Kali Linux VM (attacker) - Metasploitable 2/3 (targets) - DVWA, OWASP Juice Shop (web targets) - Isolated virtual network