What’s the most valuable thing to learn as a security enthusiast? Linux for the win! The undisputed leading Linux distribution for information security, computer forensics, and ethical hacking is Kali Linux.
Offensive Security’s team of security experts maintains Kali Linux, and it comes pre-loaded with over 600 penetration testing tools, a mass of forensics software, and a selection of security auditing frameworks. But where to start with the hundreds of lines of code in a blank command terminal?
This complete Kali Linux tutorial will provide you with a step-by-step learning process that shows you how to create a safe testing environment, learn how to use the terminal to your advantage, scan networks for security holes, and more. And with this knowledge you can start to learn ethical hacking.
What is Kali Linux, and why is it the Gold Standard for security?
However, to get started with Kali Linux, it is best to first get familiar with the unique features that this distribution has to offer.
The powerful and versatile Linux operating system is currently used by an overwhelming majority of server administrators and penetration testers around the world. When it comes to penetrating and securing the computer systems on a network, there is one distribution that stands far above the rest. This distribution, created by Offensive Security, is Kali Linux, the Debian-based Linux distribution that was previously known as BackTrack. With the most current distribution being Linux-based and powerful, Kali is a free and open-source platform that is preloaded with a wide array of over 600 safety and penetration testing applications. This provides users with a perfect platform in which to conduct tests on computer systems and networks and to perform any other form of safety and penetration testing that may be required.
+-----------------------------------------------------------------------+
| KALI LINUX ECOSYSTEM |
+-----------------------------------------------------------------------+
| DEBIAN CORE | CUSTOM SECURITY KERNEL | PRE-CONFIGURED TOOLS |
+-----------------------------------------------------------------------+
|
+----------------------------+----------------------------+
| | |
v v v
[Information Gathering] [Vulnerability Analysis] [Exploitation & Auditing]
(Information Gathering | Vulnerability Analysis | Exploitation & Auditing) (Nmap, Wireshark, etc. | Nessus, Nikto, OWASP ZAP | Metasploit, Hydra, etc.)
- Key Features That Set Kali Apart:
- 600+ Pre-Installed Security Tools: A massive selection of penetration testing and security auditing tools are available by default, such as Nmap, Metasploit, Wireshark, Burp Suite, John the Ripper and many more.
- Custom Kernel Tweaks: Kali Linux comes with a custom-tweaked kernel that includes patches for wireless injection, which greatly simplifies the process of doing security audits over Wi-Fi connections.
- Completely Free & Open Source: Maintained by Offensive Security, Kali remains free to download, use, and modify forever.
Kali Linux for Beginners: Prerequisites & Lab Architecture
One important rule to learn in Kali Linux is to not test systems that you do not own or have been given permission to test by the owner in writing prior to starting your test.
For beginners it is recommended to set up a virtual lab. This way you can practice Kali Linux in a completely isolated environment. Running Kali Linux from your Kali ISO inside a virtual machine (VM) on your host computer (like your Windows or MacOS computer) is the best way to get started with security testing using Kali Linux. You can try out lots of security tools, experiment with Kali Linux, and even crash Kali Linux without any problem. Your host computer and your personal files and programs on it will not get affected in any way.
Recommended Minimum Hardware Requirements
Minimum Requirements for Running Kali Linux
All users can run Kali Linux from a virtual box on their existing host computer. The minimum recommended specifications are:
Hardware Component
Minimum Requirement
Recommended Specification
CPU Architecture
64-bit dual-core processor
Quad-core Intel i5/i7 or AMD Ryzen 5/7
RAM (System Memory)
2 GB minimum
4 GB to 8 GB allocated to the VM
Disk Storage
20 GB free space
40 GB+ NVMe or SSD storage
Virtualization
Intel VT-x or AMD-V enabled in BIOS
Enabled with VirtualBox or VMware Workstation
Step-by-Step Kali Linux Installation Guide
Below we will outline the simple steps to get Kali Linux setup in Oracle VirtualBox. It is a long tutorial that covers all the steps required for a complete setup of Kali Linux in Oracle VirtualBox for beginners.
