Kali Linux Tutorial 2023 | Kali Linux Explained | Kali Linux for Beginners | Simplilearn

hey everyone it's no secret that the majority of our internet usage set the risk of being hacked be it via unsafe messaging applications or misconfigured operating systems to counteract this void of digital security penetration testing has become the knob when it comes to vulnerability assessment Kali Linux is an operating system that has become a well-known weapon in this fight against hackers a Linux distribution that is made specifically for penetration testers Kali Linux has layers of features that we will be covering in today's lesson let's take a look at the topics to be covered in this video we start by learning about Kali Linux and a basic explanation of its purpose we take a look at the history of Kali Linux from the story of its origin to its current day exploits next we learn a few distinct features of Kali that make it an attractive choice for penetration testers worldwide finally we take a look at the multiple ways we can install Kali Linux to start a journey in the world of penetration testing let's start by learning about Kali Linux in general Kali Linux which is formerly known as backtrack Linux is an open source Linux distribution aimed at Advanced penetration testing and security auditing it contains several hundred tools that are targeted towards various information security tasks such as penetration testing security research computer forensics and reverse engineering column Linux is a multiple platform solution accessible and freely available to Information Security Professionals and hobbyists among all the Linux distributions Kylie Linux takes its routes from the Debian operating system Debian has been a highly dependable and stable distribution for many years providing a similarly strong Foundation to the Kali desktop while the operating system is capable of practically modifying every single part of our installation the networking components of Kali become disabled by default this is done to prevent any external factors from affecting the installation procedure which may pose a risk in critical environments apart from boosting security it allows the deeper element of control to the most enthusiastic of users we did not get Kali Linux since the first day how did it come into existence let's take a look at some of its history Linux is based on years of knowledge and experience in building penetration testing and operating systems during all these project lifelines there have been only a few different developers as the team has always been small the first project was called wapix which stands for white hat knopex as can be inferred from the name it was based on the nopex operating system as its underlying OS Opex had releases ranging from version 2.0 to 2.7 this made way for the next project which was known as wax or the long hand being white hat slacks the name change was because the base OS was changed from nopics to slacks wax started at version 3 as a Nord at carrying on from mop X there was a similar OS being produced at the same time auditor security collection often being shorted to just auditor which was once again using nopics its efforts were combined with wax to produce backtrack backtrack was based on slackware from version 1 to version 3 but switched to Ubuntu later on with version 4 to version 5. using the experience gained from all of this Kal Linux came after backtrack in 2013. Kali started off using Debian stable as the engine under the hood before moving to Debian testing when Kali Linux became a rolling operating system now that we understand the history and the purpose of Kali Linux let us learn a little more about its distinct features the latest version of Kali comes with more than 600 penetration tools pre-installed after reviewing every tool that was included in backtrack developers have eliminated a great number of tools that either simply did not work or which duplicated other tools that provided the same or similar functionality the Kali Linux team is made up of a small group of individuals who are the only ones trusted to commit packages and interact with the repositories all of which is done using multiple secure protocols restricting access of critical code bases to external asset greatly reduces the risk of source contamination which can cause Kali Linux users worldwide a great deal of damage as a direct victim of cybercrime although penetration tools tend to be written in English the developers have ensured that Kali includes true multilingual support allowing more users to operate in their native language and locate the tools they need for the job the more comfortable a user feels with the intricacies of the operating system the easier it is to maintain a stronghold over the configuration and the device in general since arm-based single board systems like the Raspberry Pi are becoming more and more prevalent and inexpensive the development team knew that kali's arm support would need to be as robust as they could manage with fully working installations Linux is available on a wide range of arm devices and has arm repositories integrated with the mainland distributions so the tools for arm are updated in conjunction with the rest of the distribution all this information is necessary for users to determine if Kali Linux is the correct choice for them if it is what are the ways that they can go forward with this installation and start their penetration testing Journey the first way to use Kali Linux is by launching the distribution in the live USB mode this can be achieved by downloading the installer image file or the ISO file from the Kalin Linux website and flashing it to a USB drive with a capacity of at least 8 GB some people don't need to save their data permanently and a live USB is the perfect solution for such cases after the iso image is flashed the thumb drive can be used to boot a fully working installation of the operating system with the caviar that any changes made to the OS in this mode are not written permanently some cases allow persistent usage in live USBS but those require further configuration than normal situations but what if the user wants to store data permanently in the installed OS the best and the most reliable way to ensure this is the full-fledged hardness installation this will ensure the complete usage of the system's Hardware capabilities and will take into account the updates and the configurations being made to the OS this method is supposed to override any pre-existing operating system installed on the computer be it windows or any other variant of Linux the next alternative route for installing Kali Linux would be to use virtualization software such as VMware or virtualbox the software will be installed as a separate application on an already existing OS and Kali Linux can be run as an operating system in the same computer as a window the hardware requirements will be completely customizable starting with the allotted Ram to the virtual hard disk capacity the usage of both a host and guest operating system like car Linux allows users a safe environment to learn while not putting the systems at risk if you want to learn more about how one can go forward with this method we have