Kali Linux Intermediate — Session 2

Overview

This session is a hands-on penetration testing course led by an experienced instructor, focusing on foundational security practices, Linux command-line navigation, reconnaissance techniques, and ethical reporting. The trainer emphasizes legal compliance, documentation, and research-driven problem-solving over memorization, guiding a learner through real-world pen testing steps—from system updates and IP discovery to network scanning, exploit execution via Metasploit, and structured report creation in OneNote. The content blends technical instruction with professional ethics, highlighting the importance of written permission, scope adherence, and meticulous note-taking.

Topic (Timeline)

1. Ethical Pen Testing Framework and Legal Foundations [00:00:00 - 00:04:51]

The instructor establishes the ethical and legal boundaries of penetration testing, correcting misconceptions about hacking and emphasizing professional responsibility.

• Penetration testing requires explicit written permission and defined scope; unauthorized access is illegal, regardless of intent.
• The role of a red team is fundamentally blue: their goal is to improve security through detailed reporting, not to brag about intrusions.
• Government and corporate systems are increasingly targeted; attackers exploit misconfigurations, not just zero-days, making defense-in-depth critical.
• Operating system security is not binary—both Windows and Linux are vulnerable, and attackers pivot between systems to bypass defenses.
• Publicly disclosed CVEs (e.g., in NNSA, iOS, and Linux VMs) demonstrate the need for continuous patching and proactive hardening.

2. Terminal Fundamentals and Linux Package Management [00:04:53 - 00:14:16]

The trainer introduces core Linux commands and package management, stressing research over rote memorization as the foundation of security work.

• sudo (superuser do) grants administrative privileges; apt (advanced package tool) manages software on Debian-based systems like Kali Linux.
• sudo apt update refreshes package lists; sudo apt upgrade -y applies updates non-interactively—both are mandatory before any pen test.
• Students are taught to use command-line navigation (Ctrl+A, Ctrl+E, arrow keys) and to always read terminal output for error context.
• Digital note-taking is prioritized over handwritten notes because automated tools and reports require timestamped, reproducible records.
• The instructor demonstrates that real pen testers build custom tools (e.g., in Python) rather than rely solely on commercial software.

3. Research Methodologies and Command Reference Systems [00:18:06 - 00:34:40]

The session shifts to teaching how to effectively research Linux commands and tools using multiple authoritative sources.

• Students are instructed to use Google, image/video results, and AI tools (e.g., ChatGPT) to find command syntax, but must verify with official documentation.
• The tldr command provides concise, community-maintained summaries of complex commands, serving as a faster alternative to man pages.
• man (manual) pages offer exhaustive details; apropos helps discover commands by keyword (e.g., apropos dir).
• Different Linux distributions use different package managers: APT (Debian/Kali), DNF (RHEL/Fedora), Pacman (Arch)—understanding the distro is essential.
• The instructor models how to copy and save research findings into digital notebooks for future reference and report generation.

4. System Navigation, User Privileges, and Directory Management [00:34:40 - 00:50:16]

The trainer guides the learner through Linux file system navigation, user context, and privilege escalation concepts.

• pwd shows current directory; ls lists contents; cd .. moves up a level; cd / reaches the root directory.
• whoami reveals the current user (e.g., “student”); hostname shows the system name (e.g., “Kali”).
• mkdir fails without sudo in protected directories; sudo mkdir resolves permission issues.
• rmdir removes empty directories; rm -r removes non-empty ones, but requires caution and sudo.
• The learner creates a directory named basic_pen_testing and uses tab auto-completion to navigate into it, reinforcing efficiency in the terminal.
• The instructor introduces VirtualBox as a tool for managing test environments, setting the stage for network-based testing.

5. Network Reconnaissance and Target Discovery [00:50:16 - 01:31:43]

The learner performs active reconnaissance to identify a target system on a local network using two complementary tools.

