Reviewed October 16, 2026. Release names and links were checked against VulnHub. Practice goals below are editorial suggestions, not official level objectives, a difficulty ranking or results from independent testing of these images.
The five releases are distinct images, not interchangeable versions or a validated difficulty ladder. Identify the exact release before following setup notes or a walkthrough. “Level 2” commonly refers to Level 1.1 (#2), while the fifth release is named 2014. Completing them can support fundamentals practice, but does not establish readiness for a current certification or professional assessment.
Use Legacy Labs for a Clearly Defined Learning Task
A legacy training image can help you practice observation, service validation and reporting. It can also create compatibility work unrelated to the skill you want to learn. Decide which question the session should answer and record setup problems separately from security reasoning. Age alone does not make a target easy or its observed software exploitable.
Prepare One Compatible Attacker–Target Pair
Read the listing and any image-specific notes before importing. Record the archive filename, source, release and any published checksum. A matching legacy checksum can help detect a transfer mismatch; it does not certify that an intentionally vulnerable VM is safe. Preserve the original archive and a recoverable clean copy.
Confirm host/guest CPU architecture and supported virtual devices. Original x86 images do not become compatible with Apple Silicon merely because an Arm hypervisor is installed. Keep vulnerable guests on a controlled segment, review all adapters and routes, and remember that host-only includes the host. Use the platform selection guide for those checks.
Before the First Exercise
Confirm that you can identify the intended guest, explain the authorized scope, reach the lab through the intended interface and preserve notes. If a step is unfamiliar, make that the first learning task. There is no evidence-based rule that two missed checklist items require a fixed number of remedial minutes.
Release #1: Kioptrix Level 1
The Level 1 (#1) listing identifies the archive and describes a vulnerability-assessment/exploitation challenge. A useful practice goal is to turn one service observation into a justified follow-up. Save scan scope and output; do not convert a familiar banner into a confirmed exploit path.
Release #2: Kioptrix Level 1.1
Use the Level 1.1 (#2) entry to identify this release. For practice, keep a short hypothesis log: observed fact, possible explanation, permitted check and result. This is a suggested exercise, not a claim that the release has one required attack route or a predictable completion duration.
Release #3: Kioptrix Level 1.2
Confirm the image using the Level 1.2 (#3) entry. A suggested goal is to document transitions between stages: what changed, which account or service context applies and what remains unverified. Do not copy assumptions from another release because a walkthrough uses the same informal level number.
Release #4: Kioptrix Level 1.3
The Level 1.3 (#4) listing resolves the naming ambiguity. Use a session to distinguish initial access from effective privilege, if your authorized exercise reaches that stage. Record the actual identity and applicable permissions instead of inferring them from a shell prompt or a tool’s success message.
Release #5: Kioptrix 2014
Read the 2014 (#5) listing and its compatibility notes before treating a boot or network failure as part of the challenge. A useful practice goal is reproducibility: can the permitted result be explained and repeated from a known starting state? This does not imply that the fifth image is always harder than the others.
Track Skills Independently of Release Numbers
For each release, mark setup, service inventory, hypothesis testing, local context and reporting as not attempted, attempted with help, or independently reproduced. These are personal evidence labels, not official scores. Use the Nmap evidence workflow when the next gap is network inventory.
Separate Infrastructure Failures from Exercise Findings
A missing address may involve DHCP or an incompatible virtual NIC. A failed connection may involve routing or a stopped service. A failed exploit may involve the build, configuration or prerequisites. Preserve the error and change one assumption at a time. Bridging the guest onto a shared LAN is not a general repair for a lab connectivity problem.
Budget Sessions Without Forecasting Completion
Hypothetical example: two 60-minute sessions provide 120 scheduled minutes. If setup uses 20 and documentation uses 20, 80 remain for the chosen practice task. That is arithmetic, not an estimate of when a level will be solved. Carry an unfinished task forward with a restart note rather than inventing a completion percentage.
When to Choose Another Practice Environment
Choose a supported, guided environment when hardware compatibility or missing prerequisites dominate the session. Choose a legacy image when its specific learning task is useful and its risks are controlled. Compare current access terms and actual learning coverage before spending money. No platform, release sequence or number of completed boxes guarantees an exam outcome.
After a Result: Test Whether the Method Transfers
Write a short reproduction note with scope, starting state, observations, actions, outcome and limitations. Repeat a permitted task from a clean state. Then choose a different target that tests the same skill without relying on memorized steps. Filling gaps in Windows, identity and reporting may be more useful than repeating an already familiar Linux route.
Common Questions
Are these five levels an official difficulty progression?
No such progression is established by this guide. Use the publisher’s release details and your own evidence rather than a universal time or skill ladder.
Is a matching walkthrough enough to trust a command?
No. Confirm the release, target, conditions and permitted scope. Review code and recovery needs before any state-changing test.
Must I finish a level in one sitting?
No. A well-documented partial investigation is useful. Keep a clear next question and distinguish assistance from independent work.
Start with Identification and One Learning Goal
The checklist is local to this page and does not save your lab state. No image was downloaded, executed or exploit-tested for this revision. Retained illustrations are not evidence that these practice goals were independently tested.