a dedicated video where Kali Linux is being installed on VMware while running on a Windows 10 operating system you can find the link in the description box to get started with your very own virtual machine the final way to install Kali Linux is by using a dual boot system to put it in simple words the Kali Linux OS will not be overrating any pre-installed operating system on a machine but will be installed alongside it when a computer boots up the user will get a choice to boot into either of these operating systems many people prefer to keep both the windows and Kali Linux installed so the distribution of work and recreational activities is also allotted effectively it gives users a safety valve should their custom Linux installation run into any bugs that cannot be fixed from within the operating system there are multiple ways to install color Linux we can either install it on a normal hard drive in a virtual machine software such as VMware or virtualbox or we can do that in hardware metal machines now for the convenience of explanation we're going to install Kali Linux today on a virtual machine software known as VMware VMware is able to run multiple operating systems on a single host machine which in our case is a Windows 10 system to get started with Kali Linux installation we have to go to the website to download an image file we go to get Kali and as you can see there are multiple platforms on which this operating system can be inverted as per our requirement we're going to go with the virtual machine section as you can see it is already recommended by the Developers this is the download button which will download a 64-bit ISO file we can download 32-bit but that is more necessary for hard metal machines or if you're going to use it for older devices which do not support 64-bit operating systems yet after clicking on the download button we can see we have a WinRAR archive which will have the ISO files for now we have downloaded the ISO file and it is already present with me so we can start working on the VMS side of things once the ISO file is downloaded we open up VMware Workstation go to file and we create a new virtual machine in these two options it is highly recommended to go with the typical setup rather than the custom one the custom is much more advanced and requires much more information from the user which is beneficial for developers and people who are well versed with virtualization software but from 90 of the cases typical setup will be enough here we can select the third option which will be I will install the operating system later and some operating systems we can use the ISO file here directly and VMware will install it for us but for right now in the case of Kali Linux the third option is always the safest color Linux is a Linux distribution so we can select Linux over here and the version as you can see here it have multiple versions such as the multiple kernels every distribution has of a parent distribution for example color Linux has Debian and there are other distributions which are based or forked from some parent distribution colleges is based off Debian so we can go with the highest version of Debian which is the Debian 10.x 64-bit go on next we can write any such name we can write Kali Linux so that it will be easier to recognize the virtual machine among this list of virtual machine instances the location can be any location you decide to put by default it should be the documents folder but anywhere you put it will hold up all the information rig of the operating system all the files you download all the configurations you store everything will be stored in this particular location that you provide when we go next we are asked about the disk capacity this disk capacity will be all the storage that will be provided to your virtual machine of Cal Linux think of your Windows device if you have a one terabyte of hard drive you have the entirety of the hard disk to store data on how much data you give here you can only store up to that amount of data not to mention some amount of capacity will be taken up by the operating system itself to store its programs and applications for now we can give around let's say 15 GB of information or if it's recommended size for Debian is 20 you can just go ahead at 20. it depends all on the user case if you are going to use it extensively you can even go as high as 50 or 60 GB if you have plans to download many more applications and perform multiple different tests another option we get over here is storing virtual disks as a single file or storing them into multiple files as we already know this virtual machine run entirely on VMware sometimes when transferring these virtual machine instances let's say from a personal computer to a work computer you're going to need to copy up the entire folder that we had mentioned before over here instead all virtual machines have a portability feature now this portability feature is possible for all scenarios except it is much easier if the split the virtual disk into multiple files now even if this makes importing virtual machines easier from either system to system or software to software let's say if you want to switch from VMware to virtualbox or vice versa the performance takes a small hit it's not huge but it's recommended to go with storing the virtual disk as a single file if you have no purposes of ever moving the virtual machine even if you do it's not a complete stop that it cannot be ported it's just easier when using multiple files but in order to get the best performance out of the virtual machine we can store it as a single file over here this is a summary of all the changes that we made and all the configurations that have been settled until now now at this point of time we have not provided the dot ISO file yet which is the installation file for the Kali Linux that we downloaded from this website as of right now we have only configured the settings of the virtual machine so we can press on finish and we have Kali Linux in the list now to make the changes further we press on edit virtual machine settings the memory is supposed to give the ram of the virtual machine the devices with ram of 8 GB odds below that giving high amount of ram will cause performance issues and the host system if the memory has some amount of free storage left let's say on idle storage my Windows machine takes about 2GB so I have 6 GB of memory to provide although if you provide all of the 6gb it will be much more difficult for the host system to run everything properly so for this instance we can keep it as 2GB of memory for the virtual machine instance similarly we can use the number of processors and we can customize it according to our liking let's say if you want to use One processor but we want to use two different cores we can select them as well hard disk is pre-set up as the SCSI hard disk and it does not need to be changed for the installation of this operating system at all cdid DVD this is where the installation file comes you can think of the ISO file that we downloaded as a pen drive or a USB thumb drive which is necessary to install an operating system to provide this we're going to select use ISO image file we're going to click on browse go on