created instruction files for my home OSCP labs

docs/05-kali.md

@@ -0,0 +1,419 @@
+# Chapter 5 - Kali Linux Attack Workstation
+
+> Kali Linux serves as the primary attack platform for the cyber range. This chapter covers installing, configuring, and organizing Kali into a professional penetration testing workstation.
+
+---
+
+# Objectives
+
+After completing this chapter you will have:
+
+* Kali Linux installed
+* Static networking configured
+* SSH configured
+* A professional directory structure
+* Essential offensive security tools installed
+* Wordlists organized
+* Python virtual environments configured
+* Go tools installed
+* Notes synchronized
+* Snapshots created
+
+---
+
+# Virtual Machine Specifications
+
+| Setting |    Value |
+| ------- | -------: |
+| CPU     | 2-4 vCPU |
+| RAM     |   4-8 GB |
+| Disk    |    80 GB |
+| Bridge  |    vmbr1 |
+| BIOS    |     UEFI |
+| Machine |      q35 |
+
+---
+
+# Network Configuration
+
+Static IP:
+
+```text
+Hostname : kali
+
+IP Address : 10.10.10.10
+Subnet Mask : 255.255.255.0
+Gateway : 10.10.10.1
+DNS : 10.10.20.10
+```
+
+The gateway points to pfSense while DNS points to the Domain Controller after Active Directory has been deployed.
+
+Verify:
+
+```bash
+ip addr
+```
+
+```bash
+ip route
+```
+
+```bash
+ping 10.10.10.1
+```
+
+```bash
+ping 10.10.20.10
+```
+
+```bash
+ping google.com
+```
+
+---
+
+# Update Kali
+
+```bash
+sudo apt update
+sudo apt full-upgrade -y
+sudo apt autoremove -y
+```
+
+Reboot afterwards.
+
+---
+
+# Create Your Workspace
+
+Create a dedicated directory for all assessments.
+
+```bash
+mkdir -p ~/Labs
+```
+
+```text
+~/Labs
+├── Active
+├── Archive
+├── Loot
+├── Notes
+├── Reports
+├── Scans
+├── Scripts
+├── Tools
+├── Wordlists
+└── Screenshots
+```
+
+Each assessment gets its own folder.
+
+Example:
+
+```text
+~/Labs/Active/DC01
+```
+
+---
+
+# Install Essential Packages
+
+```bash
+sudo apt install \
+git \
+curl \
+wget \
+vim \
+tmux \
+jq \
+ripgrep \
+netcat-openbsd \
+python3-pip \
+python3-venv \
+golang-go \
+feroxbuster \
+gobuster \
+ffuf \
+seclists \
+impacket-scripts \
+bloodhound \
+crackmapexec \
+evil-winrm \
+enum4linux-ng \
+hashcat \
+john \
+rlwrap
+```
+
+Some package names may vary slightly depending on the Kali release.
+
+---
+
+# Install Go Tools
+
+Create a Go workspace.
+
+```bash
+mkdir -p ~/go
+```
+
+Add to your shell configuration:
+
+```bash
+export GOPATH=$HOME/go
+export PATH=$PATH:$GOPATH/bin
+```
+
+Useful tools include:
+
+* Ligolo-ng
+* Chisel
+* Kerbrute
+* Naabu
+* Httpx
+* Katana
+* Notify
+
+Install them with:
+
+```bash
+go install <package>@latest
+```
+
+---
+
+# Python Virtual Environments
+
+Avoid installing Python packages globally.
+
+Example:
+
+```bash
+python3 -m venv ~/venvs/tools
+```
+
+Activate:
+
+```bash
+source ~/venvs/tools/bin/activate
+```
+
+---
+
+# Git Repositories
+
+Clone frequently used projects.
+
+```text
+~/Labs/Tools
+├── PEASS-ng
+├── SecLists
+├── LinEnum
+├── Linux Exploit Suggester
+├── PowerSploit
+├── Nishang
+├── Ligolo-ng
+├── Chisel
+└── Sherlock
+```
+
+Keep these updated regularly.
+
+---
+
+# Wordlists
+
+Organize custom wordlists.
+
+```text
+Wordlists
+├── DNS
+├── Passwords
+├── Usernames
+├── Directories
+├── API
+└── Custom
+```
+
+Store any generated usernames or discovered passwords separately from the default SecLists.
+
+---
+
+# SSH Configuration
+
+Generate a keypair.
+
+```bash
+ssh-keygen -t ed25519
+```
+
+Test:
+
+```bash
+ssh localhost
+```
+
+If you plan to administer your servers from Kali, copy your public key to them.
+
+---
+
+# Tmux
+
+Create a repeatable workspace.
+
+Example layout:
+
+```text
++----------------------+
+| nmap                 |
++----------+-----------+
+| shell    | notes     |
++----------+-----------+
+```
+
+Suggested windows:
+
+1. Enumeration
+2. Web
+3. Shells
+4. Notes
+5. Packet captures
+
+---
+
+# Browser
+
+Install:
+
+* Firefox
+* Burp Suite Community
+* FoxyProxy extension
+
+Configure Burp as the browser proxy.
+
+---
+
+# Screenshots
+
+Create a dedicated folder.
+
+```text
+~/Labs/Screenshots
+```
+
+Use descriptive filenames.
+
+Example:
+
+```text
+01-nmap.png
+
+02-smb.png
+
+03-shell.png
+```
+
+---
+
+# Notes
+
+Document everything.
+
+Suggested structure:
+
+```text
+Notes
+├── Enumeration.md
+├── Credentials.md
+├── Findings.md
+├── PrivEsc.md
+└── Timeline.md
+```
+
+These notes will later be copied into Wiki.js.
+
+---
+
+# Aliases
+
+Useful aliases:
+
+```bash
+alias ll="ls -lah"
+alias ports="ss -tulpn"
+alias myip="ip addr"
+alias cls="clear"
+```
+
+Customize this over time as your workflow evolves.
+
+---
+
+# Snapshots
+
+Create snapshots after:
+
+```text
+FRESH_INSTALL
+
+FULLY_UPDATED
+
+TOOLS_INSTALLED
+
+READY_FOR_ATTACK
+```
+
+This allows you to roll back after experimenting with new tools.
+
+---
+
+# Validation Checklist
+
+Before continuing:
+
+* [ ] Static IP configured
+* [ ] Internet access verified
+* [ ] DNS working
+* [ ] Kali fully updated
+* [ ] Workspace directories created
+* [ ] Offensive tools installed
+* [ ] Wordlists organized
+* [ ] SSH keys generated
+* [ ] tmux configured
+* [ ] Browser configured for Burp Suite
+* [ ] Snapshot created
+
+---
+
+# Recommended Daily Workflow
+
+For each new target:
+
+1. Create a new folder in `~/Labs/Active`.
+2. Start a tmux session.
+3. Begin note-taking immediately.
+4. Save all scan results.
+5. Capture screenshots as you go.
+6. Record credentials and hashes in your notes.
+7. Write a short summary before moving to the next target.
+8. Transfer your final notes into Wiki.js.
+
+Following the same workflow every time helps build discipline and makes it much easier to write professional reports later.
+
+---
+
+# Next Chapter
+
+The next chapter covers building the vulnerable machines that populate the enterprise network.
+
+You'll deploy:
+
+* Windows 10 workstations
+* Windows file server
+* SQL Server
+* Ubuntu Linux target
+* Web server
+* Intentionally vulnerable configurations
+* Snapshot strategy for repeatable practice
+