1.Download VirtualBox and the Kali ISO:5-10 mins.
Here are the steps for setup a brand new Virtual Machine (VM) in VirtualBox for use as a fully standalone testing ground using Kali Linux. Please note that the ‘new’ VM described below is initially setup to perform standard penetration testing, but can be reconfigured later to act as a forensics laboratory or to use as an educational platform for teaching the use of Kali Linux. Follow this link for a much more detailed Installation Guide for Kali Linux on VirtualBox.
2.Create a New Virtual Machine:3 mins.
Open VirtualBox and click New. Set the name to Kali Linux, choose Linux as the Type, and select Debian (64-bit) as the Version. Point the ISO selector to your downloaded Kali ISO file.
3.Allocate Hardware Resources:2 mins.
4GB of RAM / 2 CPUs for a smooth Kali Linux experience. 25 GB to 30 GB of Virtual Hard Disk space, dynamically allocated is fine for now.
4.Execute the Graphical Installation:10-15 mins.
Click Start on VirtualBox to boot up the Kali Linux installer. Follow the on-screen prompts to select the desired language, region, and keyboard configuration. Continue with the installer to specify the hostname for the test environment, add a non-root user account with a strong password, and finalize the rest of the Kali Linux installation.
5.Partition Disk and Finalize Setup:5 mins.
The installation will ask you how you wish to partition your disk, just select Guided partition method and then use entire disk. Proceed with the install, select the basic packages to install. Choose the software to install for the desktop, select the “desktop (XFCE)” option. The GRUB boot loader should be set to install to the primary drive.
Once the installation completes, make sure to reboot your Virtual Machine and logon with your newly created credentials. You should then be greeted with the Kali Linux XFCE Desktop.
Core Linux Commands Every Security Professional Must Know
As you start to learn Kali Linux, you will realize that the terminal command line interface (CLI) is where all real security work takes place. Most security tools are not provided with graphical user interface buttons and, as such, are specified at the terminal with required parameters.
Here are the primary commands for the navigation and management of learning Kali Linux:
1. Essential Directory & File Navigation
Bash
# Print working directory (shows where you currently are)
pwd
# List contents of a directory with detailed permissions and hidden files.
ls -la
# Change directory to target path
cd /var/www/html
# Return to your home directory
cd ~
2. File Creation, Inspection, and Editing
Bash
# Create a new directory for your lab notes
mkdir lab_reports
# Create an empty file
touch target_ips.txt
# Read the file in terminal (same as above command)
cat target_ips.txt
# Edit files directly in terminal using Nano
nano target_ips.txt
3. Essential Package Management & Updates
Upgrading your system on a regular basis will help to prevent security problems, as the most common issues are usually found in released packages and can be easily fixed by the developers to prevent bugs in security tools. These commands should be run from time to time to keep your system and applications up to date.
Bash
# Update the package index repository list
sudo apt update
# Upgrade all installed software packages to their latest versions
sudo apt upgrade -y
Practical Kali Linux Ethical Hacking Tutorial: Hands-On Tools
With your lab up and running, and having got to grips with the command line, it is time to move on to looking at the first of three security auditing tools that you can use for ethical hacking with Kali Linux. The tools are Nmap, Burp Suite, and the Metasploit Framework.
+---------------------------------------------------------------------------------+
| ETHICAL HACKING WORKFLOW PHASE |
+---------------------------------------------------------------------------------+
| 1. RECONNAISSANCE --> 2. AUDITING --> 3. EXPLOITATION |
| Network Mapping (Nmap) Web Testing (Burp Suite) Frameworks (Metasploit)|
+---------------------------------------------------------------------------------+
Nmap (Network Mapper) - The #1 tool for network discovery, port scanning and service identification.
# A Basic TCP port scan of the local loopback address.
nmap 127.0.0.1
# Perform an aggressive service version and OS detection scan
nmap -A -p 1-1000 192.168.1.50
This command will scan all ports (1-1000) on the given target IP address and list all open ports, services and possible operating system.