go to downloads and select the Im so file over here select open and you can see it is already loaded up next in the network adapter it is recommended to use Nat this helps the virtual machine to draw the internet from the host machine settings if your host machine is connected to the internet then the virtual machine is connected as well there are some other options such as host only or custom segments or Lan segments but those are not necessary for installation rest of them are pretty standard which do not need any extra configuration and can be left as it is press OK and now we can power on this virtual machine in this screen we can choose how we want to proceed with the installation we have a start installer option over here so we're going to press enter on that we're going to wait for the things to load from the ISO file the first step in the installation is choosing the language of the operating system for this we can go with English as standard this is a location this will be used for setting up the time and some of the internal settings which depend entirely on the location of the user so for this we're going to go with India configuring the keyboard it's always recommended to go with the American English first many people make a mistake of going with the Indian keyboard if it is possible and it provides a lot of issues later on so it's always prefer to go with the American English and if later we see some necessity of another keyboard dialect adaptiveness required we can install it later but for now we should always stick with American English as a basic at this point it's going to load the installation components from the dot ISO file it is a big file of 3.6 GB so it has a lot of components that need to be put into the virtual machine which can also be used to detect Hardware once the hardware and the network configuration is done by the ISO file we want to write a hostname for the system this hostname can be anything which is used to recognize this device on a local network or a lan cable let's say if we use the name Kali domain name you we can skip it for now it's not necessary as such for the installation this is the full name for the user let's say we can provide the name as simply learn as a full name next you're going to set up a username this username is going to be necessary to identify the user from its use root accounts and the subsequent below accounts for now we can give it as something as simply one two three now we have to choose a password for the user now remember since this is the first user that is being added onto this newly installed operating system it needs to be a password for the administrator we can use whichever password we like over here and use the same password below and press on continue at this point it's going to detect on the components on which the operating system can be installed like here there are multiple options like the use entire disk use entire disk and setup lvm this entire disc concept of encrypted lvm for newcomers it is recommended to just use the first one since lvm encryption is something that we can learn afterwards when you are much more Hands-On with the Linux operating system for now we're going to use the use entire disk guided installation and press on continue when we set up the virtual machine on VMware we had set up a disk capacity there we gave our preposter 20 GB that is the hardest which is being discovered here even though it is a virtual disk on VMware it acts as a normal hard disk on which an operating system can be installed so we select this one and press on continue here there is a multiple partition system all the operating systems that are installed have different components one is used for the keeping of the applications one for the files other for the RAM management and other things for newcomers it is always recommended to keep it in one partition and we're going to select that and press on continue this is just an overview of the partition it's going to make as you can see it has a primary partition of 20.4 GB and a logical partition of 1GB used for swap memory now these kind of naming can be confusing for people who are not well versed with Linux operating systems or in general virtualization but for now you can go ahead and press on continue as this will be fine we can press on finish partitioning and write changes to disk and continue it's just a confirmation page as you can see it showed that SCSI 3 is our virtual hard disk of 20 GB disk capacity we write the changes to the disk we press yes and click on continue at this point the installation has started now this installation will take a while depending on the num amount of ram provided the processors provided and how quickly the performance of the system is being hampered by the host machine on quicker systems this will be rather quick while on the smaller ones this will take a while since this is going to take some time to install as it is being run on a virtual machine with only 2GB of RAM we're going to speed up this part of the video so we don't have to waste any more time just watching the progress bar now that our core installation is completed it's asking us to configure a package manager the work of a package manager on Linux operating system is similar to the Google Play Store on Android mobile devices and on the app store for the Apple devices it's an interface to install external applications which are not installed by default let's say for Google Chrome or any other browser which can be used to browse the internet at this point of time is ask us to select our Network mirror we're going to select as yes and move forward with this next it's going to ask us for a HTTP proxy which we can leave it as blank and press it as continue forward at this point of time it's looking for updates to the Kali Linux installation this will fetch the new builds from the Kali server so the installation is always updated to the latest version now that the package manager is configured we have the grub bootloader the grub is used for selecting the operating system while booting up its core functionality is to allow the operating system to be loaded correctly without any faults so at this point of time if it has installed the grub bootloader to your primary dive we can select this as yes and press continue remember the installation was conducted on dev SDA so we're going to select installation of the Guard loader on the same hard disk that we have configured we press this one and press continue so now the grub bootloader is being installed the grub is highly essential because it is it shows the motherboard where to start the operating system from even if the operating system is installed correctly and all the files are in correct order the absence of a bootloader will not be able to launch the OS properly as you can see the installation is finally complete so now we can press on continue and it's going to finalize the changes now you can see Carl Linux being booted up straight away it doesn't check for the ISO file anymore since the operating system is now installed onto the virtual hard disk storage that we had configured before here we're going to enter our username and password that we had set up before and we have the calendar