Kali Linux

Revealed
 
Mastering the Penetration Testing
Distribution (2021)
 Kali Linux
Revealed
 
Mastering the Penetration Testing
Distribution (2021)

by Raphaël Hertzog, Jim

O’Gorman, Mati Aharoni, and Joe
O’Gorman
Kali Linux Revealed

Copyright © 2021 Raphaël Hertzog, Jim O’Gorman, Mati Aharoni, and Joe O’Gorman

This book is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.
è https://creativecommons.org/licenses/by-sa/3.0/
Some sections of this book borrow content from the ”Debian Administrator’s Handbook, Debian Jessie from
Discovery to Mastery” written by Raphaël Hertzog and Roland Mas, which is available here:
è https://debian-handbook.info/browse/stable/
For the purpose of the CC-BY-SA license, Kali Linux Revealed is an Adaptation of the Debian Administrator’s
Handbook.
”Kali Linux” is a trademark of Offensive Security. Any use or distribution of this book, modified or not, must
comply with the trademark policy defined here:
è https://www.kali.org/trademark-policy/
All Rights Not Explicitly Granted Above Are Reserved.
ISBN: 978-0-9976156-0-9 (paperback)

OffSec Press
230 Park Ave, 3rd Fl West
New York NY 10169
USA
www.offensive-security.com

Library of Congress Control Number: 2017905895

The information in this book is distributed on an ”As Is” basis, without warranty. While every precaution
has been taken in the preparation of this work, neither the authors nor OffSec Press shall have any liabil-
ity to any person or entity with respect to any loss or damage caused or alleged to be caused directly or
indirectly by the information contained in it.
Because of the dynamic nature of the Internet, any Web addresses or links contained in this book may have
changed since publication and may no longer be valid.
Printed in the United States of America.
 Table of Contents

1. About Kali Linux 1

1.1 A Bit of History . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
1.2 Relationship with Debian . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.2.1 The Flow of Packages ......... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
1.2.2 Managing the Difference with Debian . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.3 Purpose and Use Cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.4 Main Kali Linux Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
1.4.1 A Live System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
1.4.2 Forensics Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
1.4.3 A Custom Linux Kernel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.4.4 Completely Customizable . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.4.5 A Trustable Operating System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.4.6 Usable on a Wide Range of ARM Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1.5 Kali Linux Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
.
1.5.1 Network Services Disabled by Default . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
..
1.5.2 A Curated Collection of Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1.6 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2. Getting Started with Kali Linux 13
2.1 Downloading a Kali ISO Image . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.1.1 Where to Download ............ .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.1.2 What to Download . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.1.3 Verifying Integrity and Authenticity . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Relying on the TLS-Protected Website . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Relying on PGP’s Web of Trust . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2.1.4 Copying the Image on a DVD-ROM or USB Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Creating a Bootable Kali USB Drive on Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Creating a Bootable Kali USB Drive on Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Creating a Bootable Kali USB Drive on OS X/macOS . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
2.2 Booting a Kali ISO Image in Live Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
2.2.1 On a Real Computer ................ . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
2.2.2 In a Virtual Machine ................ . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Preliminary Remarks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
VirtualBox
VMware Workstation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
2.3 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

3. Linux Fundamentals 47
3.1 What Is Linux and What Is It Doing? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
3.1.1 Driving Hardware ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
3.1.2 Unifying File Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
3.1.3 Managing Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
3.1.4 Rights Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
3.2 The Command Line . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
3.2.1 How To Get a Command Line . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
3.2.2 Command Line Basics: Browsing the Directory Tree and Managing Files . . . . . . . . . . . . . . . . . . 52
3.3 The File System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
3.3.1 The Filesystem Hierarchy Standard .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
3.3.2 The User’s Home Directory ........ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
3.4 Useful Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
3.4.1 Displaying and Modifying Text Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
3.4.2 Searching for Files and within Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
3.4.3 Managing Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
3.4.4 Managing Rights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
3.4.5 Getting System Information and Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
3.4.6 Discovering the Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
3.5 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
4. Installing Kali Linux 65
4.1 Minimal Installation Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
4.2 Step by Step Installation on a Hard Drive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
4.2.1 Plain Installation ........... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Booting and Starting the Installer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Selecting the Language . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Selecting the Country . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Selecting the Keyboard Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Detecting Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Loading Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Detecting Network Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Configuring the Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
User Creation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
Configuring the Clock . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Detecting Disks and Other Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Partitioning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
Copying the Live Image . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

IV Kali Linux Revealed

 Configuring the Package Manager (apt) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Installing Metapackages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Installing the GRUB Boot Loader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Finishing the Installation and Rebooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
4.2.2 Installation on a Fully Encrypted File System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Introduction to LVM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Introduction to LUKS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Setting Up Encrypted Partitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90
End of the Guided Partitioning with Encrypted LVM . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
4.3 Unattended Installations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
4.3.1 Preseeding Answers ........... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
With Boot Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
With a Preseed File in the Initrd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
With a Preseed File in the Boot Media . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96
With a Preseed File Loaded from the Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
4.3.2 Creating a Preseed File ............ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
4.4 ARM Installations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
4.5 Troubleshooting Installations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99
4.6 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
5. Configuring Kali Linux 107
5.1 Configuring the Network . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
5.1.1 On the Desktop with NetworkManager ..... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
5.1.2 On the Command Line with Ifupdown ...... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
5.1.3 On the Command Line with systemd-networkd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110
5.2 Managing Unix Users and Unix Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
5.2.1 Creating User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
5.2.2 Modifying an Existing Account or Password . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
5.2.3 Disabling an Account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
5.2.4 Managing Unix Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
5.3 Configuring Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
5.3.1 Configuring a Specific Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
5.3.2 Configuring SSH for Remote Logins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
5.3.3 Configuring PostgreSQL Databases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
Connection Type and Client Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Creating Users and Databases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Managing PostgreSQL Clusters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117
5.3.4 Configuring Apache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
Configuring Virtual Hosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118
Common Directives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
5.4 Managing Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
5.5 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123

Table of Contents V
 6. Helping Yourself and Getting Help 127
6.1 Documentation Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
6.1.1 Manual Pages .......... . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128
6.1.2 Info Documents ......... . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
6.1.3 Package-Specific Documentation . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130
6.1.4 Websites . . . . . . . . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
6.1.5 Kali Documentation at kali.org/docs/ . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131
6.2 Kali Linux Communities . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
6.2.1 Forums on forums.kali.org . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
6.2.2 #kali-linux IRC Channel on Freenode . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133
6.3 Filing a Good Bug Report . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
6.3.1 Generic Recommendations . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
How to Communicate . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134
What to Put in the Bug Report . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Miscellaneous Tips . . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136
6.3.2 Where to File a Bug Report . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137
6.3.3 How to File a Bug Report . . . . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
Filing a Bug Report in Kali . . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138
Filing a Bug Report in Debian . . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142
Filing a Bug Report in another Free Software Project . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
6.4 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
7. Securing and Monitoring Kali Linux 155
7.1 Defining a Security Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156
7.2 Possible Security Measures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
7.2.1 On a Server ....... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
7.2.2 On a Laptop ....... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
7.3 Securing Network Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
7.4 Firewall or Packet Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
7.4.1 Netfilter Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160
7.4.2 Syntax of iptables and ip6tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
7.4.3 Creating Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165
7.4.4 Installing the Rules at Each Boot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
7.5 Monitoring and Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
7.5.1 Monitoring Logs with logcheck . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167
7.5.2 Monitoring Activity in Real Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168
7.5.3 Detecting Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
Auditing Packages with dpkg --verify . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169
Monitoring Files: AIDE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170
7.6 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171

VI Kali Linux Revealed

8. Debian Package Management 175
8.1 Introduction to APT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
8.1.1 Relationship between APT and dpkg .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
8.1.2 Understanding the sources.list File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
8.1.3 Kali Repositories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
The Kali-Rolling Repository . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
The Kali-Dev Repository . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
The Kali Linux Mirrors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
8.2 Basic Package Interaction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
8.2.1 Initializing APT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181
8.2.2 Installing Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182
Installing Packages with dpkg . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182
Installing Packages with APT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
8.2.3 Upgrading Kali Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
8.2.4 Removing and Purging Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186
8.2.5 Inspecting Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187
Querying dpkg’s Database and Inspecting .deb Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187
Querying the Database of Available Packages with apt-cache and apt . . . . . . . . . . . . . . . . . . . . 191
8.2.6 Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192
Handling Problems after an Upgrade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193
The dpkg Log File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
Reinstalling Packages with apt --reinstall and aptitude reinstall . . . . . . . . . . . . . . . . . . . 194
Leveraging --force-* to Repair Broken Dependencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
8.2.7 Frontends: aptitude and synaptic .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
Aptitude................ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 196
Synaptic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199
8.3 Advanced APT Configuration and Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200
8.3.1 Configuring APT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200
8.3.2 Managing Package Priorities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
8.3.3 Working with Several Distributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 204
8.3.4 Tracking Automatically Installed Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205
8.3.5 Leveraging Multi-Arch Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206
Enabling Multi-Arch . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206
Multi-Arch Related Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
8.3.6 Validating Package Authenticity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
8.4 APT Package Reference: Digging Deeper into the Debian Package System . . . . . . . . . . . . . 210
8.4.1 The control File ................ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211
Dependencies: the Depends Field ....... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212
Pre-Depends, a More Demanding Depends . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
Recommends, Suggests, and Enhances Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214
Conflicts: the Conflicts Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214

Table of Contents VII

 Incompatibilities: the Breaks Field .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214
Provided Items: the Provides Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215
Replacing Files: The Replaces Field .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216
8.4.2 Configuration Scripts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
Installation and Upgrade Script Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219
Package Removal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219
8.4.3 Checksums, Conffiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220
8.5 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222
9. Advanced Usage 227
9.1 Modifying Kali Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228
9.1.1 Getting the Sources ...... .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229
9.1.2 Installing Build Dependencies . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
9.1.3 Making Changes . . . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232
Applying a Patch . . . . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233
Tweaking Build Options . . . .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234
Packaging a New Upstream Version . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 235
9.1.4 Starting the Build . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236
9.2 Recompiling the Linux Kernel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
9.2.1 Introduction and Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238
9.2.2 Getting the Sources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238
9.2.3 Configuring the Kernel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239
9.2.4 Compiling and Building the Package . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241
9.3 Building Custom Kali Live ISO Images . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241
9.3.1 Installing Pre-Requisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242
9.3.2 Building Live Images with Different Desktop Environments . . . . . . . . . . . . . . . . . . . . . . . . . 242
9.3.3 Changing the Set of Installed Packages.......... . . . . . . . . . . . . . . . . . . . . . . . . . 243
9.3.4 Using Hooks to Tweak the Contents of the Image . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
9.3.5 Adding Files in the ISO Image or in the Live Filesystem . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
9.4 Adding Persistence to the Live ISO with a USB Key . . . . . . . . . . . . . . . . . . . . . . . . . . . 246
9.4.1 The Persistence Feature: Explanations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246
9.4.2 Setting Up Unencrypted Persistence on a USB Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247
9.4.3 Setting Up Encrypted Persistence on a USB Key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
9.4.4 Using Multiple Persistence Stores . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
9.5 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
9.5.1 Summary Tips for Modifying Kali Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
9.5.2 Summary Tips for Recompiling the Linux Kernel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252
9.5.3 Summary Tips for Building Custom Kali Live ISO Images . . . . . . . . . . . . . . . . . . . . . . . . . . 253
10. Kali Linux in the Enterprise 257
10.1 Installing Kali Linux Over the Network (PXE Boot) . . . . . . . . . . . . . . . . . . . . . . . . . . 258
10.2 Leveraging Configuration Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261

VIII Kali Linux Revealed

 10.2.1 Setting Up SaltStack .......... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261
10.2.2 Executing Commands on Minions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
10.2.3 Salt States and Other Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264
10.3 Extending and Customizing Kali Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268
10.3.1 Forking Kali Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 268
10.3.2 Creating Configuration Packages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 269
10.3.3 Creating a Package Repository for APT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 275
10.4 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279
11. Introduction to Security Assessments 283
11.1 Kali Linux in an Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285
11.2 Types of Assessments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287
11.2.1 Vulnerability Assessment .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288
Likelihood of Occurrence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291
Impact . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291
Overall Risk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 291
In Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292
11.2.2 Compliance Penetration Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 292
11.2.3 Traditional Penetration Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293
11.2.4 Application Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 295
11.3 Formalization of the Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297
11.4 Types of Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298
11.4.1 Denial of Service .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 298
11.4.2 Memory Corruption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299
11.4.3 Web Vulnerabilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300
11.4.4 Password Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300
11.4.5 Client-Side Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301
11.5 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301
12. Conclusion: The Road Ahead 305
12.1 Keeping Up with Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306
12.2 Showing Off Your Newly Gained Knowledge . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306
12.3 Going Further . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307
12.3.1 Towards System Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307
12.3.2 Towards Penetration Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307
Index 308

Table of Contents IX
 Preface
You have no idea how good you have it.
In 1998, I was an up-and-coming hacker, co-founding one of the earliest professional white hat
hacking teams. We were kids, really, with dream jobs, paid to break into some of the most secure
computer systems, networks, and buildings on the planet.
It sounds pretty sexy, but in reality, we spent most of our time hovering over a keyboard, armed
with the digital tools of our trade. We wielded a sordid collection of programs, designed to map
networks and locate targets; then scan, exploit, and pivot through them. In some cases, one of
us (often Jim Chapple) would write custom tools to do wicked things like scan a Class A network
(something no other tool could do, at the time), but most often we would use or modify tools
written by the hacker community. In those pre-Google days, we frequented BugTraq, AstaLaVista,
Packet Storm, w00w00, SecurityFocus, X-Force, and other resources to conduct research and build
our arsenal.
Since we had limited time on each gig, we had to move quickly. That meant we couldn’t spend a
lot of time fiddling with tools. It meant we had to learn the core tools inside and out, and keep the
ancillary ones on tap, just in case. It meant we had to have our tools well-organized, documented,
and tested so there would be few surprises in the field. After all, if we didn’t get in, we lost face
with our clients and they would take our recommendations far less seriously.
Because of this, I spent a lot of time cataloging tools. When a tool was released or updated, I’d go
through a routine. I had to figure out if it would run on the attack platform (some didn’t), and
whether it was worthwhile (some weren’t); I had to update any scripts that relied on it, document
it, and test it, including carrying over any changes made to the previous version.
Then, I would shake out all the tools and put them in directories based on their purpose during an
assessment. I’d write wrapper scripts for certain tools, chain some tools together, and correlate
all that into a separate CD that we could take into sensitive areas, when customers wouldn’t let us
take in attack machines or remove media from their labs.
This process was painful, but it was necessary. We knew that we had the ability to break into any
network—if we applied our skills and expertise properly, stayed organized, and worked efficiently.
Although remaining undefeated was a motivator, it was about providing a service to clients who
needed us to break into networks, so they could plug gaps and move money toward critical-but-
neglected information security programs.
 We spent years sharpening our skills and expertise but we wouldn’t have been successful without
organization and efficiency. We would have failed if we couldn’t put our hands on the proper tool
when needed.
That’s why I spent so much time researching, documenting, testing, and cataloging tools, and at
the turn of the 21st Century, it was quickly becoming an overwhelming, full-time job. Thanks to
the Internet, the worldwide attack surface exploded and the variety and number of attack tools
increased exponentially, as did the workload required to maintain them.
Starting in 2004, the Internet exploded not only as a foundation for business but also as a social
platform. Computers were affordable, more consumer-friendly and ubiquitous. Storage technol-
ogy expanded from megabytes to gigabytes. Ethernet jumped from hundreds of kilobits to tens
of megabits per second, and Internet connections were faster and cheaper than ever before. E-
commerce was on the rise, social media sites like Facebook (2004) and Twitter (2006) came online
and Google (1998) had matured to the point that anyone (including criminals) could find just about
anything online.
Research became critical for teams like ours because we had to keep up with new attacks and
toolsets. We responded to more computer crimes, and forensic work demanded that we tread
lightly as we mucked through potential evidence. The concept of a live CD meant that we could
perform live forensics on a compromised machine without compromising evidence.
Now our little team had to manage attack tools, forensic tools, and a sensitive area tool distribu-
tion; we had to keep up with all the latest attack and exploit methodologies; and we had to, you
know, actually do what we were paid for—penetration tests, which were in high demand. Things
were spinning out of control, and before long, we were spending less time in battle and much more
time researching, sharpening our tools, and planning.
We were not alone in this struggle. In 2004, Mati “Muts” Aharoni, a hacker and security profes-
sional released “WHoppiX” (White Hat Knoppix), a live Linux CD that he billed as “the ultimate
pen testing live CD,” It included “all the exploits from SecurityFocus, Packet Storm and k-otik,
Metasploit Framework 2.2, and much, much more.”
I remember downloading WHoppiX and thinking it was a great thing to have around. I downloaded
other live CDs, thinking that if I were ever in a real pinch, live CDs could save my bacon in the field.
But I wasn’t about to rely on WHoppiX or any other CD for real work. I didn’t trust any of them
to fulfill the majority of my needs; none of them felt right for my workflow; they were not full,
installable distributions; and the moment I downloaded them they were out of date. An aged
toolset is the kiss of death in our industry.
I simply added these CD images, despite their relatively massive size, to our arsenal and kept up
the painful process of maintaining our “real” toolkit.
But despite my personal opinions at the time, and perhaps despite Muts’ expectations, WHoppiX
and its descendants had a seismic impact on his life, our industry, and our community.

