Cheatsheets

Kali Linux Security Tool Cheatsheet for Penetration Testing

by n8n admin

🛠 Security Tool Cheatsheet

Sarah Chen — SOC Analyst & Tool Specialist

What is Kali Linux?

Kali Linux is a Debian-based Linux distribution specifically geared towards penetration testing and security auditing. It comes pre-loaded with numerous security tools designed for various stages of the hacking process, making it a favorite among security professionals.

Installation

You can download Kali Linux from the official website and install it on a virtual machine or as a standalone OS. For most users, downloading the ISO image and using a tool like Rufus to create a bootable USB drive is recommended.

Basic Syntax

To run tools in Kali, the syntax typically follows:

COMMAND [options] [target]

Discovery

Nmap

Nmap is a powerful network scanning tool.

nmap -sS -p- target_ip

Explanation: -sS performs a SYN scan, and -p- scans all ports.

Netdiscover

This tool is used to discover live hosts on the network.

netdiscover -r 192.168.1.0/24

Scanning

OpenVAS

An open-source vulnerability scanner.

openvas-start

Use the web interface to configure scans.

Exploitation

Metasploit Framework

A comprehensive exploitation framework.

msfconsole

Start the console and load an exploit:

use exploit/windows/smb/ms17_010_eternalblue

Analysis

Wireshark

A tool for network protocol analysis.

wireshark

Allows real-time packet capture and analysis.

Evasion

Metasploit + Veil-Framework

An advanced tool for obfuscating payloads.

veil

Use the Veil toolkit to create payloads that evade AV detection.

Reporting

Dradis Framework

A tool for sharing information during a pen test.

dradis

Facilitates easy collaboration and report generation.

Quick Reference Table

Flag Description
-sS SYN scan
-p- All ports
openvas-start Start OpenVAS
msfconsole Start Metasploit

Pro Tips

  • Use nmap -O to detect OS versions.
  • Practice enum techniques with enum4linux for SMB shares.

Real-World Examples

Using Nmap for a stealth scan:

nmap -sS -Pn -p 1-65535 192.168.1.1

This command helps you scan an entire range of ports without pinging the target, ideal for stealth assessment.

Related Posts