Where to find virtual machines and ISO files?

In this article:

Where to find virtual machines and ISO files?

Free software

Virtual machines

Several websites offer a large selection of freely downloadable virtual machines with pre-configured free software, for instance:

TurnKey Linux.
Bitnami.

You can also check the marketplaces maintained by virtualization-related software, such as VMware and GNS3.

ISO files

Obviously the main place to get free software ISO files is from the projects website.

However, FrozenCow maintains a centralized list of direct links to a fair number of Linux and BSD installation ISO files.

Some projects host all previous versions of their system, but sometimes they are not easy to find. Search in priority on the master repository as these older versions may not be copied onto mirrors. Sometimes they are stored in a separate “archive” area. At last, WinWorld does a great job in collecting old systems installation medias, including discontinued Linux distributions.

If you are not sure which Linux or BSD system to choose, DistroWatch might be a good source if information.

If you hesitate between similar applications, LibHunt and alternativeTo may help you.

Microsoft

Evaluation versions

Microsoft distributes freely downloadable evaluation versions of some of its latest products through several channels:

TechNet Evaluation Center, which provides the evaluation version (virtual image files and .iso installation disks) of various Microsoft Enterprise systems and products.
Microsoft Edge Development, which provides Windows virtual machines (including older client versions not found in the previous link) with various versions of Internet Explorer and Edge for web application testing.
Older but still supported Windows versions (both client and server) may still be downloadable even if the pages linked above do not list them. To find their URLs, do such kind of search in you favorite search engine:
```
"windows 2008" "care.dlservice.microsoft.com" site:github.com
```
This should provide you various projects maintaining lists of Microsoft download URLs.

Warning

Double-check that the URL uses a legitimate Microsoft domain (usually either care.dlservice.microsoft.com or download.microsoft.com) to avoid potentially malicious files.

Depending on the image these systems expire 30, 90 or 180 days after their first boot.

Retail versions

As long as you have a valid corresponding product key, it is possible to download .iso files for all currently supported products.

Images of old systems installation media can be found in WinWorld’s library.

Installation medias for systems not distributed anymore by Microsoft but not old enough to be part of WinWorld library can usually be bought for very few money on websites like eBay.

Apple

I don’t know any official and clean way to get a recent version of Apple’s operating system (Mac OS X, OS X, macOS, or however it is called now) to run in a virtual machine.

Even the underlying “open source” system Darwin is not usable as-is anymore and is just distributed as source archives instead of binary executable as it was once. There are projects attempting to build something out of it but with nothing practically usable for now.

If you search the web you may find more-or-less reliable ways to, from a macOS system, build an installation media from an upgrade package (the method to use seems different for every upgrade). You may also find ready-made virtual machines, but use due caution as with any content downloaded from untrusted sources (while such files may be suitable for testing purpose, do not use them for anything sensitive).

Vulnerable targets

Two well known projects are:

Security Sheperd from OWASP, which targets web and mobile applications.
Metasploitable2 from Rapid7, which targets services exploitation.

To go further, Joe Shenouda maintains a very good list of hacking environments you can use to expand your practical knowledge.

How to build a virtual pentest lab

Standalone virtual machines are both a cheaper and more practical solution to test systems as they doesn’t need to dedicate hardware and are easier to handle than physical installation (actions such as cloning, doing a snapshot or a rollback become trivial).

Network virtualization goes a step further and apply the same system to a whole network, including workstations, servers, and all networking devices such as switches, routers and firewalls. A virtual network can be of any size and topology, and can mimic any real-life situation such as Active Directory domains, remote-access or site-to-site VPNs or test protocols of every network plane.

Such virtual network can be either fully isolated or have one or several link to physical devices and networks, its all up to you to decide.

Hardware

Prerequisites

The goal of a virtual lab is to be able to quickly setup the environment which will allow you to …

Continue

How to run a CAM table overflow attack in GNS3

Knowing where difference with real gears lies

For performance reasons, a lot of switch things are actually not part of the IOS code but are implemented in hardware. This includes the ARL, or Address Resolution Logic, which provides all the methods to add, remove and lookup entries in the MAC address table.

Therefore, for the NM-16ESW module to work in GNS3, Dynamips had to reimplement all these normally hardware provided services, or at least push this far enough to allow an unmodified IOS to run on it correctly.

The sad thing is indeed that this is unfinished work, as stated in this module’s source code header:

/*
 * Cisco router simulation platform.
 * Copyright (c) 2006 Christophe Fillot (cf@utc.fr)
 *
 * NM-16ESW ethernet switch module (experimental!)
 *
 * It's an attempt of proof of concept, so not optimized at all at this …

Continue

How to add virtual machines (end devices nodes) in GNS3

Virtual machines can be added in GNS3 topologies as end devices nodes and can play various roles:

Lightweight ones are very focused for instance to provide just enough to test the network connectivity or provide a functional browser.

They start blazingly fast and are very light on resources, meaning you can put several of them to test end-user workstation behavior at several places in your topology with little to no worry about the CPU or memory impact.
Dedicated appliances are designed to provide a specific service, like networking (firewall, …), applicative (proxy, email filtering, …) or administrative (monitoring, …) services.

Resource consumption vary greatly depending on the service and the software used by the appliance. However, professional appliances are usually designed to handle a large number of simultaneous operations: some will support with no issue to see the virtual machine resources settings reduced on test environments (some may require a modification in their …

Continue

Which Windows edition should I choose?

Windows editions follow a naming convention which may not be the clearest and, to make things worse, change with Windows versions and cover both technical and non-technical differences (meaning that two different editions may actually be the same with just a different EULA).

Here is a short post on main Windows editions with a focus on the version you may prefer for your lab.

Windows client editions

Windows Home or Core edition is the low-budget, consumer grade version of Windows. It is enough for home uses, but is missing features necessary for corporate environments such as the ability to join an Active Directory domain.
Windows Professional or Business edition adds more functionalities, such as the ability to join an Active Directory domain and disk encryption (limited to the Enterprise edition and above until Windows 7 included).
Windows Enterprise, Education and Ultimate editions are the most complete editions. There is little …

Continue

Common issues when using virtual machines

Qemu issues

Send the Ctrl-Alt-Del key sequence to the guest

The Ctrl-Alt-Del is a special key sequence intercepted by he operating system. Windows use it as a security¹ measure to unlock its screen, but in the case of virtualized system an alternative is necessary as the key sequence would be intercepted by the host instead of being sent to the guest.

If you are using VNC display, press F8, you should get a menu proposing to send the Ctrl-Alt-Del sequence to the guest.
If accessibility tools are available, enable the on-screen keyboard, press Ctrl-Alt on your physical keyboard and click Del on the on-screen keyboard.
If accessibility tools are not available, on Windows systems press the Shift key at least five times in a row, you should get a pop-up allowing to enable sticky keys. Now successively press the Ctrl, the Alt …

Continue

Popular tags ^{see all}

WhiteWinterWolf Practical IT security, *nix systems & networking