Tool 2: Web Traffic Interception with Burp Suite
Burp Suite - Web Traffic Interception: Burp Suite can function as an HTTP/HTTPS proxy server. In this capacity it sits between your browser and the web server for the target web site. All of the traffic to and from the web site can then be inspected, modified and even retransmitted as needed by the security tester.
# Launch Burp Suite Community Edition directly from terminal
burpsuite
Once the Burp Suite Community Edition application has been launched it can be accessed directly from within the terminal by changing directories to where the Burp Suite application was unpacked and then running the Burp Suite application as follows: burpsuite
Tool 3: Vulnerability Auditing with Metasploit Framework
The Metasploit Framework (MSF) is a vast database of known software vulnerabilities, auxiliary scanners, and exploit payloads.
# Start the Metasploit interactive console
msfconsole
# Search for a specific vulnerability scanner module
search portscan/tcp
# Select and configure a scanner module
use auxiliary/scanner/portscan/tcp
set RHOSTS 192.168.1.100
Metasploit automates testing for many known vulnerabilities that require to be patched in the software that a system is running. It performs a verification test to see if your target’s software is affected by known security issues.
Best Practices for Safe and Responsible Ethical
Best Practices for Safe and Responsible Ethical Hacking
With great power comes great responsibility. Running a machine full of penetration testing tools such as Kali Linux gives you immense power as a tester, but that power must be used for good in legal and ethical fashion.
Port scans, vulnerability scans and the exploitation of vulnerabilities must only be performed with written authorization, signed by the client (a Scope of Work agreement).
- Practice on Legal Platforms - Set up a lab of vulnerable virtual machines, such as Metasploitable, OWASP Juice Shop, etc., and practice with target practice platforms like TryHackMe and Hack The Box.
- Isolate Your Network: Only run target practice VMs on internal VirtualBox networks (i.e. Host-Only or Internal Network) and never allow them to broadcast on public networks.
Got Questions? Here Are Some FAQs
1. Is Kali Linux good for beginners?
Yes. Kali Linux is great for beginners as long as they are willing to go through all of the tools and learn the basis of Linux first. As I stated before, Kali Linux is geared more towards security professionals and ethical hackers. But the platform is very powerful and has a wide array of tools to complete tasks, and there are many tutorials to go through for each of the applications to start learning Linux from the command line to more in-depth network-related subjects.
2. Can Kali Linux be installed directly on Windows without VirtualBox?
Yes. WSL2 allows direct Kali Linux terminal access on Windows without the resource required by a virtual machine. The free Kali Linux terminal is available for download from the Microsoft Store.
3. Is it legal to use Kali Linux?
Yes. Kali Linux itself is 100% legal for download, installation, and use on your computer. Kali Linux is merely an operating system bundled with a number of diagnostic and audit tools. However, using the tools in Kali Linux to hack into systems that you do not own, or where you have not been given written permission to audit, is illegal under the computer misuse laws of most countries of the world.
4. How much RAM do I need to run Kali Linux smoothly?
For running Kali Linux with only terminal sessions, 2 GB of RAM would be sufficient for very light usage. However, with 4 GB to 8 GB of RAM, Kali Linux runs very smoothly, especially when you want to run graphical tools like Burp Suite or run multiple virtual machines.
5. What is the difference between Kali Linux and Ubuntu?
Kali Linux is a variant of Ubuntu that is specially designed to meet the requirements of security professionals. The distribution includes custom kernel drivers and a large collection of security test tools. There are many other security-focused distributions based on Ubuntu such as Parrot Security and Blackbuntu. In contrast, Ubuntu is designed to be a great daily-drive desktop distribution for office work, watching movies, listening to music, and general-purpose development work.
blog Links:
Do visit our channel to know more: SevenMentor
SevenMentor
Expert trainer and consultant at SevenMentor with years of industry experience. Passionate about sharing knowledge and empowering the next generation of tech leaders.