system booted up and this is your home page we can see the installed applications over here which are being used for penetration testing by multiple security analysts worldwide all of these come pre-installed with Carl Linux and others can be installed using the APD package manager that we had configured we can see a full name over here and with this our installation of the Kali Linux is complete now that we have covered the basics of Kali Linux let us take a look at the agenda for our demo today we start out with a few terminal commands that are a basic part of a Linux operating system configure our own proxy chains to maintain anonymity while running penetration testing attacks on our victims next we run a few nmap scans on a local Windows 10 machine to find out the type of information that can be gathered in such a scenario moving on we use Wireshark to monitor internet traffic and understand the importance of encryption and security when browsing the World Wide Web next we learn about Metasploit and its various applications in the line of vulnerability assessment of a device and finally we use mataseproid to take root access of a fully updated Windows 10 computer system let's begin with some terminal Basics on Kali Linux when most people hear the thumb Linux they Envision a complex operating system used only by programmers however the experience is not as frightening as it appears Linux is an umbrella term for a collection of free and open source Unix operating systems there are many variants like Ubuntu Fedora Debian these are distributions which will be a more precise term when using a Linux operating system you will most likely utilize a shell which is a command line interface that provides access to the operating system Services the majority of Linux distributions ship with a graphical user interface also known as GUI as their primary shell this is done to facilitate user interaction in the first place having said that a command line interface is suggested due to its increased power and Effectiveness by entering the commands into the CLI tasks that require a multi-step GUI procedure may be completed in a matter of seconds you can start the terminal by clicking on the prompt icon here on top once the terminal is open we can put up a commands the First Command that we are going to look into is PWD PWD stands for present working directory as of right now what you are seeing is the terminal window by default if I write PWD and press enter this shows the directory in which the terminal is being run on as of right now it's in the NF folder of my desktop which is specifically this folder if I open up this folder you can see it is currently empty as in it has no contents if I use another command known as mkdir which is supposed to stand for make directory and I write an F2 shortage for new folder 2. if I open up the NF you can see the new folder is created this is how the PWD command works another important command to change directories it's called the CD command let's say right now if I am in NF I want to create a new file in nf2 folder or something else in the nf2 folder I have to shift to CD nf2 now if I write PWD it will show the present working directory of Home simply learn desktop NF and inside that I am in nf2 right now it is done to navigate through the Linux files and disk directories it requires either the full path or just the name of the directory if we have to move a completely different folder on a completely different file then we can use the entire path like this for now CD Works another few commands is we can write CD dot dot and it will come back one folder now the PWD will be just NF and not nf2 let's say we are in this folder and we want to go a different file let's say if we just go for CD home simpler that's it right now these are the folders in our current present working directory we have the desktop the documents downloads Etc from here we can again go to the desktop using the same CD command cross check the changing of directories and check the files again and yes there we go NF how do we know this what are the command that we are used to show the files and folders that folder is known as the ls command LS can be used to view the contents of a directory by default this command will display the contents of your current working directory if we add some other parameters we can find the contents of other directories as well there are some hidden files as well in Linux which cannot be showed just with ls for example if we just go to cdetc which is a configuration folder for Linux if we write LS now these are the files that can be seen if you want to see the hidden files we'll have to add one more parameter here like LS minus a and as you can see the number of files have increased this time around there are other things as well that we can see with Linux LS minus a l will show the hidden files along with some of the parameters and some of the permissions that has been provided for each file as you can see many of these files have root access some of them can write some of them can read it differs file to file and the ls minus Al command is used to check each of these files permission and change them accordingly if needed the next command that we can look for is the cat command or concatenate it is one of the most frequently used commands and it is used to list the contents of a file on the output for example let's say if I have a file at the desktop in this nf2 folder I will create a document create an empty file e file I'll open up the document and I'll write it as hello Kali I will save this up now to change the directories from Etc to nf2 we have already discussed how to use the CD command using just the folder name now if you want to go through the entire directory we can write CD home as you can see it is already prompting us to complete the name of the directory at this point we just have to press tab and it completes it for ourselves next we already know we have to enter the desktop NF and nf2 and this brings us to the current working directory here if we press LS we can find a file over here now as discussed with the concatenate it is used to show the contents of a file so right now if we press cat which stands for concatenate e file as you can see we have written hello Kali in the text file and we can see the output right now we can also use it to create new files for example if we write cat any file name such as e-file 2. here we can write anything hello Kali again once you press Ctrl C here we can check e File 2 and we have hello Kali again printed over here we can see the same using the concatenate command as well if I press LS you can see we have two files here and I can go with cat e file to and I have Hello Kali again this is how the concatenate command works apart from this it can be used to copy there is a different command like called CP which is used to copy the files from one place to another mindfulness is not moving this is only going to copy the command for example currently our PWD which is the present [ __ ] directory is in the nf2 folder as you can see over here let's copy the E file to to the NF folder we can write CP e file to and give the path of the NF folder which will be home simply learn Tech stock