XII Kali Linux Revealed

In 2005, WHoppiX evolved into WHAX, with an expanded and updated toolset, based on “the more
modular SLAX (Slackware) live CD.” Muts and a growing team of volunteers from the hacker com-
munity seemed to realize that no matter how insightful they were, they could never anticipate all
the growth and fluctuation of our industry and that users of their CD would have varied needs in
the field. It was obvious that Muts and his team were actually using WHAX in the field, and they
seemed dedicated to making it work. This was encouraging to me.
In 2006, Muts, Max Moser, and their teams consolidated Auditor Security Linux and WHAX into
a single distribution called BackTrack. Still based on SLAX, BackTrack continued to grow, adding
more tools, more frameworks, extended language support, extensive wireless support, a menu
structure catering to both novice and pro users, and a heavily modified kernel. BackTrack became
the leading security distribution, but many like me still used it as a backup for their ”real tools.”
By early 2009, Muts and his team had extended BackTrack significantly to BackTrack 4. Now a full-
time job for Muts, BackTrack was no longer a live CD but a full-blown Ubuntu-based distribution
leveraging the Ubuntu software repositories. The shift marked a serious evolution: BackTrack 4
had an update mechanism. In Muts’ own words: “When syncing with our BackTrack repositories,
you will regularly get security tool updates soon after they are released.”
This was a turning point. The BackTrack team had tuned into the struggles facing pen testers,
forensic analysts and others working in our industry. Their efforts would save us countless hours
and provide a firm foundation, allowing us to get back into the fight and spend more time doing
the important (and fun) stuff. As a result, the community responded by flocking to the forums
and wiki; and by pitching in on the dev team. BackTrack was truly a community effort, with Muts
still leading the charge.
BackTrack 4 had finally become an industrial-strength platform and I, and others like me, breathed
a sigh of relief. We knew firsthand the “pain and sufferance” Muts and his team were bearing,
because we had been there. As a result, many of us began using BackTrack as a primary foundation
for our work. Yes, we still fiddled with tools, wrote our own code, and developed our own exploits
and techniques; and we researched and experimented; but we did not spend all our time collecting,
updating, validating, and organizing tools.
BackTrack 4 R1 and R2 were further revisions in 2010, leading to the ground-up rebuild of Back-
Track 5 in 2011. Still based on Ubuntu, and picking up steam with every release, BackTrack was
now a massive project that required a heroic volunteer and community effort but also funding.
Muts launched Offensive Security (in 2006) not only to provide world-class training and penetra-
tion testing services but also to provide a vehicle to keep BackTrack development rolling, and
ensure that BackTrack remained open-source and free to use.
BackTrack continued to grow and improve through 2012 (with R1, R2, and R3), maintaining an
Ubuntu core and adding hundreds of new tools, including physical and hardware exploitation
tools, VMware support, countless wireless and hardware drivers, and a multitude of stability im-
provements and bug fixes. However, after the release of R3, BackTrack development went rela-
tively, and somewhat mysteriously, quiet.

Preface XIII
 There was some speculation in the industry. Some thought that BackTrack was getting “bought
out”, selling its soul to a faceless evil corporate overlord for a massive payout. Offensive Secu-
rity was growing into one of the most respected training companies and a thought leader in our
industry, and some speculated that its success had gobbled up and sidelined the key BackTrack
developers. However, nothing could be farther from the truth.
In 2013, Kali Linux 1.0 was released. From the release notes: “After a year of silent development,
Offensive Security is proud to announce the release and public availability of Kali Linux, the most
advanced, robust, and stable penetration-testing distribution to date. Kali is a more mature, se-
cure, and enterprise-ready version of BackTrack.”
Kali Linux was not a mere rebranding of BackTrack. Sporting more than 600 completely repack-
aged tools, it was clearly an amazing toolset, but there was still more to it than that. Kali had been
built, from the ground up, on a Debian core. To the uninformed, this might not seem like a big
deal. But the ripple effects were staggering. Thanks to a massive repackaging effort, Kali users
could download the source for every single tool; they could modify and rebuild a tool as needed,
with only a few keystrokes. Unlike other mainstream operating systems of the day, Kali Linux
synchronized with the Debian repositories four times a day, which meant Kali users could get
wickedly current package updates and security fixes. Kali developers threw themselves into the
fray, packaging and maintaining upstream versions of many tools so that users were constantly
kept on the bleeding edge. Thanks to its Debian roots, Kali’s users could bootstrap an installation
or ISO directly from the repositories, which opened the door for completely customized Kali in-
stallations or massive enterprise deployments, which could be further automated and customized
with preseed files. To complete the customization trifecta, Kali Users could modify the desktop
environment, alter menus, change icons, and even replace windowing environments. A massive
ARM development push opened the door for installation of Kali Linux on a wide range of hardware
platforms including access points, single-board computers (Raspberry Pi, ODROID, BeagleBone,
and CubieBoard, for example), and ARM-based Chromebook computers. And last but certainly
not least, Kali Linux sported seamless minor and major upgrades, which meant devotees would
never have to re-install customized Kali Linux setups.
The community took notice. In the first five days, 90,000 of us downloaded Kali 1.0.
This was just the beginning. In 2015, Kali 2.0 was released, followed by the 2016 rolling releases.
In summary, “If Kali 1.0 was focused on building a solid infrastructure, then Kali 2.0 is focused on
overhauling the user experience and maintaining updated packages and tool repositories.”
The current version of Kali Linux is a rolling distribution, which marks the end of discrete ver-
sions. Now, users are up to date continuously and receive updates and patches as they are created.
Core tools are updated more frequently thanks to an upstream version tagging system, ground-
breaking accessibility improvements for the visually impaired have been implemented, and the
Linux kernels are updated and patched to continue wireless 802.11 injection support. Software De-
fined Radio (SDR) and Near-Field Communication (NFC) tools add support for new fields of security
testing. Full Linux encrypted disk installation and emergency self-destruct options are available,

XIV Kali Linux Revealed

thanks to LVM and LUKS respectively, USB persistence options have been added, allowing USB-
based Kali installs to maintain changes between reboots, whether the USB drive is encrypted or
not. Finally, the latest revisions of Kali opened the door for NetHunter, an open-source world-class
operating system running on mobile devices based on Kali Linux and Android.
Kali Linux has evolved not only into the information security professional’s platform of choice,
but truly into an industrial-grade, world-class, mature, secure, and enterprise-ready operating
system distribution.
Through the decade-long development process, Muts and his team, along with the tireless dedi-
cation of countless volunteers from the hacker community, have taken on the burden of stream-
lining and organizing our work environment, freeing us from much of the drudgery of our work
and providing a secure and reliable foundation, allowing us to concentrate on driving the industry
forward to the end goal of securing our digital world.
And interestingly, but not surprisingly, an amazing community has built up around Kali Linux.
Each and every month, three to four hundred thousand of us download a version of Kali. We come
together on the Kali forums, some forty-thousand strong, and three to four hundred of us at a time
can be found on the Kali IRC channel. We gather at conferences and attend Kali Dojos to learn how
to best leverage Kali from the developers themselves.
Kali Linux has changed the world of information security for the better, and Muts and his team
have saved each of us countless hours of toil and frustration, allowing us to spend more time and
energy driving the industry forward, together.
But despite its amazing acceptance, support, and popularity, Kali has never released an official
manual. Well, now that has changed. I’m thrilled to have come alongside the Kali development
team and specifically Mati Aharoni, Raphaël Hertzog, Devon Kearns, and Jim O’Gorman to offer
this, the first in perhaps a series of official publications focused on Kali Linux. In this book, we
will focus on the Kali Linux platform itself, and help you understand and maximize the usage of
Kali from the ground up. We won’t yet delve into the arsenal of tools contained in Kali Linux, but
whether you’re a veteran or an absolute n00b, this is the best place to start, if you’re ready to dig
in and get serious with Kali Linux. Regardless of how long you’ve been at the game, your decision
to read this book connects you to the growing Kali Linux community, one of the oldest, largest,
most active, and most vibrant in our industry.
On behalf of Muts and the rest of the amazing Kali team, congratulations on taking the first step
to mastering Kali Linux!
Johnny Long
February 2017

Preface XV
 Foreword
The sixteen high-end laptops ordered for your pentesting team just arrived, and you have been
tasked to set them up—for tomorrow’s offsite engagement. You install Kali and boot up one of the
laptops only to find that it is barely usable. Despite Kali’s cutting-edge kernel, the network cards
and mouse aren’t working, and the hefty NVIDIA graphics card and GPU are staring at you blankly,
because they lack properly installed drivers. You sigh.
In Kali Live mode, you quickly type lspci into a console, then squint. You scroll through the
hardware listing: “PCI bridge, USB controller, SATA controller. Aha! Ethernet and Network con-
trollers.” A quick Google search for their respective model numbers, cross referenced with the
Kali kernel version, reveals that these cutting-edge drivers haven’t reached the mainline kernel
yet.
But all is not lost. A plan is slowly formulating in your head, and you thank the heavens for the
Kali Linux Revealed book that you picked up a couple of weeks ago. You could use the Kali Live-
Build system to create a custom Kali ISO, which would have the needed drivers baked into the
installation media. In addition, you could include the NVIDIA graphics drivers as well as the CUDA
libraries needed to get that beast of a GPU to talk nicely to hashcat, and have it purr while cracking
password hashes at blistering speeds. Heck, you could even throw in a custom wallpaper with a
Microsoft Logo on it, to taunt your team at work.
Since the hardware profiles for your installations are identical, you add a preseeded boot option to
the ISO, so that your team can boot off a USB stick and have Kali installed with no user interaction—
the installation takes care of itself, full disk encryption and all.
Perfect! You can now generate an updated version of Kali on demand, specifically designed and
optimized for your hardware. You saved the day. Mission complete!
With the deluge of hardware hitting the market, this scenario is becoming more common for
those of us who venture away from mainstream operating systems, in search of something leaner,
meaner, or more suitable to our work and style.
This is especially applicable to those attracted to the security field, whether it be an alluring hobby,
fascination, or line of work. As newcomers, they often find themselves stumped by the environ-
ment or the operating system. For many newcomers Kali is their first introduction to Linux.
We recognized this shift in our user base a couple of years back, and figured that we could help
our community by creating a structured, introductory book that would guide users into the world
 of security, while giving them all the Linux sophistication they would need to get started. And so,
the Kali book was born—now available free over the Internet for the benefit of anyone interested
in entering the field of security through Kali Linux.
As the book started taking shape, however, we quickly realized that there was untapped potential.
This would be a great opportunity to go further than an introductory Kali Linux book and explore
some of the more interesting and little-known features. Hence, the name of the book: Kali Linux
Revealed.
By the end, we were chuffed with the result. The book answered all our requirements and I’m
proud to say it exceeded our expectations. We came to the realization that we had inadvertently
enlarged the book’s potential user base. It was no longer intended only for newcomers to the
security field, but also included great information for experienced penetration testers who needed
to improve and polish their control of Kali Linux—allowing them to unlock the full potential of
our distribution. Whether they were fielding a single machine or thousands across an enterprise,
making minor configuration changes or completely customizing down to the kernel level, building
their own repositories, touching the surface or delving deep into the amazing Debian package
management system, Kali Linux Revealed provides the roadmap.
With your map in hand, on behalf of myself and the entire Kali Linux team, I wish you an exciting,
fun, fruitful, and “revealing” journey!
Muts
February 2017

XVIII Kali Linux Revealed

 Introduction
Kali Linux is the world’s most powerful and popular penetration testing platform, used by security
professionals in a wide range of specializations, including penetration testing, forensics, reverse
engineering, and vulnerability assessment. It is the culmination of years of refinement and the
result of a continuous evolution of the platform, from WHoppiX to WHAX, to BackTrack, and now
to a complete penetration testing framework leveraging many features of Debian GNU/Linux and
the vibrant open source community worldwide.
Kali Linux has not been built to be a simple collection of tools, but rather a flexible framework
that professional penetration testers, security enthusiasts, students, and amateurs can customize
to fit their specific needs.

Why This Book?

Kali Linux is not merely a collection of various information security tools that are installed on a
standard Debian base and preconfigured to get you up and running right away. To get the most
out of Kali, it is important to have a thorough understanding of its powerful Debian GNU/Linux
underpinnings (which support all those great tools) and learning how you can put them to use in
your environment.
Although Kali is decidedly multi-purpose, it is primarily designed to aid in penetration testing.
The objective of this book is not only to help you feel at home when you use Kali Linux, but also to
help improve your understanding and streamline your experience so that when you are engaged
in a penetration test and time is of the essence, you won’t need to worry about losing precious
minutes to install new software or enable a new network service. In this book, we will introduce
you first to Linux, then we will dive deeper as we introduce you to the nuances specific to Kali
Linux so you know exactly what is going on under the hood.
This is invaluable knowledge to have, particularly when you are trying to work under tight time
constraints. It is not uncommon to require this depth of knowledge when you are getting set up,
troubleshooting a problem, struggling to bend a tool to your will, parsing output from a tool, or
leveraging Kali in a larger-scale environment.
 Is This Book for You?

If you are eager to dive into the intellectually rich and incredibly fascinating field of information
security, and have rightfully selected Kali Linux as a primary platform, then this book will help
you in that journey. This book is written to help first-time Linux users, as well as current Kali
users seeking to deepen their knowledge about the underpinnings of Kali, as well as those who
have used Kali for years but who are looking to formalize their learning, expand their use of Kali,
and fill in gaps in their knowledge.
In addition, this book can serve as a roadmap, technical reference, and study guide for those pur-
suing the Kali Linux Certified Professional certification.

