homelab/docs/05-kali.md

# Chapter 5 - Kali Linux Attack Workstation

> Kali Linux serves as the primary attack platform for the cyber range. This chapter covers installing, configuring, and organizing Kali into a professional penetration testing workstation.

---

# Objectives

After completing this chapter you will have:

* Kali Linux installed
* Static networking configured
* SSH configured
* A professional directory structure
* Essential offensive security tools installed
* Wordlists organized
* Python virtual environments configured
* Go tools installed
* Notes synchronized
* Snapshots created

---

# Virtual Machine Specifications

| Setting |    Value |
| ------- | -------: |
| CPU     | 2-4 vCPU |
| RAM     |   4-8 GB |
| Disk    |    80 GB |
| Bridge  |    vmbr1 |
| BIOS    |     UEFI |
| Machine |      q35 |

---

# Network Configuration

Static IP:

```text
Hostname : kali

IP Address : 10.10.10.10
Subnet Mask : 255.255.255.0
Gateway : 10.10.10.1
DNS : 10.10.20.10
```

The gateway points to pfSense while DNS points to the Domain Controller after Active Directory has been deployed.

Verify:

```bash
ip addr
```

```bash
ip route
```

```bash
ping 10.10.10.1
```

```bash
ping 10.10.20.10
```

```bash
ping google.com
```

---

# Update Kali

```bash
sudo apt update
sudo apt full-upgrade -y
sudo apt autoremove -y
```

Reboot afterwards.

---

# Create Your Workspace

Create a dedicated directory for all assessments.

```bash
mkdir -p ~/Labs
```

```text
~/Labs
├── Active
├── Archive
├── Loot
├── Notes
├── Reports
├── Scans
├── Scripts
├── Tools
├── Wordlists
└── Screenshots
```

Each assessment gets its own folder.

Example:

```text
~/Labs/Active/DC01
```

---

# Install Essential Packages

```bash
sudo apt install \
git \
curl \
wget \
vim \
tmux \
jq \
ripgrep \
netcat-openbsd \
python3-pip \
python3-venv \
golang-go \
feroxbuster \
gobuster \
ffuf \
seclists \
impacket-scripts \
bloodhound \
crackmapexec \
evil-winrm \
enum4linux-ng \
hashcat \
john \
rlwrap
```

Some package names may vary slightly depending on the Kali release.

---

# Install Go Tools

Create a Go workspace.

```bash
mkdir -p ~/go
```

Add to your shell configuration:

```bash
export GOPATH=$HOME/go
export PATH=$PATH:$GOPATH/bin
```

Useful tools include:

* Ligolo-ng
* Chisel
* Kerbrute
* Naabu
* Httpx
* Katana
* Notify

Install them with:

```bash
go install <package>@latest
```

---

# Python Virtual Environments

Avoid installing Python packages globally.

Example:

```bash
python3 -m venv ~/venvs/tools
```

Activate:

```bash
source ~/venvs/tools/bin/activate
```

---

# Git Repositories

Clone frequently used projects.

```text
~/Labs/Tools
├── PEASS-ng
├── SecLists
├── LinEnum
├── Linux Exploit Suggester
├── PowerSploit
├── Nishang
├── Ligolo-ng
├── Chisel
└── Sherlock
```

Keep these updated regularly.

---

# Wordlists

Organize custom wordlists.

```text
Wordlists
├── DNS
├── Passwords
├── Usernames
├── Directories
├── API
└── Custom
```

Store any generated usernames or discovered passwords separately from the default SecLists.

---

# SSH Configuration

Generate a keypair.

```bash
ssh-keygen -t ed25519
```

Test:

```bash
ssh localhost
```

If you plan to administer your servers from Kali, copy your public key to them.

---

# Tmux

Create a repeatable workspace.

Example layout:

```text
+----------------------+
| nmap                 |
+----------+-----------+
| shell    | notes     |
+----------+-----------+
```

Suggested windows:

1. Enumeration
2. Web
3. Shells
4. Notes
5. Packet captures

---

# Browser

Install:

* Firefox
* Burp Suite Community
* FoxyProxy extension

Configure Burp as the browser proxy.

---

# Screenshots

Create a dedicated folder.

```text
~/Labs/Screenshots
```

Use descriptive filenames.

Example:

```text
01-nmap.png

02-smb.png

03-shell.png
```

---

# Notes

Document everything.

Suggested structure:

```text
Notes
├── Enumeration.md
├── Credentials.md
├── Findings.md
├── PrivEsc.md
└── Timeline.md
```

These notes will later be copied into Wiki.js.

---

# Aliases

Useful aliases:

```bash
alias ll="ls -lah"
alias ports="ss -tulpn"
alias myip="ip addr"
alias cls="clear"
```

Customize this over time as your workflow evolves.

---

# Snapshots

Create snapshots after:

```text
FRESH_INSTALL

FULLY_UPDATED

TOOLS_INSTALLED

READY_FOR_ATTACK
```

This allows you to roll back after experimenting with new tools.

---

# Validation Checklist

Before continuing:

* [ ] Static IP configured
* [ ] Internet access verified
* [ ] DNS working
* [ ] Kali fully updated
* [ ] Workspace directories created
* [ ] Offensive tools installed
* [ ] Wordlists organized
* [ ] SSH keys generated
* [ ] tmux configured
* [ ] Browser configured for Burp Suite
* [ ] Snapshot created

---

# Recommended Daily Workflow

For each new target:

1. Create a new folder in `~/Labs/Active`.
2. Start a tmux session.
3. Begin note-taking immediately.
4. Save all scan results.
5. Capture screenshots as you go.
6. Record credentials and hashes in your notes.
7. Write a short summary before moving to the next target.
8. Transfer your final notes into Wiki.js.

Following the same workflow every time helps build discipline and makes it much easier to write professional reports later.

---

# Next Chapter

The next chapter covers building the vulnerable machines that populate the enterprise network.

You'll deploy:

* Windows 10 workstations
* Windows file server
* SQL Server
* Ubuntu Linux target
* Web server
* Intentionally vulnerable configurations
* Snapshot strategy for repeatable practice