One of the most important components in building a penetration lab is its vulnerable system(s). We can't go around attempting to practice on systems for which we do not have prior consent as that would be illegal and intrusive.
Popular vulnerable machines used for penetration testing training and practice are known as Metasploitable 2 and Metasploitable 3. These were created by the development team at Rapid 7 (www.rapid7.com) for students and professionals to develop their skills in penetration testing using Rapid 7's own exploitation development framework, Metasploit (www.rapid7.com/products/metasploit).
Other sources of vulnerable systems for practicing and adding to a lab include VulnHub (www.vulnhub.com) and Pentesterlab (www.pentesterlab.com).