General Approach and Book Structure

This book has been designed so that you can put your hands on Kali Linux right from the start.
You don’t have to read half of the book to get started. Every topic is covered in a very pragmatic
manner, and the book is packed with samples and screenshots to help make the explanations more
concrete.
In chapter 1, “About Kali Linux” [page 2], we define some basic terminology and explain the pur-
pose of Kali Linux. In chapter 2, “Getting Started with Kali Linux” [page 14], we guide you step-by-
step from the download of the ISO image to getting Kali Linux running on your computer. Next
comes chapter 3, “Linux Fundamentals” [page 48] which supplies the basic knowledge that you
need to know about any Linux system, such as its architecture, installation process, file system
hierarchy, permissions, and more.
At this point, you have been using Kali Linux as live system for a while. With chapter 4, “Installing
Kali Linux” [page 66] you will learn how to make a permanent Kali Linux installation (on your hard
disk) and with chapter 5, “Configuring Kali Linux” [page 108] how to tweak it to your liking. As
a regular Kali user, it is time to get familiar with the important resources available to Kali users:
chapter 6, “Helping Yourself and Getting Help” [page 128] gives you the keys to deal with the
unexpected problems that you will likely face.
With the basics well covered, the rest of the book dives into more advanced topics: chapter 7,
“Securing and Monitoring Kali Linux” [page 156] gives you tips to ensure that your Kali Linux
installation meets your security requirements. Next, chapter 8, “Debian Package Management”
[page 176] explains how to leverage the full potential of the Debian packaging ecosystem. And
in chapter 9, “Advanced Usage” [page 228], you learn how to create a fully customized Kali Linux
ISO image. All those topics are even more relevant when you deploy Kali Linux at scale in an
enterprise as documented in chapter 10, “Kali Linux in the Enterprise” [page 258].

XX Kali Linux Revealed

The last chapter, chapter 11, “Introduction to Security Assessments” [page 284], makes the link
between everything that you have learned in this book and the day-to-day work of security pro-
fessionals.

Acknowledgments of Raphaël Hertzog

I would like to thank Mati Aharoni: in 2012, he got in touch with me because I was one out of
dozens of Debian consultants and he wanted to build a successor to BackTrack that would be based
on Debian. That is how I started to work on Kali Linux, and ever since I have enjoyed my journey
in the Kali world.
Over the years, Kali Linux got closer to Debian GNU/Linux, notably with the switch to Kali Rolling,
based on Debian Testing. Now most of my work, be it on Kali or on Debian, provides benefits to the
entire Debian ecosystem. And this is exactly what keeps me so motivated to continue, day after
day, month after month, year after year.
Working on this book is also a great opportunity that Mati offered me. It is not the same kind
of work but it is equally rewarding to be able to help people and share with them my expertise
of the Debian/Kali operating system. Building on my experience with the Debian Administrator’s
Handbook, I hope that my explanations will help you to get started in the fast-moving world of
computer security.
I would also like to thank all the Offensive Security persons who were involved in the book: Jim
O’Gorman (co-author of some chapters), Devon Kearns (reviewer), Ron Henry (technical editor),
Joe Steinbach and Tony Cruse (project managers). And thank you to Johnny Long who joined to
write the preface but ended up reviewing the whole book.

Acknowledgments of Jim O’Gorman

I would like to thank everyone involved in this project for their contributions, of which mine were
only a small part. This book, much like Kali Linux itself was a collaborative project of many hands
making light work. Special thanks to Raphaël, Devon, Mati, Johnny, and Ron for taking on the
lion’s share of the effort. Without them, this book would not have come together.

Acknowledgments of Mati Aharoni

It has been a few years since Kali Linux was first released, and since day one, I have always dreamt
of publishing an official book which covers the Kali operating system as a whole. It is therefore
a great privilege for me to finally see such a book making it out to the public. I would like to
sincerely thank everyone involved in the creation of this project—including Jim, Devon, Johnny,

Introduction XXI
 and Ron. A very special thanks goes to Raphaël for doing most of the heavy lifting in this book,
and bringing in his extensive expertise to our group.

Acknowledgments of Joe O’Gorman - 2021 Revision

Kali Linux has changed a lot since Kali Linux Revealed first released back in 2017. From additional
developers to moving away from using root as the default user, lots of progress has been made
over the years. Kali Linux Revealed was due for an updated revision, and I am honored for the
opportunity to have contributed to this epic project during the revision process.

XXII Kali Linux Revealed

 Keywords

Linux distribution
Debian derivative
Purpose
Features
Policies
 Chapter

About Kali Linux 1

Contents

A Bit of History 2 Relationship with Debian 4 Purpose and Use Cases 5 Main Kali Linux Features 8
Kali Linux Policies 10 Summary 11
 Kali Linux1 is an enterprise-ready security auditing Linux distribution based on Debian
GNU/Linux. Kali is aimed at security professionals and IT administrators, enabling them to con-
duct advanced penetration testing, forensic analysis, and security auditing.

What is a Linux Although it is commonly used as a name for the entire operating system, Linux is
Distribution? just the name of the kernel, a piece of software that handles interactions between the
hardware and end-user applications.
The expression Linux distribution, on the other hand, refers to a complete operating
system (OS) built on top of the Linux kernel, usually including an installation pro-
gram and many applications, which are either pre-installed or packaged in an easily
installable way.
Debian GNU/Linux2 is a leading generic Linux distribution, known for its quality and
stability. Kali Linux builds on the work of the Debian project and adds over 400 special-
purpose packages of its own, all related to information security, particularly the field
of penetration testing.
Debian is a free software project providing multiple versions of its operating system
and we often use the term distribution to refer to a specific version of it, for exam-
ple the Debian Stable or Debian Testing distributions. The same also applies to Kali
Linux—with the Kali Rolling distribution, for example.

1.1. A Bit of History

The Kali Linux project began quietly in 2012, when Offensive Security decided that they wanted to
replace their venerable BackTrack Linux project, which was manually maintained, with something
that could become a genuine Debian derivative3 , complete with all of the required infrastructure
and improved packaging techniques. The decision was made to build Kali on top of the Debian dis-
tribution because it is well known for its quality, stability, and wide selection of available software.
That is why I (Raphaël) got involved in this project, as a Debian consultant.
The first release (version 1.0) happened one year later, in March 2013, and was based on Debian
7 “Wheezy”, Debian’s stable distribution at the time. In that first year of development, we pack-
aged hundreds of pen-testing-related applications and built the infrastructure. Even though the
number of applications is significant, the application list has been meticulously curated, drop-
ping applications that no longer worked or that duplicated features already available in better
programs.
During the two years following version 1.0, Kali released many incremental updates, expanding
the range of available applications and improving hardware support, thanks to newer kernel re-
leases. With some investment in continuous integration, we ensured that all important packages
1
https://www.kali.org/
2
https://www.debian.org/
3
https://wiki.debian.org/Derivatives/Census

2 Kali Linux Revealed

were kept in an installable state and that customized live images (a hallmark of the distribution)
could always be created.
In 2015, when Debian 8 “Jessie” came out, we worked to rebase Kali Linux on top of it. While
Kali Linux 1.x avoided the GNOME Shell (relying on GNOME Fallback instead), in this version we
decided to embrace and enhance it: we added some GNOME Shell extensions to acquire missing
features, most notably the Applications menu. The result of that work became Kali Linux 2.0,
published in August 2015.

Xfce is Kali Linux’s A desktop environment is a collection of graphical applications that share a common
Default Desktop graphical toolkit and that are meant to be used together on user workstations. Desk-
Environment top environments are generally not used in servers. They usually provide an applica-
tion launcher, a file manager, a web browser, an email client, an office suite, etc.
Xfce4 is one of the most popular lightweight desktop environments, perfect for our
live ISO images and is included on the main installer ISO images provided by Kali
Linux (together with GNOME5 , KDE6 ). You can select a desktop environment of your
choosing during installation. Otherwise, post-installation you have the additional
options of; i37 , i3-gaps8 , MATE9 , Enlightenment10 , LXDE11 .

In parallel, we increased our efforts to ensure that Kali Linux always has the latest version of all
pen-testing applications. Unfortunately, that goal was a bit at odds with the use of Debian Stable12
as a base for the distribution, because it required us to backport many packages. This is due to the
fact that Debian Stable puts a priority on the stability of the software, often causing a long delay
from the release of an upstream update to when it is integrated into the distribution. Given our
investment in continuous integration, it was quite a natural move to rebase Kali Linux on top of
Debian Testing13 so that we could benefit from the latest version of all Debian packages as soon
as they were available. Debian Testing has a much more aggressive update cycle, which is more
compatible with the philosophy of Kali Linux.
This is, in essence, the concept of Kali Rolling. While the rolling distribution has been available
for quite a while, Kali 2016.1 was the first release to officially embrace the rolling nature of that
distribution: when you install the latest Kali release, your system actually tracks the Kali Rolling
distribution and every single day you get new updates. In the past, Kali releases were snapshots of
the underlying Debian distribution with Kali-specific packages injected into it.
4
https://www.xfce.org/
5
https://www.gnome.org/
6
https://kde.org/
7
https://i3wm.org/
8
https://github.com/Airblader/i3
9
https://mate-desktop.org/
10
https://www.enlightenment.org/
11
https://www.lxde.org/
12
https://www.debian.org/releases/stable/
13
https://www.debian.org/releases/testing/

Chapter 1 — About Kali Linux 3

 A rolling distribution has many benefits but it also comes with multiple challenges, both for those
of us who are building the distribution and for the users who have to cope with a never-ending
flow of updates and sometimes backwards-incompatible changes. This book aims to give you the
knowledge required to deal with everything you may encounter while managing your Kali Linux
installation.

1.2. Relationship with Debian

The Kali Linux distribution is based on Debian Testing14 . Therefore, most of the packages available
in Kali Linux come straight from this Debian repository.
While Kali Linux relies heavily on Debian, it is also entirely independent15 in the sense that we
have our own infrastructure and retain the freedom to make any changes we want.

1.2.1. The Flow of Packages

On the Debian side, the contributors are working every day on updating packages and uploading
them to the Debian Unstable distribution (Unstable is also known as sid16 ). From there, packages
migrate to the Debian Testing distribution once the most troublesome bugs have been taken out.
The migration process also ensures that no dependencies are broken in Debian Testing. The goal
is that Testing is always in a usable (or even releasable!) state.
Debian Testing’s goals align quite well with those of Kali Linux so we picked it as the base. To add
the Kali-specific packages in the distribution, we follow a two-step process.
First, we take Debian Testing and force-inject our own Kali packages (located in our kali-dev-only
repository) to build the kali-dev repository. This repository will break from time to time: for in-
stance, our Kali-specific packages might not be installable until they have been recompiled against
newer libraries. In other situations, packages that we have forked might also have to be updated,
either to become installable again, or to fix the installability of another package that depends on
a newer version of the forked package. In any case, kali-dev is not for end-users.
kali-rolling is the distribution that Kali Linux users are expected to track and is built out of kali-dev
in the same way that Debian Testing is built out of Debian Unstable. Packages migrate only when
all dependencies can be satisfied in the target distribution.

14
https://www.debian.org/releases/testing/
15
https://www.debian.org/derivatives/
16
https://www.debian.org/releases/sid/

4 Kali Linux Revealed

1.2.2. Managing the Difference with Debian

As a design decision, we try to minimize the number of forked packages as much as possible. How-
ever, in order to implement some of Kali’s unique features, some changes must be made. To limit
the impact of these changes, we strive to send them upstream, either by integrating the feature di-
rectly, or by adding the required hooks so that it is straightforward to enable the desired features
without further modifying the upstream packages themselves.
The Kali Package Tracker17 helps us to keep track of our divergence with Debian. At any time, we
can look up which package has been forked and whether it is in sync with Debian, or if an update
is required. All our packages are maintained in Git repositories18 hosting a Debian branch and a
Kali branch side-by-side. Thanks to this, updating a forked package is a simple two-step process:
update the Debian branch and then merge it into the Kali branch.
While the number of forked packages in Kali is relatively low, the number of additional packages
is rather high: in January 2021 there were almost 50019 . Most of these packages are free software
complying with the Debian Free Software Guidelines20 and our ultimate goal would be to maintain
those packages within Debian whenever possible. That is why we strive to comply with the Debian
Policy21 and to follow the good packaging practices used in Debian. Unfortunately, there are also
quite a few exceptions where proper packaging was nearly impossible to create. As a result of
time being scarce, few packages have been pushed to Debian.

1.3. Purpose and Use Cases

While Kali’s focus can be quickly summarized as “penetration testing and security auditing”, there
are many different tasks involved behind those activities. Kali Linux is built as a platform, because
it includes many tools covering very different use cases (though they may certainly be used in
combination during a penetration test).
For example, Kali Linux can be used on various types of computers: obviously on the laptops of
penetration testers, but also on servers of system administrators wishing to monitor their net-
work, on the workstations of forensic analysts, and more unexpectedly, on stealthy embedded de-
vices, typically with ARM CPUs, that can be dropped in the range of a wireless network or plugged
in the computer of target users. Many ARM devices are also perfect attack machines due to their
small form factors and low power requirements. Kali Linux can also be deployed in the cloud to
quickly build a farm of password-cracking machines and on mobile phones and tablets to allow
for truly portable penetration testing.

17
https://pkg.kali.org/derivative/kali-dev/
18
https://gitlab.com/kalilinux/packages
19
https://pkg.kali.org/derivative/kali-roll/
20
https://www.debian.org/social_contract
21
https://www.debian.org/doc/debian-policy/

Chapter 1 — About Kali Linux 5

 But that is not all; penetration testers also need servers: to use collaboration software within a
team of pen-testers, to set up a web server for use in phishing campaigns, to run vulnerability
scanning tools, and other related activities.
Once you have booted Kali, you will quickly discover that Kali Linux’s main menu is organized by
theme across the various kinds of tasks and activities that are relevant for pen-testers and other
information security professionals as shown in Figure 1.1, “Kali Linux’s Applications Menu” [page
6].

Figure 1.1 Kali Linux’s Applications Menu

These tasks and activities include:

• Information Gathering: Collecting data about the target network and its structure, identify-
ing computers, their operating systems, and the services that they run. Identifying poten-
tially sensitive parts of the information system. Extracting all sorts of listings from running
directory services.

• Vulnerability Analysis: Quickly testing whether a local or remote system is affected by a

number of known vulnerabilities or insecure configurations. Vulnerability scanners use
databases containing thousands of signatures to identify potential vulnerabilities.

• Web Application Analysis: Identifying misconfigurations and security weaknesses in web

applications. It is crucial to identify and mitigate these issues given that the public avail-
ability of these applications makes them ideal targets for attackers.