and an F now if I press LS I'll find both the files in nf2 since I copied to go back to the NF folder again we can again use the same command of no we can again use the home simply learn desktop and just an F no nf2 this time just enough as you can see this will change back our present working directory now when we press LS we will find the e-file to file and the nf2 folder and we can confirm this using the GUI as well this is the NF folder and you can see the nf2 folder and the e-file to document if I write cat e file to cat e file to we can see the contents of the file now this can be done using moving as well for example if I go to CD nf2 which is the inside folder it has both the document files like e file and e-file 2. let's say I want to move the e-file completely from nf2 to NF1 instead of writing CP the command I am going to use is MV MV e file and again give the path of the folder into which I have to copy which will be again home simply learn desktop and NF as you can see the contents of the nf2 have appeared here and E file has been moved from nf2 to NF this is this nf2 and we don't find e file here anymore if we press CD dot dot and we go back to NF LS right now and we can file both the files e file that we moved and E file to that we copied from the nf2 folder so this is how copying and moving will work using the terminal now this is just a simple one line statement that might take a couple of clicks when using GUI this is why the command line interface is considered to be much more streamlined for Linux operating systems another very important command for Linux operating system is the sudo command Sudo is short for super user dupe the command enables you to perform tasks that require administrative or root permissions you can think of it as how we run programs administrator on Windows systems it is not advisable to use this cupboard for daily use because it might be easy for an error to occur and the permissions of root are very intricate so new beginners are advise to use this sudo command only when absolutely necessary for example sudo SU with this command I am giving this terminal a root permission this SEO stands for this user at this point it's going to ask for my admin password once I enter my password and I now have root access note how the password that I entered did not show up here this is a security measure to prevent people from snooping on your root password which is the end game of all this operating system as you also can see the symbol changed if the dollar symbol is showing it source as a standard user when you switch to root you can easily see a hash symbol this opens up a shell inside this terminal command for example we can exit out of the root user to the standard user using the command exit and once again we have the dollar sign and the root has vanished over here there are some commands that will only work with administrative access for example when updating the Kali Linux system we have to use apt update as you can see it says problem unlinking the file because permission denied now let's try this using sudo sudo APD update as you can see it is updating the package repositories which work as the software installed on the system this can be done using either writing the sudo command every time we want to perform a root access or we can just write sudo Su once and write apt update alone the fetching is complete over here for the second example let's say I just write sudo Su and this time it's not going to ask me the password because at this current terminal process I've already provided the root password once and it is in memory right now now when we used to update the system we had to write sudo apt update that was because we were running it as a standard user now we are running it as a root user so all we have to write is if it update and it's going to continue its work there you go another command that can be useful is the Ping command pretty self-explanatory it's going to be checking the internet connectivity you can be used to check internet connectivity or you can see if there is a local server on your system which needs to be pinged then you can check there for example if you have to write ping and we can use either IP address or domain let's say if you want to check that if we can access google.com using this Kali Linux installation or not we can write ping google.com and you can see it shows the bytes being sent and received and how much time it took to take up the request this can be done for local systems as well for example this installation of Kali Linux is being run on a virtual machine once this machine is running I still have my host machine running over here the IP address of which is 192.168.29 179. if I try to Ping this from here as you can see the time to complete the request is drastically low compared to a website on the internet considering this is on the local network this is how the Ping command is worked and it can show you what kind of packages are transmitted how many are received if there was any kind of packet loss between the connection window and other details a very important command when working with the terminal for long duration is a history command it is self-explanatory there are so many commands that are being run sometimes people forget what was the change they did oh what was the directory name they put a history command helps to recover some of the commands that you have written it doesn't go all the way back but it takes up many commands that were inputted in the last few processes this is how the history command works these are some of the most commonly used terminal commands if you want to learn more about this terminal and every other feature of this please let us know in the comment section and we will try to make an in-depth tutorial special figures repeat if you want to learn more about the terminal please let us know in the comment section and we will try to make an in-depth tutorial specifically for terminal commands on Linux moving on we learn how to configure proxy chains on a system proxying refers to the technique of bouncing your internet traffic through multiple machines to hide the identity of the original machine it is a good tool that hackers use to accomplish this goal is proxy chains essentially you can use proxy chains to run any program through a proxy server this will allow you to access internet from behind a restrictive firewall which hides your IP address even allows you to use multiple proxies At Once by chaining them together one of the most important reasons that proxy chains is used in a security context is that it's easy to evade detection attackers often use proxies to hide their true identities while executing an attack and when multiple proxies are chained together it becomes harder and harder for forensic professional to trace the traffic back to the original machine when these proxies are located across countries investigators would have to obtain warranties in the local jurisdictions where every proxy is located to see how proxygen works let's open Firefox first and check our current IP address write Firefox and there we go as we can see Firefox is now open let's check our current IP address right now if we go to an address called my