homelab/docs/05-kali.md

Chapter 5 - Kali Linux Attack Workstation

Kali Linux serves as the primary attack platform for the cyber range. This chapter covers installing, configuring, and organizing Kali into a professional penetration testing workstation.

---

Objectives

After completing this chapter you will have:

• Kali Linux installed
• Static networking configured
• SSH configured
• A professional directory structure
• Essential offensive security tools installed
• Wordlists organized
• Python virtual environments configured
• Go tools installed
• Notes synchronized
• Snapshots created

---

Virtual Machine Specifications

Setting	Value
CPU	2-4 vCPU
RAM	4-8 GB
Disk	80 GB
Bridge	vmbr1
BIOS	UEFI
Machine	q35

---

Network Configuration

Static IP:

Hostname : kali

IP Address : 10.10.10.10
Subnet Mask : 255.255.255.0
Gateway : 10.10.10.1
DNS : 10.10.20.10

The gateway points to pfSense while DNS points to the Domain Controller after Active Directory has been deployed.

Verify:

ip addr

ip route

ping 10.10.10.1

ping 10.10.20.10

ping google.com

---

Update Kali

sudo apt update
sudo apt full-upgrade -y
sudo apt autoremove -y

Reboot afterwards.

---

Create Your Workspace

Create a dedicated directory for all assessments.

mkdir -p ~/Labs

~/Labs
├── Active
├── Archive
├── Loot
├── Notes
├── Reports
├── Scans
├── Scripts
├── Tools
├── Wordlists
└── Screenshots

Each assessment gets its own folder.

Example:

~/Labs/Active/DC01

---

Install Essential Packages

sudo apt install \
git \
curl \
wget \
vim \
tmux \
jq \
ripgrep \
netcat-openbsd \
python3-pip \
python3-venv \
golang-go \
feroxbuster \
gobuster \
ffuf \
seclists \
impacket-scripts \
bloodhound \
crackmapexec \
evil-winrm \
enum4linux-ng \
hashcat \
john \
rlwrap

Some package names may vary slightly depending on the Kali release.

---

Install Go Tools

Create a Go workspace.

mkdir -p ~/go

Add to your shell configuration:

export GOPATH=$HOME/go
export PATH=$PATH:$GOPATH/bin

Useful tools include:

• Ligolo-ng
• Chisel
• Kerbrute
• Naabu
• Httpx
• Katana
• Notify

Install them with:

go install <package>@latest

---

Python Virtual Environments

Avoid installing Python packages globally.

Example:

python3 -m venv ~/venvs/tools

Activate:

source ~/venvs/tools/bin/activate

---

Git Repositories

Clone frequently used projects.

~/Labs/Tools
├── PEASS-ng
├── SecLists
├── LinEnum
├── Linux Exploit Suggester
├── PowerSploit
├── Nishang
├── Ligolo-ng
├── Chisel
└── Sherlock

Keep these updated regularly.

---

Wordlists

Organize custom wordlists.

Wordlists
├── DNS
├── Passwords
├── Usernames
├── Directories
├── API
└── Custom

Store any generated usernames or discovered passwords separately from the default SecLists.

---

SSH Configuration

Generate a keypair.

ssh-keygen -t ed25519

Test:

ssh localhost

If you plan to administer your servers from Kali, copy your public key to them.

---

Tmux

Create a repeatable workspace.

Example layout:

+----------------------+
| nmap                 |
+----------+-----------+
| shell    | notes     |
+----------+-----------+

Suggested windows:

1. Enumeration
2. Web
3. Shells
4. Notes
5. Packet captures

---

Browser

Install:

• Firefox
• Burp Suite Community
• FoxyProxy extension

Configure Burp as the browser proxy.

---

Screenshots

Create a dedicated folder.

~/Labs/Screenshots

Use descriptive filenames.

Example:

01-nmap.png

02-smb.png

03-shell.png

---

Notes

Document everything.

Suggested structure:

Notes
├── Enumeration.md
├── Credentials.md
├── Findings.md
├── PrivEsc.md
└── Timeline.md

These notes will later be copied into Wiki.js.

---

Aliases

Useful aliases:

alias ll="ls -lah"
alias ports="ss -tulpn"
alias myip="ip addr"
alias cls="clear"

Customize this over time as your workflow evolves.

---

Snapshots

Create snapshots after:

FRESH_INSTALL

FULLY_UPDATED

TOOLS_INSTALLED

READY_FOR_ATTACK

This allows you to roll back after experimenting with new tools.

---

Validation Checklist

Before continuing:

• Static IP configured
• Internet access verified
• DNS working
• Kali fully updated
• Workspace directories created
• Offensive tools installed
• Wordlists organized
• SSH keys generated
• tmux configured
• Browser configured for Burp Suite
• Snapshot created

---

Recommended Daily Workflow

For each new target:

1. Create a new folder in ~/Labs/Active.
2. Start a tmux session.
3. Begin note-taking immediately.
4. Save all scan results.
5. Capture screenshots as you go.
6. Record credentials and hashes in your notes.
7. Write a short summary before moving to the next target.
8. Transfer your final notes into Wiki.js.

Following the same workflow every time helps build discipline and makes it much easier to write professional reports later.

---

Next Chapter

The next chapter covers building the vulnerable machines that populate the enterprise network.

You'll deploy:

• Windows 10 workstations
• Windows file server
• SQL Server
• Ubuntu Linux target
• Web server
• Intentionally vulnerable configurations
• Snapshot strategy for repeatable practice