6 Kali Linux Revealed

• Database Assessment: From SQL injection to attacking credentials, database attacks are a
common vector for attackers. Tools that test for attack vectors ranging from SQL injection
to data extraction and analysis can be found here.
• Password Attacks: Authentication systems are always a go-to attack vector. Many useful
tools can be found here, from online password attack tools to offline attacks against the
encryption or hashing systems.
• Wireless Attacks: The pervasive nature of wireless networks means that they will always
be a commonly attacked vector. With its wide range of support for multiple wireless cards,
Kali is an obvious choice for attacks against multiple types of wireless networks.
• Reverse Engineering: Reverse engineering is an activity with many purposes. In support
of offensive activities, it is one of the primary methods for vulnerability identification and
exploit development. On the defensive side, it is used to analyze malware employed in tar-
geted attacks. In this capacity, the goal is to identify the capabilities of a given piece of
tradecraft.
• Exploitation Tools: Exploiting, or taking advantage of a (formerly identified) vulnerability,
allows you to gain control of a remote machine (or device). This access can then be used
for further privilege escalation attacks, either locally on the compromised machine, or on
other machines accessible on its local network. This category contains a number of tools
and utilities that simplify the process of writing your own exploits.
• Sniffing & Spoofing: Gaining access to the data as they travel across the network is often ad-
vantageous for an attacker. Here you can find spoofing tools that allow you to impersonate
a legitimate user as well as sniffing tools that allow you to capture and analyze data right
off the wire. When used together, these tools can be very powerful.
• Post Exploitation: Once you have gained access to a system, you will often want to maintain
that level of access or extend control by laterally moving across the network. Tools that
assist in these goals are found here.
• Forensics: Forensic Linux live boot environments have been very popular for years now.
Kali contains a large number of popular Linux-based forensic tools allowing you to do ev-
erything from initial triage, to data imaging, to full analysis and case management.
• Reporting Tools: A penetration test is only complete once the findings have been reported.
This category contains tools to help collate the data collected from information-gathering
tools, discover non-obvious relationships, and bring everything together in various reports.
• Social Engineering Tools: When the technical side is well-secured, there is often the possi-
bility of exploiting human behavior as an attack vector. Given the right influence, people
can frequently be induced to take actions that compromise the security of the environment.
Did the USB key that the secretary just plugged in contain a harmless PDF? Or was it also a
Trojan horse that installed a backdoor? Was the banking website the accountant just logged
into the expected website or a perfect copy used for phishing purposes? This category con-
tains tools that aid in these types of attacks.

Chapter 1 — About Kali Linux 7

 1.4. Main Kali Linux Features

Kali Linux is a Linux distribution that contains its own collection of hundreds of software tools
specifically tailored for their target users—penetration testers and other security professionals.
It also comes with an installation program to completely setup Kali Linux as the main operating
system on any computer.
This is pretty much like all other existing Linux distributions but there are other features that
differentiate Kali Linux, many of which are tailored to the specific needs of penetration testers.
Let’s have a look at some of those features.

1.4.1. A Live System

Alongside the main installer ISO images, Kali Linux offers a separate live ISO image to download.
This allows you to use Kali Linux as a bootable live system. In other words, you can use Kali Linux
without installing it, just by booting the ISO image (usually after having copied the image onto a
USB key).
The live system contains the tools most commonly used by penetration testers, so even if your day-
to-day system is not Kali Linux, you can simply insert the disk or USB key and reboot to run Kali.
However, keep in mind that the default configuration will not preserve changes between reboots.
If you configure persistence with a USB key (see section 9.4, “Adding Persistence to the Live ISO
with a USB Key” [page 246]), then you can tweak the system to your liking (modify config files,
save reports, upgrade software, and install additional packages, for example), and the changes
will be retained across reboots.

1.4.2. Forensics Mode

In general, when doing forensic work on a system, you want to avoid any activity that would alter
the data on the analyzed system in any way. Unfortunately, modern desktop environments tend
to interfere with this objective by trying to auto-mount any disk(s) they detect. To avoid this
behavior, Kali Linux has a forensics mode that can be enabled from the boot menu: it will disable
all such features.
The live system is particularly useful for forensics purposes, because it is possible to reboot any
computer into a Kali Linux system without accessing or modifying its hard disks.

8 Kali Linux Revealed

1.4.3. A Custom Linux Kernel

Kali Linux always provides a customized recent Linux kernel22 , based on the version in Debian
Unstable. This ensures solid hardware support, especially for a wide range of wireless devices.
The kernel is patched23 for wireless injection support since many wireless security assessment
tools rely on this feature.
Since many hardware devices require up-to-date firmware files (found in /lib/firmware/), Kali
installs them all by default—including the firmware available in Debian’s non-free section. Those
are not installed by default in Debian, because they are closed-source and thus not part of Debian
proper.

1.4.4. Completely Customizable

Kali Linux is built by penetration testers for penetration testers, but we understand that not ev-
eryone will agree with our design decisions or choice of tools to include by default. With this in
mind, we always ensure that Kali Linux is easy to customize based on your own needs and prefer-
ences. To this end, we publish the live-build24 configuration used to build the official Kali images
so you can customize it to your liking. It is very easy to start from this published configuration
and implement various changes based on your needs thanks to the versatility of live-build.
Live-build includes many features to modify the installed system, install supplementary files, in-
stall additional packages, run arbitrary commands, and change the values pre-seeded to debconf.

1.4.5. A Trustable Operating System

Users of a security distribution rightfully want to know that it can be trusted and that it has been
developed in plain sight, allowing anyone to inspect the source code. Kali Linux is developed by a
small team25 of knowledgeable developers working transparently and following the best security
practices: they upload signed source packages, which are then built on dedicated build daemons.
The packages are then checksummed and distributed as part of a signed repository.
The work done on the packages can be fully reviewed through the packaging Git repositories26
(which contain signed tags) that are used to build the Kali source packages. The evolution of each
package can also be followed through the Kali package tracker27 .

22
https://pkg.kali.org/pkg/linux
23
https://gitlab.com/kalilinux/packages/linux/-/blob/kali/master/debian/patches/series
24
https://gitlab.com/kalilinux/build-scripts/live-build-config
25
https://www.kali.org/about-us/
26
https://gitlab.com/kalilinux/packages
27
https://pkg.kali.org/

Chapter 1 — About Kali Linux 9

 1.4.6. Usable on a Wide Range of ARM Devices

Kali Linux provides binary packages for the armel, armhf, and arm64 ARM architectures. Thanks
to the easily installable images provided by Offensive Security, Kali Linux can be deployed on
many interesting devices, from smartphones and tablets to Wi-Fi routers and computers of various
shapes and sizes.

1.5. Kali Linux Policies

While Kali Linux strives to follow the Debian policy whenever possible, there are some areas where
we made significantly different design choices due to the particular needs of security profession-
als.

1.5.1. Network Services Disabled by Default

In contrast to Debian, Kali Linux disables any installed service that would listen on a public net-
work interface by default, such as HTTP and SSH.
The rationale behind this decision is to minimize exposure during a penetration test when it is
detrimental to announce your presence and risk detection because of unexpected network inter-
actions.
You can still manually enable any services of your choosing by running sudo systemctl enable
service. We will get back to this in chapter 5, “Configuring Kali Linux” [page 108] later in this
book.

1.5.2. A Curated Collection of Applications

Debian aims to be the universal operating system and puts very few limits on what gets packaged,
provided that each package has a maintainer.
By way of contrast, Kali Linux does not package every penetration testing tool available. Instead,
we aim to provide only the best freely-licensed tools covering most tasks that a penetration tester
might want to perform.
Kali developers working as penetration testers drive the selection process and we leverage their
experience and expertise to make enlightened choices. In some cases this is a matter of fact, but
there are other, more difficult choices that simply come down to personal preference.
Here are some of the points considered when a new application gets evaluated:
• The usefulness of the application in a penetration testing context
• The unique functionality of the application’s features

10 Kali Linux Revealed

 • The application’s license
• The application’s resource requirements
Maintaining an updated and useful penetration testing tool repository is a challenging task. We
welcome tool suggestions within a dedicated category (New Tool Requests) in the Kali Bug Tracker28 .
New tool requests are best received when the submission is well-presented, including an explana-
tion of why the tool is useful, how it compares to other similar applications, and so on.

1.6. Summary

In this chapter we have introduced you to Kali Linux, provided a bit of history, run through some
of the primary features, and presented several use cases. We have also discussed some of the
policies we have adopted when developing Kali Linux.
Summary Tips:
• Kali Linux29 is an enterprise-ready security auditing Linux distribution based on Debian
GNU/Linux. Kali is aimed at security professionals and IT administrators, enabling them
to conduct advanced penetration testing, forensic analysis, and security auditing.
• Unlike most mainstream operating systems, Kali Linux is a rolling distribution, which means
that you will receive updates every single day.
• The Kali Linux distribution is based on Debian Testing30 . Therefore, most of the packages
available in Kali Linux come straight from this Debian repository.
• While Kali’s focus can be quickly summarized with “penetration testing and security audit-
ing”, there are several use cases including system administrators wishing to monitor their
networks, forensic analysis, embedded device installations, wireless monitoring, installa-
tion on mobile platforms, and more.
• Kali’s menus make it easy to get to tools for various tasks and activities including: vulnera-
bility analysis, web application analysis, database assessment, password attacks, wireless at-
tacks, reverse engineering, exploitation tools, sniffing and spoofing, post exploitation tools,
forensics, reporting tools, and social engineering tools.
• Kali Linux has many advanced features including: use as a live (non-installed) system, a ro-
bust and safe forensics mode, a custom Linux kernel, ability to completely customize the
system, a trusted and secure base operating system, ARM installation capability, secure de-
fault network policies, and a curated set of applications.
In the next chapter (chapter 2, “Getting Started with Kali Linux” [page 14]), we will jump in and
try out Kali Linux thanks to its live mode.
28
https://bugs.kali.org/
29
https://www.kali.org
30
https://www.debian.org/releases/testing/

Chapter 1 — About Kali Linux 11

Keywords

Download
ISO image
Live boot
 Chapter

Getting Started with 2

Kali Linux
Contents

Downloading a Kali ISO Image 14 Booting a Kali ISO Image in Live Mode 24 Summary 44
 Unlike some other operating systems, Kali Linux makes getting started easy, thanks to the fact that
a live disk image is available, meaning that you can boot the downloaded image without following
any prior installation procedure. This means you can use the same image for testing, for use as
a bootable USB or DVD-ROM image in a forensics case, or for installing as a permanent operating
system on physical or virtual hardware.
Because of this simplicity, it is easy to forget that certain precautions must be taken. Kali users
are often the target of those with ill intentions, whether state sponsored groups, elements of orga-
nized crime, or individual hackers. The open-source nature of Kali Linux makes it relatively easy
to build and distribute fake versions, so it is essential that you get into the habit of downloading
from original sources and verifying the integrity and the authenticity of your download. This is
especially relevant to security professionals who often have access to sensitive networks and are
entrusted with client data.

2.1. Downloading a Kali ISO Image

2.1.1. Where to Download

The only official source of Kali Linux ISO images is the Downloads section of the Kali website. Due
to its popularity, numerous sites offer Kali images for download, but they should not be considered
trustworthy and indeed may be infected with malware or otherwise cause irreparable damage to
your system.
è https://www.kali.org/downloads/
The website is available over HTTPS, making it difficult to impersonate. Being able to carry out
a man-in-the-middle attack is not sufficient as the attacker would also need a www.kali.org cer-
tificate signed by a Transport Layer Security (TLS) certificate authority that is trusted by the vic-
tim’s browser. Because certificate authorities exist precisely to prevent this type of problem, they
deliver certificates only to people whose identities have been verified and who have provided
evidence that they control the corresponding website.

cdimage.kali.org The links found on the download page point to the cdimage.kali.org domain, which
redirects to a mirror close to you, improving your transfer speed while reducing the
burden on Kali’s central servers.
A list of available mirrors can be found here:
è https://cdimage.kali.org/README.mirrorlist

2.1.2. What to Download

The official download page shows a short list of ISO images, as shown in Figure 2.1, “List of Images
Offered for Download” [page 15].

14 Kali Linux Revealed

Figure 2.1 List of Images Offered for Download

Chapter 2 — Getting Started with Kali Linux 15

 All disk images labeled 64-bit or 32-bit refer to images suitable for CPUs, found in most modern
desktop and laptop computers. If you are downloading for use on a fairly modern machine, it most
likely contains a 64-bit processor. If you are unsure, rest assured that all 64-bit processors can run
32-bit instructions. You can always download and run the 32-bit image. The reverse is not true,
however. Refer to the sidebar for more detailed information.
If you are planning to install Kali on an ARM-based device, you must refer to Offensive Security’s
download page1 for the list of available devices.

Is My CPU 64-bit or Under Microsoft Windows, you can find this information by running the System Infor-
32-bit? mation application (found in the Accessories > System Tools folder). On the System
Summary screen, you can inspect the System Type field: it will contain ”x64-based
PC” for a 64-bit CPU or “x86-based PC” for a 32-bit CPU.
Under OS X/macOS, there is no standard application showing this information but
you can still infer it from the output of the uname -m command run on the terminal.
It will return x86_64 on a system with a 64-bit kernel (which can only run on a 64-bit
CPU), systems with a 32-bit kernel, it will return i386 or something similar (i486,
i586, or i686), and on systems with an arm64 kernel, it will return arm64. Any 32-
bit kernel can run on a 64-bit CPU, but since Apple controls the hardware and the
software, it is unlikely you will find this configuration.
Under Linux, you can inspect the flags field in the /proc/cpuinfo virtual file. If it
contains the lm attribute, then your CPU is a 64-bit; otherwise, it is a 32-bit. The
following command line will tell you what kind of CPU you have:

$ grep -qP ’^flags\s*:.*\blm\b’ /proc/cpuinfo && echo 64-bit

å || echo 32-bit
64-bit

Now that you know whether you need a 64-bit or 32-bit image, there is only one step left: selecting
the kind of image. The available images differ in how they go about installation. The Installer
and NetInstaller images, specialized for a straightforward install featuring selectable installation
options, do not come with the ability to run the live system. The Live image, however, comes
with the ability to run the live system or start the installation process, although it does lack the
selectable options featured in the installation images. The selectable options include choices in
desktop environments as well as which collection of packages to install. We will be using the live
image throughout this book.
Once you have decided on the image you need, you can download the image by clicking on the
title in the respective row. Alternatively, you can download the image from the BitTorrent peer-
to-peer network by clicking on ”Torrent,” provided that you have a BitTorrent client associated
with the .torrent extension.
While your chosen ISO image is downloading, you should take note of the checksum written in
the sha256sum column. Once you have downloaded your image, use this checksum to verify that
1
https://www.offensive-security.com/kali-linux-arm-images/

16 Kali Linux Revealed

the downloaded image matches the one the Kali development team put online (see section 2.1.3,
“Verifying Integrity and Authenticity” [page 17]).

2.1.3. Verifying Integrity and Authenticity

Security professionals must verify the integrity of their tools to not only protect their data and
networks but also those of their clients. While the Kali download page and links are TLS-protected,
Kali relies on a network of external mirrors to distribute the image means that you should not
blindly trust what you download. The mirror you were directed to may have been compromised,
or you might be the victim of an attack yourself.
To alleviate this, the Kali project always provides checksums of the images it distributes. But to
make such a check effective, you must be sure that the checksum you grabbed is effectively the
checksum published by the Kali Linux developers. You have different ways to ascertain this.

Relying on the TLS-Protected Website

When you retrieve the checksum from the TLS-protected download webpage, its origin is indi-
rectly guaranteed by the X.509 certificate security model: the content you see comes from a web
site that is effectively under the control of the person who requested the TLS certificate.
Now you should generate the checksum of your downloaded image and ensure that it matches
what you recorded from the Kali website:
$ sha256sum kali-linux-2020.3-live-amd64.iso
1a0b2ea83f48861dd3f3babd5a2892a14b30a7234c8c9b5013a6507d1401874f kali-linux-2020.3-live-amd64.iso

If your generated checksum matches the one on the Kali Linux download page, you have the cor-
rect file. If the checksums differ, there is a problem, although this does not always indicate a com-
promise or an attack; downloads occasionally get corrupted as they traverse the Internet. Try
your download again, from another official Kali mirror, if possible (see “cdimage.kali.org” [page
14] for more information about available mirrors).