ip.com and you can see it easily detects our country is in India and this is a public IP address now if we move to the terminal again here we can now write proxy chains minus h what is minus H does is it finds a help it it stands for the help file this is for help file what we found out using this is proxy chains has a config file here Etc proxychains4.conf this is the config file found using this config file we can customize how our proxy change should work if we want to open that we have to use it in a text editor on Windows we have notepad and other things like that Microsoft Word related documents on Linux we have a tool called Nano to access the Nano we use the command Nano and give the path of the file that we want to check as of right now the proxy chance config file is located over here so we're going to follow the path there chains 4 Dot comf and here we go we see the config file there are three basic types of proxy chaining here we have a strict chain where all the proxy in the list will be used and they will be changed in order we have a random chain where each connection made through proxy genes will be done via random combo proxies in the proxy list when you have a dynamic chain it's the same as strict chain but dead proxies are excluded from the chain and here we can set up whichever type we want to enable or disable a particular type we use the hash symbol here as you can see right now all the lines have a hashtag symbol at the front except this one a dynamic chain this is the current one being used let's say if I want to use a strict chain method so I can add a hash value here and remove the hash here at one point of time any one of these three four types should be enabled let's go for the Dynam Dynamic chain we can disable this strict Chain by putting the hashtag in front and removing the dynamic chain as you can see below we have few commands to how to handle the Nano text editor this symbol is known as the control button on your keyboard now if we want to write out which is synonymous to saving the file supposed to go with Ctrl O So if I press Ctrl o on my keyboard it says file name to write and we have to press enter here since we want to overwrite the proxy chains 4 dot comf file we don't want to create a new file over here so just press enter and we get a permission right this permission denied we're getting is because we have opened this using a standard user Etc is a system folder to be able to use make some changes we have to use it using a sudo command to exit this Nano we have to use the control X command we use Ctrl X we're going to clear and this time we're going to use the sudo command sudo Nano Etc proxy chains 4.0 and we have the same file open up again now this time if you want to make a change let's say we're going to add a strict chain instead of a dynamic chain which remove the hashtag from straight we're going to use Ctrl o for the save file option we're going to press enter and it says root 160 lines again if you want to reverse this change we put the hashtag over here enable Dynamic chain we press Ctrl o press enter and it says root 160 lines now we can exit straight away using the control X format right now we have not provided any file or a proxy chain we can have proxy IP addresses from the internet but we have to make sure that they are safe and they don't Snoop on our data when there is no proxy chains being provided personally it going it's going to use the Tor Network but for that we have to start door is a service in Linux to know more about the store we can write sudo systemctl which is used to know the status of services on the Linux operating system and status of torque a system CTL sorry as instead of STL it should be system CTL status Tor as you can see it is a toss service anonymizing overlay Network for TCP connections and it's currently inactive now to start this up we have to write sudo system CTL start Dot now if we repeat the same sudo system CTL status Star as you can see it's active now you can see the green logo over here okay to integrate the Firefox and the browser we can use the proxy chains command directly over here we can write proxy chains we can use Firefox to launch our web browser and let's say if we want to visit google.com we press enter and the Firefox window is launched and it should open up google.com next and there we go if we go to myip.com once again as you can see we have a different IP address and the country is a known as well so this is how we can use proxy chains to anonymize a internet usage when using Kali Linux next on our agenda is the ability to scan networks using nmap at its core nmap is a network scanning tool that uses IP packets to identify all the devices connected to a network can learn more about nmap using their help file as you can see these are some of the parameters that can be used when scanning ports of a system you can see the version and the URL of the webs of the service over here the primary users of nmap can be broken into three Crow processors first the program gives you detailed information on every IP active on your network and then each IPA can then be scanned secondly it can also be used to providing a lot of live hosts and open ports as well as identifying the OS of every connected device thirdly and map has also become a valuable tool for users looking to protect personal and business websites using nmap to scan your own web server particularly if you are hosting your website from home is essentially simulating the process that a hacker would use to attack your site attacking your own site in this way is a powerful way of identifying security vulnerabilities as we already discussed The Host Windows 10 machine on the system has an IP address a 192 168 29.179 if you want to test the OS scan of the system we're going to first get the root permission over here we use the sudo command and now we are a root user we're going to launch the command and map minus o which is supposed to be an OS detection scan the IP address we can use of the host system 192.168.29.179 in a legitimate penetration testing scenario we can use the IP address of the vulnerable disk device over here we are going to let it scan for a while and it's going to give us some guesses on what can the OS be as you can see the scan is done and it has shown some of the ports that are open you can see the msrpc port open at the https 443 Port open which is used to connect to the internet and it has some aggressive OS guesses as well for example it thinks there's a 90 94 chance that it's going to be a Microsoft Windows XP Service Pack 3. that's partly because a lot of the Windows XP update packages are still prevalent on Windows now that the OS detection is confirmed there are multiple more details that we can gather from nmap let's go with the NF minus a command which is supposed to capture as much data as possible there is also a speed setting you can call it a speed setting or a control setting of the minus t minus t ranges from t 0 to T1 to T through all the way up to D5 this basically determines how aggressively the victim is being scanned if you scan slowly it will take more time to provide the results but it will also give a less chance for the intrusion detection system on the