Vagrant, and optionally Git. A setup script creates a named internal network, and the attacker VM is attached to it. The presenter clones the project's GitHub repository, finds a beginner machine by searching the directory listing, and runs a single vagrant up command. The box downloads, is imported into VirtualBox, and starts headless. From the attacker host, the presenter confirms the address on the internal network, runs a basic Nmap scan, and opens a web server on port 80 in a browser.

The speakers also cover day-to-day handling. Vagrant halt stops a machine so it can be resumed later from the same directory, while vagrant destroy removes it completely, freeing disk space. Running vagrant up again rebuilds a fresh copy, so learners can reset a lab easily. The takeaway is that the repository reduces lab setup to a few commands, and the speakers invite feedback and contributions from other maintainers of vulnerable machines.