• ip a reveals the local machine’s IP (10.0.3.15); the target must be discovered via network scanning.
• sudo netdiscover and sudo arp-scan -l are used in parallel to find live hosts; MAC addresses starting with 08:00 identify VMs.
• The target IP (10.0.3.16) is confirmed by matching it to VirtualBox’s network settings.
• Passive reconnaissance (e.g., Google, social media) is contrasted with active scanning, which requires legal authorization to avoid crossing into illegal activity.
• The instructor stresses mastery of 2–3 tools per phase rather than tool overload, emphasizing depth over breadth.

6. Port Scanning, Service Enumeration, and Exploitation with Metasploit [01:31:44 - 02:41:32]

The learner conducts a full vulnerability scan and successfully exploits a service to gain root access.

• nmap 10.0.3.16 identifies open ports: 21 (FTP), 22 (SSH), 80 (HTTP); nmap -A reveals OS (Ubuntu) and service versions (Apache 2.4.18).
• Default web pages are flagged as vulnerabilities; results are saved to a text file (nmap -A > bp_nmap_scan.txt) for documentation.
• Anonymous FTP login fails; a known exploit (ProFTPD 1.3.3c) is found via search exploit proftpd 1.3.3c.
• Metasploit (msfconsole) is launched: the exploit module is selected, RHOST is set to the target, and a Unix reverse shell payload is configured with LHOST.
• Exploit succeeds—session opens as root; whoami and id confirm elevated privileges; /root directory is accessed, revealing sensitive files.
• Every step is to be screenshot and documented for the final report.

7. Report Documentation and Professional Accountability [02:41:32 - 03:07:31]

The instructor mandates structured, professional report writing as a non-negotiable component of ethical pen testing.

• Reports must include: Project name, date, commands used, screenshots of outputs, analysis, and lessons learned.
• OneNote is introduced as the preferred tool for documentation due to its sync, share, and screenshot capabilities.
• The learner is guided to create a template with tabs: Project, Commands, Screenshots, Analysis, Lessons Learned.
• Written permission and scope are explicitly added as first-line items in the report, reinforcing legal compliance.
• The instructor shares that his own reports are meticulously detailed because accountability prevents legal liability and ensures payment.

8. Professional Ethics, Insurance, and Operational Discipline [02:45:15 - 03:20:45]

The session concludes with a strong emphasis on professional conduct, risk mitigation, and operational hygiene.

• Liability insurance is mandatory for professional pen testers; lack of it exposes individuals to prosecution even with good intent.
• Never exceed written scope—if an IP is found outside it, report it immediately; treat it as trespassing, not opportunity.
• Documentation is not optional—it is the difference between being paid and being prosecuted.
• The instructor shares that he was recently offered a Deputy CISO role, underscoring the value of disciplined, well-documented work.
• Personal anecdotes (e.g., music, food) are included only to humanize the trainer, not to distract from core professional principles.

Appendix

Key Concepts

• Penetration testing is a legally authorized, documented process to improve security—not to demonstrate hacking skill.
• Defense-in-depth is critical; no single OS is immune to attack.
• Research (Google, man pages, tldr, AI) is the primary skill for a pen tester, not memorization.
• Root access and data exfiltration are the goals of exploitation; documentation of every step is mandatory.
• Active reconnaissance (scanning) requires explicit permission; passive reconnaissance is safer and often sufficient for initial intelligence.

Tools & Commands

• sudo apt update && sudo apt upgrade -y — System package management
• ip a — Display network interfaces and IPs
• sudo netdiscover — Network host discovery
• sudo arp-scan -l — Local network ARP scanning
• nmap 10.0.3.16 — Port scanning
• nmap -A 10.0.3.16 — Aggressive scan with OS/service detection
• ftp 10.0.3.16 — FTP connection testing
• msfconsole — Metasploit Framework console
• use exploit/... — Select exploit module
• set RHOSTS, set LHOST — Configure target and listener
• exploit — Execute the payload
• whoami, id — Verify privilege level
• tldr <command> — Concise command reference
• man <command> — Full manual page
• apropos <keyword> — Search commands by description
• mkdir, rmdir, cd, pwd, ls — File system navigation
• history — View command history
• OneNote — Digital report documentation tool