vulnerable machine firewall to detect that someone is trying to penetrate the network for now if we want to go with somewhat of a high speed we can go with the T4 and provide the same IP address of the local machine I am trying to attack it's going to take a little bit of time since it's trying to capture a lot of information as you can see the results are now here it launched a scan and took a few top ports that are most likely vulnerable from a Windows XP perspective and it showed a few ports over here it has not shown 991 filtered ports which could not be attacked anyway since they were closed for outside access it shows a few fingerprint settings like the connection policies and the port details it shows an HTTP options some other intricate details that can be used when you attacking its servers it shows a VMware version that it's running and some few other ports over here apart from that we also have the aggressive OS gases over here just like we did with the minus o and you can see this time it is showing Windows 7 as 98 percent no exactos matches since uh if there was any exact wise matches we could have seen 100 chances over here this is a trace route a trace route will be the time and the path a connection request takes from the source to the destination for example this request went from 192 168.72.2 to a destination address since this is a local machine it took only a single step and multiple occasions so if you're trying to access a remote system it's going to be a number of free suits when it jumps from firewall to firewall and router to router this is how we can use nmap to find information about a system and find some vulnerable ports we can access moving on we have a tutorial on how to use Wireshark to sniff Network traffic to start using Wireshark we're going to have to open the application first now during installation of Wireshark there is an option to enable if non-root users can be able to capture traffic or not in my installation I have disabled that so I will be launching Wireshark when using the root user itself also to capture data we need an external Wi-Fi adapter you can see it over here in the VM tab removable devices our link 802.1 and WLAN this is a external Wi-Fi adapter which is inserted into my USB system you can see it over here if I write iwconfig this is the one wlan0 this is absolutely necessary because we need to have a monitor mode required we won't need it for sniffing data on Wireshark right now but it's going to be necessary later on in this tutorial as well as we will see for now we can just start up Wireshark by writing its name on the command line and it should start the program here we go here it's going to check which of the adapters we want to use for example right now the eth0 which supposed to stand for ethernet 0 Port you can see data is being transmitted up and down we're going to select eth0 and we have started capturing data you can see this data request from the source so destination and the time and the which protocol it is following everything we can see and we can see the ipv4 flags here as well as you can see over here to capture internet traffic we can try running Firefox if we just write Wikipedia .com and you can see the number of requests increasing okay this is spelling mistake Wikipedia yeah you can see the application data of all these requests going up and they're connected to a destination server of 1 0 through 102.166.224 now if you even if you check the transmission control protocol Flags over here and so many more things we cannot find anything beneficial as you can see the information over here is gibberish which is supposed to be since it's supposed to be encrypted now this is possible due to this being an https website hence you can see the lock symbol over here and connection is supposed to be secure now what about HTTP ports we have seen many people recommend to not visit HTTP ports repeat we have seen many people recommend to not visit HTTP websites and even if we have to visit to not provide any critical information for example let's go to a random HTTP page over here as you can see this is saying connection is not secure and this is an HTTP HTTP page and not https now let's check for some of the information that is passing through this this is a login form let's say I have a legitimate account over here if I write my account name and my password is supposed to be password one two three four I press login and the password does not match because I do not have an account over here but let's say I did and I was logged in as expected you can go to Wireshark we can use filters over here now all the requests that I am sending it's a TCP request so I can write a filter containing TCP contains whatever string if it is being passed let's say for the end user name I write my account name so I can just write my account name over here and press enter to find a request over here now as you can see there are many flags over here if we go to the HTT HTML form URL encoded and open up some of its Flags as you can see I can see my account name and simply learn password over here this is the same details that I input on the website let's say I did have a legitimate account on this website I would have logged in with no problems but anyone who would be using Wireshark to sniff on the data can easily get my credentials from here this is why it's recommended to not provide any information on HTTP Pages the security is not up to the mark and always look for the lock symbol when visiting any website or making any internet transactions or providing any information this is how we can use Wireshark to detect transmission and sniff packet data that is being transferred to the network adapter next we have to learn about what is Metasploit the Metasploit project is a computer security project that provides information about security vulnerabilities and AIDS in penetration testing and IDs development we can open up the terminal here we're going to allow root access and to open up Metasploit the key word is msf console that's going to take a little bit of time to start it up now the Metasploit console has been loaded from here we can decide what type of attack we want to launch and what kind of exploits we can launch against vulnerable targets for example like we already discussed I'm running this virtual machine on a Windows 10 host machine so if I open the command prompt from my Windows 10 over here if I need to check the IP address once I go with ipconfig here you can see the IP address of this local machine moving on if we have to attack that machine let's say we want to see what kind of exploits are going to work over there now we already know that Windows has some common vulnerabilities one of those vulnerabilities is the HTA server vulnerability HTA is supposed to be a HTML application but when past the right payload it can be used to open a back door into a system to start off with the Metasploit and accessing such applications we're going to use the command use exploit and the name of the reverse HTA server is this windows for miscellaneous HDA server as you can see it already found this one all right now there are some options that we need to set for this exploit to go through for example you can