Relying on PGP’s Web of Trust

If you don’t trust HTTPS for authentication, you are a bit paranoid but rightfully so. There are
many examples of badly managed certificate authorities that issued rogue certificates, which
ended up being misused. You may also be the victim of a “friendly” man-in-the-middle at-
tack implemented on many corporate networks, using a custom, browser-implanted trust store
that presents fake certificates to encrypted websites, allowing corporate auditors to monitor en-
crypted traffic.

Chapter 2 — Getting Started with Kali Linux 17

 For cases like this, we also provide a GnuPG key that we use to sign the checksums of the images
we provide. The key’s identifiers and its fingerprints are shown here:
pub rsa4096 2012-03-05 [SC] [expires: 2023-01-16]
44C6 513A 8E4F B3D3 0875 F758 ED44 4FF0 7D8D 0BF6
uid Kali Linux Repository <[email protected]>
sub rsa4096 2012-03-05 [E] [expires: 2023-01-16]

This key is part of a global web of trust because it has been signed at least by me (Raphaël Hertzog)
and I am part of the web of trust due to my heavy GnuPG usage as a Debian developer.
The PGP/GPG security model is very unique. Anyone can generate any key with any identity, but
you would only trust that key if it has been signed by another key that you already trust. When you
sign a key, you certify that you met the holder of the key and that you know that the associated
identity is correct. And you define the initial set of keys that you trust, which obviously includes
your own key.
This model has its own limitations so you can opt to download Kali’s public key over HTTPS (or
from a keyserver) and just decide that you trust it because its fingerprint matches what we an-
nounced in multiple places, including just above in this book:
$ wget -q -O - https://archive.kali.org/archive-key.asc | gpg --import
[ or ]
$ gpg --keyserver hkp://keys.gnupg.net --recv-key 44C6513A8E4FB3D30875F758ED444FF07D8D0BF6
gpg: key ED444FF07D8D0BF6: public key ”Kali Linux Repository <[email protected]>” imported
gpg: Total number processed: 1
gpg: imported: 1
[...]
$ gpg --fingerprint 44C6513A8E4FB3D30875F758ED444FF07D8D0BF6
[...]
44C6 513A 8E4F B3D3 0875 F758 ED44 4FF0 7D8D 0BF6
[...]

After you have retrieved the key, you can use it to verify the checksums of the distributed im-
ages. Let’s download the file with the checksums (SHA256SUMS) and the associated signature file
(SHA256SUMS.gpg) and verify the signature:
$ wget http://cdimage.kali.org/current/SHA256SUMS
[...]
$ wget http://cdimage.kali.org/current/SHA256SUMS.gpg
[...]
$ gpg --verify SHA256SUMS.gpg SHA256SUMS
gpg: Signature made Tue 18 Aug 2020 10:31:15 AM EDT
gpg: using RSA key 44C6513A8E4FB3D30875F758ED444FF07D8D0BF6
gpg: Good signature from ”Kali Linux Repository <[email protected]>”

If you get that “Good signature” message, you can trust the content of the SHA256SUMS file and use
it to verify the files you downloaded. Otherwise, there is a problem. You should review whether
you downloaded the files from a legitimate Kali Linux mirror.

18 Kali Linux Revealed

Note that you can use the following command line to verify that the downloaded file has the same
checksum that is listed in SHA256SUMS, provided that the downloaded ISO file is in the same direc-
tory:
$ grep kali-linux-2020.3-live-amd64.iso SHA256SUMS | sha256sum -c
kali-linux-2020.3-live-amd64.iso: OK

If you don’t get OK in response, then the file you have downloaded is different from the one re-
leased by the Kali team. It cannot be trusted and should not be used.

2.1.4. Copying the Image on a DVD-ROM or USB Key

Unless you want to run Kali Linux in a virtual machine, the ISO image is of limited use in and of
itself. You must burn it on a DVD-ROM or copy it onto a USB key to be able to boot your machine
into Kali Linux. We have chosen the Kali live image as we wish to boot from a USB allowing us to
either use a live environment or install Kali Linux’s default configuration.
We won’t cover how to burn the ISO image onto a DVD-ROM, as the process varies widely by plat-
form and environment, but in most cases, right clicking on the .iso file will present a contextual
menu item that executes a DVD-ROM burning application. Try it out!

Warning

In this section, you will learn how to overwrite an arbitrary disk with a Kali
Linux ISO image. Always double-check the target disk before launching
the operation as a single mistake would likely cause complete data loss and
possibly damage your setup beyond repair.

Creating a Bootable Kali USB Drive on Windows

As a prerequisite, you should download and install Win32 Disk Imager:

è https://sourceforge.net/projects/win32diskimager/
Plug your USB key into your Microsoft Windows PC and note the drive designator associated to it
(for example, “E:\”).
Launch Win32 Disk Imager and choose the Kali Linux ISO file that you want to copy on the USB key.
Verify that the letter of the device selected corresponds with that assigned to the USB key. Once
you are certain that you have selected the correct drive, click the Write button and confirm that

Chapter 2 — Getting Started with Kali Linux 19

 you want to overwrite the contents of the USB key as shown in Figure 2.2, “Win32 Disk Imager in
action” [page 20].

Figure 2.2 Win32 Disk Imager in action

Once the copy is completed, safely eject the USB drive from your Microsoft Windows system. You
can now use the USB device to boot Kali Linux.

20 Kali Linux Revealed

Creating a Bootable Kali USB Drive on Linux

Creating a bootable Kali Linux USB key in a Linux environment is easy. The GNOME desktop envi-
ronment, which is installed by default in many Linux distributions, comes with a Disks utility (in
the gnome-disk-utility package). That program shows a list of disks, which refreshes dynamically
when you plug or unplug a disk. When you select your USB key in the list of disks, detailed infor-
mation will appear and will help you confirm that you selected the correct disk. Note that you can
find its device name in the title bar as shown in Figure 2.3, “GNOME Disks” [page 21].

Figure 2.3 GNOME Disks

Click on the menu button and select Restore Disk Image... in the displayed pop-up menu. Select
the ISO image that you formerly downloaded and click on Start Restoring... as shown in Figure 2.4,
“Restore Disk Image Dialog” [page 21].

Figure 2.4 Restore Disk Image Dialog

Chapter 2 — Getting Started with Kali Linux 21

 Enjoy a cup of coffee while it finishes copying the image on the USB key (Figure 2.5, “Progression
of the Image Restoration” [page 22]).

Figure 2.5 Progression of the Image Restoration

Create the Bootable USB Even though the graphical process is fairly straightforward, the operation is just as
Drive from the Command easy for command line users.
Line When you insert your USB key, the Linux kernel will detect it and assign it a name,
which is printed in the kernel logs. You can find its name by inspecting the logs
returned by dmesg.
$ dmesg
[...]
[ 2596.727036] usb 1-2.1: new high-speed USB device number 7 using uhci_hcd
[ 2597.023023] usb 1-2.1: New USB device found, idVendor=0781, idProduct=5575,
å bcdDevice= 1.26
[ 2597.023025] usb 1-2.1: New USB device strings: Mfr=1, Product=2,
å SerialNumber=3
[ 2597.023026] usb 1-2.1: Product: Cruzer Glide
[ 2597.023026] usb 1-2.1: Manufacturer: SanDisk
[ 2597.023026] usb 1-2.1: SerialNumber: 200533495211C0824E58
[ 2597.025989] usb-storage 1-2.1:1.0: USB Mass Storage device detected
[ 2597.026064] scsi host3: usb-storage 1-2.1:1.0
[ 2598.055632] scsi 3:0:0:0: Direct-Access SanDisk Cruzer Glide 1.26
å PQ: 0 ANSI: 5
[ 2598.058596] sd 3:0:0:0: Attached scsi generic sg2 type 0
[ 2598.063036] sd 3:0:0:0: [sdb] 31266816 512-byte logical blocks: (16.0 GB
å /14.9 GiB)
[ 2598.067356] sd 3:0:0:0: [sdb] Write Protect is off
[ 2598.067361] sd 3:0:0:0: [sdb] Mode Sense: 43 00 00 00
[ 2598.074276] sd 3:0:0:0: [sdb] Write cache: disabled, read cache: enabled,
å doesn’t support DPO or FUA
[ 2598.095976] sdb: sdb1
[ 2598.108225] sd 3:0:0:0: [sdb] Attached SCSI removable disk

Now that you know that the USB key is available as /dev/sdb, you can proceed to
copy the image with the dd command:
# dd if=kali-linux-2020.3-live-amd64.iso of=/dev/sdb
6129688+0 records in
6129688+0 records out
3138400256 bytes (3.1 GB, 2.9 GiB) copied, 678.758 s, 4.6 MB/s

22 Kali Linux Revealed

 Note that you need root permissions for this operation to succeed and you should
also ensure that the USB key is unused. That is, you should make sure that none
of its partitions are mounted. The command also assumes that it is run while in the
directory hosting the ISO image, otherwise the full path will need to be provided.
For reference, if stands for “input file” and of for “output file.” The dd command reads
data from the input file and writes it back to the output file. It does not show any
progress information so you must be patient while it is doing its work (It is not unusual
for the command to take more than half an hour!). Look at the write activity LED on
the USB key if you want to double check that the command is working. The statistics
shown above are displayed only when the command has completed. On OS X/macOS,
you can also press CTRL+T during the operation to get statistical information about
the copy including how much data has been copied.

Creating a Bootable Kali USB Drive on OS X/macOS

OS X/macOS is based on UNIX, so the process of creating a bootable Kali Linux USB drive is similar
to the Linux procedure. Once you have downloaded and verified your chosen Kali ISO file, use dd
to copy it over to your USB stick.
To identify the device name of the USB key, run diskutil list to list the disks available on
your system. Next, insert your USB key and run the diskutil list command again. The second
output should list an additional disk. You can determine the device name of the USB key by com-
paring the output from both commands. Look for a new line identifying your USB disk and note
the /dev/diskX where X represents the disk ID.
You should make sure that the USB key is not mounted, which can be accomplished with an explicit
unmount command (assuming /dev/disk6 is the device name of the USB key):
$ diskutil unmount /dev/disk6

Now proceed to execute the dd command. This time, add a supplementary parameter — bs for
block size. It defines the size of the block that is read from the input file and then written to the
output file. We will also utilize the raw disk path (signified by the r before disk) which will allow
faster write speeds.
# dd if=kali-linux-2020.3-live-amd64.iso of=/dev/rdisk2 bs=4m
748+1 records in
748+1 records out
3138400256 bytes transferred in 713.156461 secs (4400718 bytes/sec)

That’s it. Your USB key is now ready and you can boot from it or use it to install Kali Linux.
Booting an Alternate Disk To boot from an alternate drive on an OS X/macOS system, bring up the boot menu by
on OS X/macOS pressing and holding the Option key immediately after powering on the device and
selecting the drive you want to use.
For more information, see Apple’s knowledge base2 .

Chapter 2 — Getting Started with Kali Linux 23

 2.2. Booting a Kali ISO Image in Live Mode

2.2.1. On a Real Computer

As a prerequisite, you need either a USB key prepared (as detailed in the previous section) or a
DVD-ROM burned with a Kali Linux ISO image.
The BIOS/UEFI is responsible for the early boot process and can be configured through a piece of
software called Setup. In particular, it allows users to choose which boot device is preferred. In
this case, you want to select either the DVD-ROM drive or USB drive, depending on which device
you have created. Depending on your BIOS/UEFI, you may have a one time boot menu option,
allowing to temporarily change the boot order.
Starting Setup usually involves pressing a particular key very soon after the computer is powered
on. This key is often Delete or Escape, and sometimes F2, F8, F10 or F12. Most of the time, the
choice is briefly flashed onscreen when the computer powers on, before the operating system
loads.
Once the BIOS/UEFI has been properly configured to boot from your device, booting Kali Linux
is simply a matter of inserting the DVD-ROM or plugging in the USB drive and powering on the
computer.

Disable Secure Boot While the Kali Linux images can be booted in UEFI mode, they do not support secure
boot. You should disable that feature in your machine’s Setup.

2.2.2. In a Virtual Machine

Virtual machines have multiple benefits for Kali Linux users. They are especially useful if you want
to try out Kali Linux but aren’t ready to commit to installing it permanently on your machine or if
you have a powerful system and want to run multiple operating systems simultaneously. This is a
popular choice for many penetration testers and security professionals who need to use the wide
range of tools available in Kali Linux but still want to have full access to their primary operating
system. This also provides them with the ability to archive or securely delete the virtual machine
and any client data it may contain rather than reinstalling their entire operating system.
The snapshot features of virtualization software also make it easy to experiment with potentially
dangerous operations, such as malware analysis, while allowing for an easy way out by restoring
a previous snapshot.
There are many virtualization tools available for all major operating systems, including VirtualBox®,
VMware Workstation®, Xen, KVM, and Hyper-V to name a few. Ultimately, you will use the one that
best suits you but we will cover the two most frequently-used in a desktop context: VirtualBox® and
2
https://support.apple.com/en-gb/guide/mac-help/mchlp1034/mac

24 Kali Linux Revealed

VMware Workstation®, both running on Microsoft Windows 10. If you don’t have corporate policy
constraints or personal preference, our recommendation is that you try out VirtualBox first, as it
is free, works well, is (mostly) open-source, and is available for most operating systems.
For the next sections, we will assume that you have already installed the appropriate virtualization
tool and are familiar with its operation.

Preliminary Remarks

To fully benefit from virtualization, you should have a CPU with the appropriate virtualization
features and they should not be disabled by the BIOS/UEFI. Double check for any “Intel® Virtual-
ization Technology” and/or “Intel® VT-d Feature” options in the machine’s Setup screens.
You should also have a 64-bit host operating system, such as amd64 architecture for Debian-based
Linux distributions, x86_64 architecture for RedHat-based Linux distributions, and 64-bit for Mi-
crosoft Windows.
If you lack any of the prerequisites, either the virtualization tool will not work properly or it will
be restricted to running only 32-bit guest operating systems.
Since virtualization tools hook into the host operating system and hardware at a low level, there
are often incompatibilities between them. Do not expect these tools to run well at the same time.
Also, Microsoft Windows users beware that professional editions or higher come with Hyper-V
installed and enabled, which might interfere with your virtualization tool of choice. To turn it off,
execute “Turn Windows features on or off” from Windows Settings.

VirtualBox

After the initial installation, VirtualBox’s main screen looks something like Figure 2.6, “Virtual-
Box’s Start Screen” [page 26].

Chapter 2 — Getting Started with Kali Linux 25

 Figure 2.6 VirtualBox’s Start Screen

Click on New (Figure 2.7, “Name and Operating System” [page 27]) to start a wizard that will guide
you through the multiple steps required to input all the parameters of the new virtual machine.

26 Kali Linux Revealed

 Figure 2.7 Name and Operating System

In the first step, shown in Figure 2.7, “Name and Operating System” [page 27], you must assign a
name to your new virtual machine. We will use “Kali Linux.” You must also indicate what kind
of operating system will be used. Since Kali Linux is based on Debian GNU/Linux, select ”Linux”
for the type and ”Debian (32-bit)” or ”Debian (64-bit)” for the version. Although any other Linux
version will most likely work, this will help distinguish between the various virtual machines that
you might have installed.