see some of the options over here there is a payload the payload is supposed to be the malicious file that we are going to send on the HTML application which allows us to give the back door for example right now the payload which is the malicious file is a Windows meter printer reverse TCP completely understandable now let's set the L host L host and R host and SRV host should be the one where we are going to launch the attack from for example if we launched another tab of this console and we just press i f config the IP address is 192 plus 168 72130 so we're going to set the L host as 192.168.72.130 and we're going to do the same thing with SRV host we're going to set up port where we need to capture the back door axis next the payload has already been set this payload will launch a back door and give us meta prita access to the system metopriter is can be considered as an upgrade of a normal command prompt shell we will look into it once we get the access in the first place now that we have set the commands we can press on exploit and press enter now you can see we have a URL over here we're going to copy this URL once the URL is copied we take it into the browser and paste it this will ask us to download this file now as per browser security settings this file should be blocked by default we can decide to keep it and with the correct formulation of this malicious package even the website browser antivirus softwares will not be able to detect good payloads we're going to save this file and we're going to open it publisher could not be verified if we press run and we go back to our Meetup beta access over here you can see it has already captured the URL of an HD server and it is writing delivering payload just have to wait for a few seconds so the payload is delivered it has sent this much amount of data meter Peter session one is opened and we should get the access soon there we go now to understand where is the session set we can write sessions minus I as you can see it has a meter beta over here we're going to write sessions minus I recession ID is 1 so we're going to write 1. and we have the meter beta access now to get a fair idea of the system we're going to write this info and it's going to the computer name the OS architecture all these things we can write the help command to see what are the things that we can get out of the system we can take screenshots we can control the webcam and start a video chat we can take a lot of things over here there are other commands as well where we can change the file directory like the cad command CD command there are so many things that work in the normal CMD which we can run on the meter beta as well now if you want to access this command prompt of the system directly we can go with this we have to write shell and there we go we are in the downloads folder right now to see if this is the same computer or not we're going to write ipconfig as you can see it is our victim machine with 192.168 or 29.171 we can just press exit and we're back with the meter beta access this is how we can use metafreter and Metasploit to gain access to a Windows 10 machine next let's take a look at how we can get to root access from a Windows 10 system we just learned how we can get a meter beta access from a system we can background this meter Builder session by writing background and pressing enter we can still we can still see the shares sessions minus I it's still present over here now these kind of access are not administrative access these are the kind of back doors that can be created for standard users but to get a complete access of a system including the program files the windows documents we need to have root access or administrative access through that we're going to use another exploit reminder that the meter Peter session of the standard access is already present and we're not messing with it right now we're going to set up another session albeit with the same machine that exploit name is use exploit windows local bypass USC Event Viewer and there we go now if we check the options that we can put in the system we have to choose an exploit Target we need to put a session as well let's say we going to use the session one this is the session that has the meter beta access with the standard user it doesn't have the system user we're going to write set Session One and we're going to run export run a few commands and it opened a second meter beta session as you can see it is the assessment too if I write this info we can still see I am not the system user right now I'm still just a normal user how can we check that if you go to Shell Excel CC users canopy downloads all these things if I press exit go back to the meter bitter there is a command on meter beta get system it attempts to elevate your privilege to that of the local system which basically means you get promoted into root access so if we write get system and due to pipe impersonation we now have the system root access as you can see now it has become x64 and we are the admin users now if I go to Shell I can easily go back windows and I can easily access these ones this kind of control over the windows folders and the program files folders these kind of things are not possible if you are not an admin access or the command prompt has not been run with admin permissions this is how we can use privilege escalation to get into an admin access system we use the second exploit which was the bypass us Event Viewer exploit and essentially used to do the first session as you can read here Windows escalation USA protection bypass it was first disclosed on 2016 but it still works on some systems this is how we can get a root access on a Windows 10 installation hope you learned something new today if you have any doubts regarding the topic mentioned in the lesson please feel free to let us know in the comment section below staying ahead in your career requires continuous learning and upskilling whether you're a student aiming to learn today's top skills or a working professional looking to advance your career we've got you covered explore our impressive catalog of certification programs in Cutting Edge domains including data science cloud computing cyber security AI machine learning or digital marketing designed in collaboration with leading universities and top corporations and delivered by industry experts choose any of our programs and set yourself on the path to Career Success click the link in the description to know more foreign hi there if you like this video subscribe to the simply learning YouTube channel and click here to watch similar videos to nerd up and get certified click here

Channel: Simplilearn

Views: 25,644

Keywords: kali linux tutorial, kali linux hacking tutorials, kali linux for beginners, kali linux tools, kali linux tutorial for beginners, kali linux full tutorial 2023, kali linux full guide, kali linux tutorial 2023, kali linux tutorial beginning, kali linux explained, kali linux tools explained, kali linux all tools explained, kali linux file system explained, kali linux, kali linux install, kali linux 2023, kali linux 2023 tutorial, kali linux 2023 update, simplilearn

Id: B6zGwbW5_Ns

Length: 71min 32sec (4292 seconds)

Published: Sat Jul 29 2023