Chapter 2 — Getting Started with Kali Linux 27

 Figure 2.8 Memory Size

In the second step, you must decide how much memory to allocate to the virtual machine. While
the recommended size of 1024 MB is acceptable for a Debian virtual machine acting as a server, it
is definitely not enough to run a Kali desktop system, especially not for a Kali Linux live system,
as the live system uses memory to store changes made to the file system. We recommend increas-
ing the value to 1500 MB (Figure 2.8, “Memory Size” [page 28]) and highly recommend that you
allocate no less than 2048 MB of RAM. For more information, see section 4.1, “Minimal Installation
Requirements” [page 66]

28 Kali Linux Revealed

 Figure 2.9 Hard disk

In the third step (shown in Figure 2.9, “Hard disk” [page 29]), you are prompted to choose a physi-
cal or virtual hard disk for your new virtual machine. Although a hard disk is not required to run
Kali Linux as a live system, add one for when we demonstrate the installation procedure later, in
chapter 4, “Installing Kali Linux” [page 66].

Chapter 2 — Getting Started with Kali Linux 29

 Figure 2.10 Hard Disk File Type

The content of the hard disk of the virtual machine is stored on the host machine as a file. Virtu-
alBox is able to store the contents of the hard disk using multiple formats (shown in Figure 2.10,
“Hard Disk File Type” [page 30]): the default (VDI) corresponds to VirtualBox’s native format;
VMDK is the format used by VMware. Keep the default value, because you don’t have any reason
to change it. The ability to use multiple formats is interesting mainly when you want to move a
virtual machine from one virtualization tool to another.

30 Kali Linux Revealed

 Figure 2.11 Storage on Physical Hard Disk

The explanation text in Figure 2.11, “Storage on Physical Hard Disk” [page 31] clearly describes
the advantages and drawbacks of dynamic and fixed disk allocation. In this example, we accept
the default selection (Dynamically allocated), since we are using a laptop with SSD disks. We don’t
want to waste space and won’t need the extra bit of performance as the machine is already quite
fast to begin with.

Chapter 2 — Getting Started with Kali Linux 31

 Figure 2.12 File Location and Size

The default hard disk size of 20 GB shown in Figure 2.12, “File Location and Size” [page 32] is
enough for a standard installation of Kali Linux, so we will not change it. For more information
about Kali’s requirements see section 4.1, “Minimal Installation Requirements” [page 66]. You can
also tweak the name and the location of the disk image. This can be handy when you don’t have
enough space on your hard disk, allowing you to store the disk image on an external drive.

32 Kali Linux Revealed

 Figure 2.13 The New Virtual Machine Appears in the List

The virtual machine has been created but you can’t really run it yet, because there is no operating
system installed. You also have some settings to tweak. Click on Settings on the VM Manager
screen and let’s review some of the most useful settings.

Chapter 2 — Getting Started with Kali Linux 33

 Figure 2.14 Storage Settings

In the Storage screen (Figure 2.14, “Storage Settings” [page 34]), you should associate the Kali
Linux ISO image with the virtual CD/DVD-ROM reader. First, select the CD-ROM drive in the Stor-
age Tree list and then click on the small CD-ROM icon on the right to display a contextual menu
where you can Choose Virtual Optical Disk File….

34 Kali Linux Revealed

 Figure 2.15 System Settings: Motherboard

In the System screen (Figure 2.15, “System Settings: Motherboard” [page 35]), you will find a Moth-
erboard tab. Make sure that the boot order indicates that the system will first try to boot from
any optical device before trying a hard disk. This is also the tab where you can alter the amount
of memory allocated to the virtual machine, should the need arise.

Chapter 2 — Getting Started with Kali Linux 35

 Figure 2.16 System Settings: Processor

In the same screen but on the “Processor” tab (Figure 2.16, “System Settings: Processor” [page
36]), you can adjust the number of processors assigned to the virtual machine. Most importantly,
if you use a 32-bit image, enable PAE/NX or the Kali image will not boot since the default kernel
variant used by Kali for i386 (aptly named “686-pae”) is compiled in a way that requires Physical
Address Extension (PAE) support in the CPU.
There are many other parameters that can be configured, like the network setup (defining how
the traffic on the network card is handled), but the above changes are sufficient to be able to boot
a working Kali Linux live system. Finally, click Boot and the virtual machine should boot properly,
as shown in Figure 2.17, “Kali Linux Boot Screen in VirtualBox” [page 37]. If not, carefully review
all settings and try again.

36 Kali Linux Revealed

 Figure 2.17 Kali Linux Boot Screen in VirtualBox

VMware Workstation

VMware Workstation is very similar to VirtualBox in terms of features and user interface, because
they are both designed primarily for desktop usage, but the setup process for a new virtual ma-
chine is a bit different. We will be using VMware Workstation Pro edition.

Chapter 2 — Getting Started with Kali Linux 37

 Figure 2.18 VMware Start Screen

The initial screen, shown in Figure 2.18, “VMware Start Screen” [page 38], displays a big Create a
New Virtual Machine button that starts a wizard to guide you through the creation of your virtual
machine.

Figure 2.19 New virtual Machine Wizard

38 Kali Linux Revealed

In the first step, you must decide whether you want to be presented with advanced settings dur-
ing the setup process. In this example, there are no special requirements so choose the typical
installation, as shown in Figure 2.19, “New virtual Machine Wizard” [page 38].

Figure 2.20 Guest Operating System Installation

The wizard assumes that you want to install the operating system immediately and asks you to
select the ISO image containing the installation program (Figure 2.20, “Guest Operating System
Installation” [page 39]). Select “Installer disc image file (iso)” and click on Browse to select the
image file.

Chapter 2 — Getting Started with Kali Linux 39

 Figure 2.21 Select a Guest Operating System

When the operating system cannot be detected from the selected ISO image, the wizard asks you
which guest OS type you intend to run. You should select “Linux” for the OS and “Debian 10.x
64-bit” for the version, as shown in Figure 2.21, “Select a Guest Operating System” [page 40]. We
select ”Debian 10.x” due to Kali Linux being constantly updated to the newest version of Debian.

40 Kali Linux Revealed

 Figure 2.22 Name the Virtual Machine

Choose ”Kali Linux” as the name of the new virtual machine (Figure 2.22, “Name the Virtual Ma-
chine” [page 41]). As with VirtualBox, you also have the option to store the virtual machine files
in an alternate location.

Figure 2.23 Specify Disk Capacity

Chapter 2 — Getting Started with Kali Linux 41

 The default hard disk size of 20 GB (Figure 2.23, “Specify Disk Capacity” [page 41]) is usually suf-
ficient but you can adjust it here depending on your expected needs. As opposed to VirtualBox,
which can use a single file of varying size, VMware has the ability to store the disk’s content over
multiple files. In both cases, the goal is to conserve the host’s disk space.

Figure 2.24 Ready to Create Virtual Machine

VMware Workstation is now configured to create the new virtual machine. It displays a summary
of the choices made so that you can double-check everything before creating the machine. Notice
that the wizard opted to allocate 2048 MB of RAM to the virtual machine, which is sufficient for
our needs. If the allocated value is lower, that is not enough so click on Customize Hardware... (Fig-
ure 2.24, “Ready to Create Virtual Machine” [page 42]) and tweak the Memory setting, as shown
in Figure 2.25, “Configure Hardware Window” [page 43].

42 Kali Linux Revealed

 Figure 2.25 Configure Hardware Window

After a last click on Finish (Figure 2.24, “Ready to Create Virtual Machine” [page 42]), the virtual
machine is now configured and can be started by clicking ”Power on this virtual machine” as
shown in Figure 2.26, “Kali Linux Virtual Machine Ready” [page 44].

Chapter 2 — Getting Started with Kali Linux 43

 Figure 2.26 Kali Linux Virtual Machine Ready

2.3. Summary

In this chapter, you learned about the various Kali Linux ISO images, learned how to verify and
download them, and learned how to create bootable USB disks from them on various operating sys-
tems. We also discussed how to boot the USB disks and reviewed how to configure the BIOS/UEFI
and startup settings on various hardware platforms so that the USB disks will boot.
Summary Tips:

• www.kali.org is the only official download site for Kali ISOs. Do not download them from
any other site, because those downloads could contain malware.
• Always validate the sha256sum of your downloads with the sha256sum command to ensure
the integrity of your ISO download. If it doesn’t match, try the download again or use a
different source.
• You must write the Kali Linux ISO image to a bootable media if you want to boot it on a
physical machine. Use Win32 Disk Imager on Microsoft Windows, the Disks utility on Linux
using GNOME, or the dd command on Mac OS X/macOS/Linux. Be very careful when writing
the image. Selecting the wrong disk could permanently damage data on your machine.
• Configure the BIOS/UEFI Setup screens on a PC or hold the Option key on OS X/macOS to
allow the machine to boot from the USB drive.
• Virtual machine programs like VirtualBox and VMware Workstation Pro are especially useful
if you want to try out Kali Linux but aren’t ready to commit to installing it permanently on

44 Kali Linux Revealed

 your machine or if you have a powerful system and want to run multiple operating systems
simultaneously.
Now that you have a working installation of Kali Linux, it is time to delve into some Linux funda-
mentals that are required for basic and advanced operation of Kali. If you are a moderate to ad-
vanced Linux user, consider skimming the next chapter (chapter 3, “Linux Fundamentals” [page
48]).

Chapter 2 — Getting Started with Kali Linux 45

 Keywords

Linux kernel
User space
Command line
bash
Filesystem Hierarchy
Unix commands
 Chapter

Linux Fundamentals 3
Contents

What Is Linux and What Is It Doing? 48 The Command Line 51 The File System 54
Useful Commands 56 Summary 62
 Before you can master Kali Linux, you must be at ease with a generic Linux system. Linux profi-
ciency will serve you well, because a large percentage of web, email, and other Internet services
run on Linux servers.
In this section, we strive to cover the basics of Linux, but we assume that you already know about
computer systems in general, including components such as the CPU, RAM, motherboard, and
hard disk, as well as device controllers and their associated connectors.

3.1. What Is Linux and What Is It Doing?

The term ”Linux” is often used to refer to the entire operating system, but in reality, Linux is
the operating system kernel, which is started by the boot loader, which is itself started by the
BIOS/UEFI. The kernel assumes a role similar to that of a conductor in an orchestra—it ensures
coordination between hardware and software. This role includes managing hardware, processes,
users, permissions, and the file system. The kernel provides a common base to all other programs
on the system and typically runs in ring zero, also known as kernel space.

The User Space We use the term user space to lump together everything that happens outside of the
kernel.
Among the programs running in user space are many core utilities from the GNU
project1 , most of which are meant to be run from the command line. You can use
them in scripts to automate many tasks. Refer to section 3.4, “Useful Commands”
[page 56] for more information about the most important commands.

Let’s quickly review the various tasks handled by the Linux kernel.

3.1.1. Driving Hardware

The kernel is tasked, first and foremost, with controlling the computer’s hardware components.
It detects and configures them when the computer powers on, or when a device is inserted or re-
moved (for example, a USB device). It also makes them available to higher-level software, through
a simplified programming interface, so applications can take advantage of devices without having
to address details such as which extension slot an option board is plugged into. The programming
interface also provides an abstraction layer; this allows video-conferencing software, for exam-
ple, to use a webcam regardless of its maker and model. The software can use the Video for Linux
(V4L) interface and the kernel will translate function calls of the interface into actual hardware
commands needed by the specific webcam in use.
The kernel exports data about detected hardware through the /proc/ and /sys/ virtual file sys-
tems. Applications often access devices by way of files created within /dev/. Specific files rep-
1
https://www.gnu.org/

48 Kali Linux Revealed

resent disk drives (for instance, /dev/sda), partitions (/dev/sda1), mice (/dev/input/mouse0),
keyboards (/dev/input/event0), sound cards (/dev/snd/*), serial ports (/dev/ttyS*), and other
components.
There are two types of device files: block and character. The former has characteristics of a block of
data: It has a finite size, and you can access bytes at any position in the block. The latter behaves
like a flow of characters. You can read and write characters, but you cannot seek to a given position
and change arbitrary bytes. To find out the type of a given device file, inspect the first letter in
the output of ls -l. It is either b, for block devices, or c, for character devices:
$ ls -l /dev/sda /dev/ttyS0
brw-rw---- 1 root disk 8, 0 Mar 21 08:44 /dev/sda
crw-rw---- 1 root dialout 4, 64 Mar 30 08:59 /dev/ttyS0

As you might expect, disk drives and partitions use block devices, whereas mouse, keyboard, and
serial ports use character devices. In both cases, the programming interface includes device-
specific commands that can be invoked through the ioctl system call.

3.1.2. Unifying File Systems

File systems are a prominent aspect of the kernel. Unix-like systems merge all the file stores into a
single hierarchy, which allows users and applications to access data by knowing its location within
that hierarchy.
The starting point of this hierarchical tree is called the root, represented by the “/” character.
This directory can contain named subdirectories. For instance, the home subdirectory of / is called
/home/. This subdirectory can, in turn, contain other subdirectories, and so on. Each directory can
also contain files, where the data will be stored. Thus, /home/kali/Desktop/hello.txt refers
to a file named hello.txt stored in the Desktop subdirectory of the kali subdirectory of the home
directory, present in the root. The kernel translates between this naming system and the storage
location on a disk.
Unlike other systems, Linux possesses only one such hierarchy, and it can integrate data from
several disks. One of these disks becomes the root, and the others are mounted on directories in
the hierarchy (the Linux command is called mount). These other disks are then available under the
mount points. This allows storing users’ home directories (traditionally stored within /home/) on
a separate hard disk, which will contain the kali directory (along with home directories of other
users). Once you mount the disk on /home/, these directories become accessible at their usual
locations, and paths such as /home/kali/Desktop/hello.txt keep working.
There are many file system formats, corresponding to many ways of physically storing data on
disks. The most widely known are ext2, ext3, and ext4, but others exist. For instance, VFAT is the
filesystem that was historically used by DOS and Microsoft Windows operating systems. Linux’s
support for VFAT allows hard disks to be accessible under Kali as well as under Microsoft Windows.
In any case, you must prepare a file system on a disk before you can mount it and this operation is

Chapter 3 — Linux Fundamentals 49

 known as formatting. Commands such as mkfs.ext4 (where mkfs stands for MaKe FileSystem) han-
dle formatting. These commands require, as a parameter, a device file representing the partition
to be formatted (for instance, /dev/sda1, the first partition on the first drive). This operation is
destructive and should be run only once, unless you want to wipe a filesystem and start fresh.
There are also network filesystems such as NFS, which do not store data on a local disk. Instead,
data is transmitted through the network to a server that stores and retrieves them on demand.
Thanks to the file system abstraction, you don’t have to worry about how this disk is connected,
since the files remain accessible in their usual hierarchical way.

3.1.3. Managing Processes

A process is a running instance of a program, which requires memory to store both the program
itself and its operating data. The kernel is in charge of creating and tracking processes. When
a program runs, the kernel first sets aside some memory, loads the executable code from the file
system into it, and then starts the code running. It keeps information about this process, the most
visible of which is an identification number known as the process identifier (PID).
Like most modern operating systems, those with Unix-like kernels, including Linux, are capable
of multi-tasking. In other words, they allow the system to run many processes at the same time.
There is actually only one running process at any one time, but the kernel divides CPU time into
small slices and runs each process in turn. Since these time slices are very short (in the millisecond
range), they create the appearance of processes running in parallel, although they are active only
during their time interval and are idle the rest of the time. The kernel’s job is to adjust its schedul-
ing mechanisms to keep that appearance, while maximizing global system performance. If the
time slices are too long, the application may not appear as responsive as desired. Too short, and
the system loses time by switching tasks too frequently. These decisions can be refined with pro-
cess priorities, where high-priority processes will run for longer periods and with more frequent
time slices than low-priority processes.

Multi-Processor Systems The limitation described above, of only one process running at a time, doesn’t always
(and Variants) apply: the actual restriction is that there can be only one running process per pro-
cessor core. Multi-processor, multi-core, or hyper-threaded systems allow several
processes to run in parallel. The same time-slicing system is used, though, to handle
cases where there are more active processes than available processor cores. This is not
unusual: a basic system, even a mostly idle one, almost always has tens of running
processes.

The kernel allows several independent instances of the same program to run, but each is allowed
to access only its own time slices and memory. Their data thus remains independent.

50 Kali Linux Revealed

3.1.4. Rights Management

Unix-like systems support multiple users and groups and allow control of permissions. Most of
the time, a process is identified by the user who started it. That process is only permitted to
take actions permitted for its owner. For instance, opening a file requires the kernel to check
the process identity against access permissions (for more details on this particular example, see
section 3.4.4, “Managing Rights” [page 57]).

3.2. The Command Line

By “command line”, we mean a text-based interface that allows you to enter commands, execute
them, and view the results. You can run a terminal (a textual screen within the graphical desktop,
or the text console itself outside of any graphical interface) and a command interpreter inside it
(the shell).

3.2.1. How To Get a Command Line

When your system is working properly, the easiest way to access the command line is to run a
terminal in your graphical desktop session.

Figure 3.1 Starting QTerminal

Chapter 3 — Linux Fundamentals 51

 For instance, on a default Kali Linux system, QTerminal can be started from the list of favorite
applications. You can also type “terminal” while in the applications menu (the one that gets acti-
vated when you move the mouse to the top-left corner) and click on the correct application icon
that appears (Figure 3.1, “Starting QTerminal” [page 51]).
In the event that your graphical interface is broken, you can still get a command line on virtual
consoles (up to six of them can be accessible through the six key combinations of CTRL+ALT+F1
through CTRL+ALT+F6 — the CTRL key can be omitted if you are already in text mode, outside of
Xorg or Wayland’s graphical interface). You get a very basic login screen where you enter your
login and password before being granted access to the command line with its shell:
Kali GNU/Linux Rolling kali tty3

kali login: kali

Password:
Linux kali 5.7.0-kali1-amd64 #1 SMP Debian 5.7.6-1kali2 (2020-07-01) X86_64

The programs included with the Kali GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Kali GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent

permitted by applicable law.
kali@kali:~$

The program handling your input and executing your commands is called a shell (or a command-
line interpreter). The default shell provided in Kali Linux is Bash (it stands for Bourne Again SHell).
The trailing “$“ or “#” character indicates that the shell is awaiting your input. It also indicates
whether Bash recognizes you as a normal user (the former case with the dollar, $) or as a super
user (the latter case with the hash, #).

3.2.2. Command Line Basics: Browsing the Directory Tree and Managing Files

This section only provides a brief overview of the covered commands, all of which have many
options not described here, so please refer to the abundant documentation available in their re-
spective manual pages. In penetration tests, you will most often receive shell access to a system
after a successful exploit, rather than a graphical user interface. Proficiency with the command
line is essential for your success as a security professional.
Once a session is open, the pwd command (which stands for print working directory) displays your
current location in the filesystem. The current directory is changed with the cd directory com-
mand (cd is for change directory). When you don’t specify the target directory, you are taken to
your home directory. When you use cd - (dash), you go back to the former working directory
(the one in use before the last cd call). The parent directory is always called .. (two dots), whereas

52 Kali Linux Revealed

the current directory is also known as . (one dot). The ls command allows listing the contents of
a directory. If you don’t provide parameters, ls operates on the current directory.
$ pwd
/home/kali
$ cd Desktop
$ pwd
/home/kali/Desktop
$ cd .
$ pwd
/home/kali/Desktop
$ cd ..
$ pwd
/home/kali
$ ls
Desktop Downloads Pictures Templates
Documents Music Public Videos

You can create a new directory with mkdir directory, and remove an existing (empty) directory
with rmdir directory. The mv command allows moving and renaming files and directories; remov-
ing a file is achieved with rm file, and copying a file is done with cp source-file target-file.
$ mkdir test
$ ls
Desktop Downloads Pictures Templates Videos
Documents Music Public test
$ mv test new
$ ls
Desktop Downloads new Public Videos
Documents Music Pictures Templates
$ rmdir new
$ ls
Desktop Downloads Pictures Templates Videos
Documents Music Public

The shell executes each command by running the first program of the given name that it finds
in a directory listed in the PATH environment variable. Most often, these programs are in /bin,
/sbin, /usr/bin, or /usr/sbin. For example, the ls command is found in /bin/ls; the which
command reports the location of a given executable. Sometimes the command is directly handled
by the shell, in which case, it is called a shell built-in command (cd and pwd are among those); the
type command lets you query the type of each command.
$ echo $PATH
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
$ which ls
/bin/ls
$ type rm

Chapter 3 — Linux Fundamentals 53

 rm is /bin/rm
$ type cd
cd is a shell builtin

Note the usage of the echo command, which simply displays a string on the terminal. In this case,
it is used to print the contents of an environment variable since the shell automatically substitutes
variables with their values before executing the command line.

Environment Variables Environment variables allow storage of global settings for the shell or various other
programs. They are contextual but inheritable. For example, each process has its
own set of environment variables (they are contextual). Shells, like login shells, can
declare variables, which will be passed down to other programs they execute (they
are inheritable).
These variables can be defined system-wide in /etc/profile or per-user in ~/
.profile but variables that are not specific to command line interpreters are better
put in /etc/environment, since those variables will be injected into all user sessions
thanks to a Pluggable Authentication Module (PAM) – even when no shell is executed.

3.3. The File System

3.3.1. The Filesystem Hierarchy Standard

As with other Linux distributions, Kali Linux is organized to be consistent with the Filesystem Hi-
erarchy Standard (FHS), allowing users of other Linux distributions to easily find their way around
Kali. The FHS defines the purpose of each directory. The top-level directories are described as
follows.
• /bin/: basic programs
• /boot/: Kali Linux kernel and other files required for its early boot process
• /dev/: device files
• /etc/: configuration files
• /home/: user’s personal files
• /lib/: basic libraries
• /media/: mount points for removable devices (CD/DVD-ROM, USB keys, and so on)
• /mnt/: temporary mount point
• /opt/: extra applications provided by third parties
• /root/: administrator’s (root’s) personal files
• /run/: volatile runtime data that does not persist across reboots (not yet included in the
FHS)

54 Kali Linux Revealed

 • /sbin/: system programs
• /srv/: data used by servers hosted on this system
• /tmp/: temporary files (this directory is often emptied at boot)
• /usr/: applications (this directory is further subdivided into bin, sbin, lib according to
the same logic as in the root directory) Furthermore, /usr/share/ contains architecture-
independent data. The /usr/local/ directory is meant to be used by the administrator for
installing applications manually without overwriting files handled by the packaging system
(dpkg).
• /var/: variable data handled by services. This includes log files, queues, spools, and caches.
• /proc/ and /sys/ are specific to the Linux kernel (and not part of the FHS). They are used
by the kernel for exporting data to user space.

3.3.2. The User’s Home Directory

The contents of a user’s home directory are not standardized but there are still a few noteworthy
conventions. One is that a user’s home directory is often referred to by a tilde (“~”). That is useful
to know because command interpreters automatically replace a tilde with the correct directory
(which is stored in the HOME environment variable, and whose usual value is /home/user/).
Traditionally, application configuration files are often stored directly under your home directory,
but the filenames usually start with a dot (for instance, the mutt email client stores its configura-
tion in ~/.muttrc). Note that filenames that start with a dot are hidden by default; the ls com-
mand only lists them when the -a option is used and graphical file managers need to be explicitly
configured to display hidden files.
Some programs also use multiple configuration files organized in one directory (for instance, ~/
.ssh/). Some applications (such as the Firefox web browser) also use their directory to store a
cache of downloaded data. This means that those directories can end up consuming a lot of disk
space.
These configuration files stored directly in your home directory, often collectively referred to
as dotfiles, have long proliferated to the point that these directories can be quite cluttered with
them. Fortunately, an effort led collectively under the FreeDesktop.org2 umbrella has resulted
in the XDG Base Directory Specification, a convention that aims at cleaning up these files and
directories. This specification states that configuration files should be stored under ~/.config,
cache files under ~/.cache, and application data files under ~/.local (or subdirectories thereof).
This convention is slowly gaining traction.
Graphical desktops usually have shortcuts to display the contents of the ~/Desktop/ directory (or
whatever the appropriate translation is for systems not configured in English).
2
https://www.freedesktop.org/

Chapter 3 — Linux Fundamentals 55

 Finally, the email system sometimes stores incoming emails into a ~/Mail/ directory.

3.4. Useful Commands

3.4.1. Displaying and Modifying Text Files

The cat file command (intended to concatenate files to the standard output device) reads a file
and displays its contents on the terminal. If the file is too big to fit on a screen, you can use a pager
such as less (or more) to display it page by page.
The editor command starts a text editor (such as Vi or Nano) and allows creating, modifying,
and reading text files. The simplest files can sometimes be created directly from the command
interpreter thanks to redirection: command > file creates a file named file containing the out-
put of the given command. command >> file is similar except that it appends the output of the
command to the file rather than overwriting it.
$ echo ”Kali rules!” > kali-rules.txt
$ cat kali-rules.txt
Kali rules!
$ echo ”Kali is the best!” >> kali-rules.txt
$ cat kali-rules.txt
Kali rules!
Kali is the best!

3.4.2. Searching for Files and within Files

The find directory criteria command searches for files in the hierarchy under directory ac-
cording to several criteria. The most commonly used criterion is -name filename, which allows
searching for a file by name. You can also use common wildcards such as “*” in the filename
search.
$ find /etc -name hosts
/etc/hosts
/etc/avahi/hosts
$ find /etc -name ”hosts*”
/etc/hosts
/etc/hosts.allow
/etc/hosts.deny
/etc/avahi/hosts

The grep expression files command searches the contents of the files and extracts lines
matching the regular expression. Adding the -r option enables a recursive search on all files con-
tained in the directory. This allows you to look for a file when you only know a part of its contents.

56 Kali Linux Revealed

3.4.3. Managing Processes

The ps aux command lists the processes currently running and helps to identify them by showing
their PID. Once you know the PID of a process, the kill -signal pid command allows you to send
it a signal (if you own the process). Several signals exist; most commonly used are TERM (a request
to terminate gracefully) and KILL (a forced kill).
The command interpreter can also run programs in the background if the command is followed
by “&”. By using the ampersand, you resume control of the shell immediately even though the
command is still running (hidden from view as a background process). The jobs command lists
the processes running in the background; running fg %job-number (for foreground) restores a
job to the foreground. When a command is running in the foreground (either because it was
started normally, or brought back to the foreground with fg), the Control+Z key combination
pauses the process and resumes control of the command line. The process can then be restarted
in the background with bg %job-number (for background).

3.4.4. Managing Rights

Linux is a multi-user system so it is necessary to provide a permissions system to control the set of
authorized operations on files and directories, which includes all the system resources and devices
(on a Unix system, any device is represented by a file or directory). This principle is common to
all Unix-like systems.
Each file or directory has specific permissions for three categories of users:
• Its owner (symbolized by u, as in User)
• Its owner group (symbolized by g, as in Group), representing all the members of the group
• The others (symbolized by o, as in Other)
Three types of rights can be combined:
• Reading (symbolized by r, as in Read);
• Writing (or modifying, symbolized by w, as in Write);
• Executing (symbolized by x, as in eXecute).
In the case of a file, these rights are easily understood: read access allows reading the content
(including copying), write access allows changing it, and execute access allows running it (which
will only work if it is a program).

setuidand setgid Two particular rights are relevant to executable files: setuid and setgid (symbolized
executables with the letter “s”). Note that we frequently speak of bit, since each of these boolean
values can be represented by a 0 or a 1. These two rights allow any user to execute
the program with the rights of the owner or the group, respectively. This mechanism

Chapter 3 — Linux Fundamentals 57

 grants access to features requiring higher level permissions than those you would
usually have.
Since a setuid root program is systematically run under the super-user identity, it is
very important to ensure it is secure and reliable. Any user who manages to subvert
a setuid root program to call a command of their choice could then impersonate the
root user and have all rights on the system. Penetration testers regularly search for
these types of files when they gain access to a system as a way of escalating their
privileges.

A directory is handled differently from a file. Read access gives the right to consult the list of its
contents (files and directories); write access allows creating or deleting files; and execute access
allows crossing through the directory to access its contents (for example, with the cd command).
Being able to cross through a directory without being able to read it gives the user permission to
access the entries therein that are known by name, but not to find them without knowing their
exact name.

SECURITY The setgid bit also applies to directories. Any newly-created item in such directories
setgid directory and sticky is automatically assigned the owner group of the parent directory, instead of inherit-
bit ing the creator’s main group as usual. Because of this, you don’t have to change your
main group (with the newgrp command) when working in a file tree shared between
several users of the same dedicated group.
The sticky bit (symbolized by the letter “t”) is a permission that is only useful in
directories. It is especially used for temporary directories where everybody has write
access (such as /tmp/): it restricts deletion of files so that only their owner or the
owner of the parent directory can delete them. Lacking this, everyone could delete
other users’ files in /tmp/.

Three commands control the permissions associated with a file:

• chown user file changes the owner of the file
• chgrp group file alters the owner group
• chmod rights file changes the permissions for the file

TIP Frequently you want to change the group of a file at the same time that you change
Changing the user and the owner. The chown command has a special syntax for that: chown user:group
group file

There are two ways of representing rights. Among them, the symbolic representation is probably
the easiest to understand and remember. It involves the letter symbols mentioned above. You
can define rights for each category of users (u/g/o), by setting them explicitly (with =), by adding
(+), or subtracting (-). Thus the u=rwx,g+rw,o-r formula gives the owner read, write, and execute
rights, adds read and write rights for the owner group, and removes read rights for other users.

58 Kali Linux Revealed

Rights not altered by the addition or subtraction in such a command remain unmodified. The
letter a, for all, covers all three categories of users, so that a=rx grants all three categories the
same rights (read and execute, but not write).
The (octal) numeric representation associates each right with a value: 4 for read, 2 for write, and
1 for execute. We associate each combination of rights with the sum of the three figures, and a
value is assigned to each category of users, in the usual order (owner, group, others).
For instance, the chmod 754 file command will set the following rights: read, write and execute
for the owner (since 7 = 4 + 2 + 1); read and execute for the group (since 5 = 4 + 1); read-only for
others. The 0 means no rights; thus chmod 600 file allows for read and write permissions for the
owner, and no rights for anyone else. The most frequent right combinations are 755 for executable
files and directories, and 644 for data files.
To represent special rights, you can prefix a fourth digit to this number according to the same
principle, where the setuid, setgid, and sticky bits are 4, 2, and 1, respectively. The command
chmod 4754 will associate the setuid bit with the previously described rights.

Note that the use of octal notation only allows you to set all the rights at once on a file; you cannot
use it to add a new right, such as read access for the group owner, since you must take into account
the existing rights and compute the new corresponding numerical value.
The octal representation is also used with the umask command, which is used to restrict permis-
sions on newly created files. When an application creates a file, it assigns indicative permissions,
knowing that the system automatically removes the rights defined with umask. Enter umask in a
shell; you will see a mask such as 0022. This is simply an octal representation of the rights to be
systematically removed (in this case, the write rights for the group and other users).
If you give it a new octal value, the umask command modifies the mask. Used in a shell initial-
ization file (for example, ~/.bash_profile), it will effectively change the default mask for your
work sessions.

TIP Sometimes we have to change rights for an entire file tree. All the commands above
Recursive operation have a -R option to operate recursively in sub-directories.
The distinction between directories and files sometimes causes problems with recur-
sive operations. That is why the “X” letter has been introduced in the symbolic repre-
sentation of rights. It represents a right to execute which applies only to directories
(and not to files lacking this right). Thus, chmod -R a+X directory will only add
execute rights for all categories of users (a) for all of the sub-directories and files for
which at least one category of user (even if their sole owner) already has execute
rights.

Chapter 3 — Linux Fundamentals 59

 3.4.5. Getting System Information and Logs

The free command displays information on memory; (df (for disk free) reports on the available
disk space on each of the disks mounted in the file system. Its -h option (for human readable)
converts the sizes into a more legible unit (usually mebibytes or gibibytes). In a similar fashion,
the free command supports the -m and -g options, and displays its data either in mebibytes or in
gibibytes, respectively.
$ free
total used free shared buff/cache available
Mem: 2052944 661232 621208 10520 770504 1359916
Swap: 0 0 0
$ df
Filesystem 1K-blocks Used Available Use% Mounted on
udev 1014584 0 1014584 0% /dev
tmpfs 205296 8940 196356 5% /run
/dev/vda1 30830588 11168116 18073328 39% /
tmpfs 1026472 456 1026016 1% /dev/shm
tmpfs 5120 0 5120 0% /run/lock
tmpfs 1026472 0 1026472 0% /sys/fs/cgroup
tmpfs 205296 36 205260 1% /run/user/132
tmpfs 205296 24 205272 1% /run/user/0

The id command displays the identity of the user running the session along with the list of groups
they belong to. Since access to some files or devices may be limited to group members, checking
available group membership may be useful.
$ id
uid=1000(kali) gid=1000(kali) groups=1000(kali),27(sudo)

The uname -a command returns a single line documenting the kernel name (Linux), the hostname,
the kernel release, the kernel version, the machine type (an architecture string such as x86_64),
and the name of the operating system (GNU/Linux). The output of this command should usually
be included in bug reports as it clearly defines the kernel in use and the hardware platform you
are running on.
$ uname -a
Linux kali 5.8.0-kali3-amd64 #1 SMP Debian 5.8.14-1kali1 (2020-10-13) x86_64 GNU/Linux

All these commands provide run-time information, but often you need to consult logs to under-
stand what happened on your computer. In particular, the kernel emits messages that it stores in
a ring buffer whenever something interesting happens (such as a new USB device being inserted,
a failing hard disk operation, or initial hardware detection on boot). You can retrieve the kernel
logs with the dmesg command.
Systemd’s journal also stores multiple logs (stdout/stderr output of services, syslog messages, ker-
nel logs) and makes it easy to query them with journalctl. Without any arguments, it just dumps

60 Kali Linux Revealed

all the available logs in a chronological way. With the -r option, it will reverse the order so that
newer messages are shown first. With the -f option, it will continuously print new log entries
as they are appended to its database. The -u option can limit the messages to those emitted by a
specific systemd unit (ex: journalctl -u ssh.service).

3.4.6. Discovering the Hardware

The kernel exports many details about detected hardware through the /proc/ and /sys/ virtual
filesystems. Several tools summarize those details. Among them, lspci (in the pciutils package)
lists PCI devices, lsusb (in the usbutils package) lists USB devices, and lspcmcia (in the pcmciau-
tils package) lists PCMCIA cards. These tools are very useful for identifying the exact model of
a device. This identification also allows more precise searches on the web, which in turn, lead
to more relevant documents. Note that the pciutils and usbutils packages are already installed on
the base Kali system but pcmciautils must be installed with apt update followed by apt install
pcmciautils. We will discuss more about package installation and management in section 8.2,
“Basic Package Interaction” [page 181]

Example 3.1 Example of information provided by lspci and lsusb

$ lspci
[...]
00:02.1 Display controller: Intel Corporation Mobile 915GM/GMS/910GML Express Graphics Controller (rev 03)
00:1c.0 PCI bridge: Intel Corporation 82801FB/FBM/FR/FW/FRW (ICH6 Family) PCI Express Port 1 (rev 03)
00:1d.0 USB Controller: Intel Corporation 82801FB/FBM/FR/FW/FRW (ICH6 Family) USB UHCI #1 (rev 03)
[...]
01:00.0 Ethernet controller: Broadcom Corporation NetXtreme BCM5751 Gigabit Ethernet PCI Express (rev 01)
02:03.0 Network controller: Intel Corporation PRO/Wireless 2200BG Network Connection (rev 05)
$ lsusb
Bus 005 Device 004: ID 413c:a005 Dell Computer Corp.
Bus 005 Device 008: ID 413c:9001 Dell Computer Corp.
Bus 005 Device 007: ID 045e:00dd Microsoft Corp.
Bus 005 Device 006: ID 046d:c03d Logitech, Inc.
[...]
Bus 002 Device 004: ID 413c:8103 Dell Computer Corp. Wireless 350 Bluetooth

These programs have a -v option that lists much more detailed (but usually unnecessary) informa-
tion. Finally, the lsdev command (in the procinfo package) lists communication resources used by
devices.
The lshw program is a combination of the above programs and displays a long description of the
hardware discovered in a hierarchical manner. You should attach its full output to any report
about hardware support problems.

Chapter 3 — Linux Fundamentals 61

 3.5. Summary

In this section, we took a whirlwind tour of the Linux landscape. We discussed the kernel and user
space, reviewed many common Linux shell commands, discussed processes and how to manage
them, reviewed user and group security concepts, discussed the FHS, and toured some of the most
common directories and files found on Kali Linux.
Summary Tips:
• Linux is often used to refer to the entire operating system but in reality Linux itself is the
operating system kernel that is started by the boot loader, which is itself started by the
BIOS/UEFI.
• User space refers to everything that happens outside of the kernel. Among the programs
running in user space, there are many core utilities from the GNU project3 , most of which
are meant to be run from the command line (a text-based interface that allows you to enter
commands, execute them, and view the results). A shell executes your commands within
that interface.
• Common commands include: pwd (print working directory), cd (change directory), ls (list
file or directory contents), mkdir (make directory), rmdir (remove directory), mv, rm, and
cp (move, remove, or copy file or directory respectively), cat (concatenate or show file),
less/more (show files a page at a time), editor (start a text editor), find (locate a file or
directory), free (display memory information), df (show disk free space), id (display the
identity of the user along with the list of groups they belong to), dmesg (review kernel logs),
and journalctl (show all available logs).
• You can inspect the hardware on a Kali system with several commands: lspci (list PCI de-
vices), lsusb (list USB devices), and lspcmcia lists PCMCIA cards.
• A process is a running instance of a program, which requires memory to store both the pro-
gram itself and its operating data. You can manage processes with commands like: ps (show
processes), kill (kill processes), bg (send process to background), fg (bring background
process to foreground), and jobs (show background processes).
• Unix-like systems are multi-user. They support multiple users and groups and allow con-
trol over actions, based on permissions. You can manage file and directory rights with sev-
eral commands, including: chmod (change permissions), chown (change owner), and chgrp
(change group).
• As with other professional Linux distributions, Kali Linux is organized to be consistent with
the Filesystem Hierarchy Standard (FHS), allowing users coming from other Linux distributions
to easily find their way around Kali.
• Traditionally, application configuration files are stored under your home directory, in hid-
den files or directories starting with a period (or dot).
3
https://www.gnu.org/

62 Kali Linux Revealed

Now that you have a handle on Linux fundamentals, let’s get Kali Linux set up and running.

Chapter 3 — Linux Fundamentals 63

 Keywords

Installation
Unattended
installation
ARM devices
Troubleshooting
 Chapter

Installing Kali Linux 4

Contents

Minimal Installation Requirements 66 Step by Step Installation on a Hard Drive 66 Unattended Installations 95
ARM Installations 98 Troubleshooting Installations 99 Summary 104
 In this chapter, we will focus on the Kali Linux installation process. First, we will discuss the min-
imum installation requirements (section 4.1, “Minimal Installation Requirements” [page 66]) to
ensure that your real or virtual system is well-configured to handle the type of installation that
you will pursue. Then we will go through each step of the installation process (section 4.2, “Step
by Step Installation on a Hard Drive” [page 66]) for a plain installation, as well as for a more se-
cure installation involving a fully encrypted file system. We will also discuss preseeding, which
allows unattended installations (section 4.3, “Unattended Installations” [page 95]) by providing
predetermined answers to installation questions. We will also show you how to install Kali Linux
on various ARM devices (section 4.4, “ARM Installations” [page 98]), which expands Kali’s capabili-
ties far beyond the desktop. Finally, we will show you what to do in the rare case of an installation
failure (section 4.5, “Troubleshooting Installations” [page 99]), so you can work through the issue
and successfully finish a tough install.

4.1. Minimal Installation Requirements

The installation requirements for Kali Linux vary depending on what you would like to install. On
the low end, you can set up Kali as a basic Secure Shell (SSH) server with no desktop, using as little
as 128 MB of RAM (512 MB recommended) and 2 GB of disk space. On the higher end, if you opt to
install the default Xfce desktop and the kali-linux-default metapackage, you should really aim for
at least 2048 MB of RAM and 20 GB of disk space.
Besides the RAM and hard disk requirements, your computer needs to have a CPU supported by
at least one of the amd64, i386, or arm64 architectures.

4.2. Step by Step Installation on a Hard Drive

In this section, we assume that you have a bootable USB drive or DVD (see section 2.1.4, “Copying
the Image on a DVD-ROM or USB Key” [page 19] for details on how to prepare such a drive) and
that you booted from it to start the installation process.

4.2.1. Plain Installation

First, we will take a look at a standard Kali installation, with an unencrypted file system.

Booting and Starting the Installer

Once the BIOS/UEFI has begun booting from the USB drive or DVD-ROM, the isolinux boot loader
menu appears, as shown in Figure 4.1, “Boot Screen” [page 67]. At this stage, the Linux kernel is
not yet loaded; this menu allows you to choose the kernel to boot and enter optional parameters
to be transferred to it in the process.

66 Kali Linux Revealed

Using the arrow keys todo a standard installation, either choose Graphical Install or Install (for
classic text-mode), then press the Enter key to initiate the remainder of the installation process.
Each menu entry hides a specific boot command line, which can be configured as needed by press-
ing the Tab key before validating the entry and booting.

Figure 4.1 Boot Screen

Once booted, the installation program guides you step-by-step through the process. We will take
a look at each of these steps in detail. We will cover installation from a standard Kali Linux live
image; installations from a mini.iso may look slightly different. We will also address graphical
mode installation, but the only difference from classic text-mode installation is the appearance.
The versions pose identical questions and present identical options.

Selecting the Language

As shown in Figure 4.2, “Selecting the Language” [page 68], the installation program begins in
English but the first step allows you to choose the language that will be used for the rest of the

Chapter 4 — Installing Kali Linux 67

 installation process. This language choice is also used to define more relevant default choices in
subsequent stages (notably the keyboard layout).

Navigating with the Some steps in the installation process require you to enter information. These screens
Keyboard have several areas that may gain focus (text entry area, checkboxes, list of choices, OK
and Cancel buttons), and the Tab key allows you to move from one to another.
In graphical installation mode, you can use the mouse as you would normally on an
installed graphical desktop.

Figure 4.2 Selecting the Language

Selecting the Country

The second step (Figure 4.3, “Selecting the Country” [page 69]) consists of choosing your country.
Combined with the language, this information enables the installation program to offer the most
appropriate keyboard layout. This will also influence the configuration of the time zone. In the
United States, a standard QWERTY keyboard is suggested and the installer presents a choice of
appropriate time zones.

68 Kali Linux Revealed

 Figure 4.3 Selecting the Country

Selecting the Keyboard Layout

The proposed American English keyboard corresponds to the usual QWERTY layout as shown in
Figure 4.4, “Choice of Keyboard” [page 70].

Chapter 4 — Installing Kali Linux 69

 Figure 4.4 Choice of Keyboard

Detecting Hardware

In the vast majority of cases, the hardware detection step is completely automatic. The installer
detects your hardware and tries to identify the boot device used in order to access its content. It
loads the modules corresponding to the various hardware components detected and then mounts
the boot device in order to read it. The previous steps were completely contained in the boot image
included on the boot device, a file of limited size and loaded into memory by the bootloader when
booting from the boot device.

Loading Components

With the contents of the boot device now available, the installer loads all the files necessary to
continue with its work. This includes additional drivers for the remaining hardware (especially
the network card), as well as all the components of the installation program.

70 Kali Linux Revealed

Detecting Network Hardware

In this step, the installer will try to automatically identify the network card and load the corre-
sponding module. If automatic detection fails, you can manually select the module to load. If all
else fails, you can load a specific module from a removable device. This last solution is usually
only needed if the appropriate driver is not included in the standard Linux kernel, but available
elsewhere, such as the manufacturer’s website.
This step must absolutely be successful for network installations (such as those done when booting
from a mini.iso), since the Debian packages must be loaded from the network.

Configuring the Network

In order to automate the process as much as possible, the installer attempts an automatic net-
work configuration using Dynamic Host Configuration Protocol (DHCP) (for IPv4 and IPv6) and
ICMPv6’s Neighbor Discovery Protocol (for IPv6), as shown in Figure 4.5, “Network Autoconfigu-
ration” [page 71].

Figure 4.5 Network Autoconfiguration

Chapter 4 — Installing Kali Linux 71

 If the automatic configuration fails, the installer offers more choices: try again with a normal
DHCP configuration, attempt DHCP configuration by declaring the name of the machine, or set up
a static network configuration.
This last option requires an IP address, a subnet mask, an IP address for a potential gateway, a
machine name, and a domain name.

Configuration without If the local network is equipped with a DHCP server that you do not wish to use
DHCP because you prefer to define a static IP address for the machine during installation,
you can add the netcfg/use_dhcp=false option when booting. You just need to
edit the desired menu entry by pressing the Tab key and adding the desired option
before pressing the Enter key.

User Creation

The installer prompts to create a new user (Figure 4.6, “Create User” [page 73]) since it automati-
cally creates a user account in the ”sudo” group. This means that the user has full administrative
privileges through the sudo command. This is helpful due to the fact that multiple items are only
available through administrative privileges.
The installer also asks for a username for the account as well as a password. The installer will
request confirmation of the password to prevent any input error.

72 Kali Linux Revealed

 Figure 4.6 Create User

The Default User The default user’s password should be long (eight characters or more) and impossi-
Password ble to guess, since attackers target Internet-connected computers and servers with
automated tools, attempting to log in with obvious passwords. Sometimes attackers
leverage dictionary attacks, using many combinations of words and numbers as pass-
words. Avoid using the names of children or parents and dates of birth, because these
are easily guessed.
These remarks are equally applicable to other user passwords but the consequences
of a compromised account are less drastic for users without sudo privileges.
If you are lacking inspiration, don’t hesitate to use a password generator, such as
pwgen (found in the package of the same name, which is already included in the base
Kali installation).

Chapter 4 — Installing Kali Linux 73