This post will show you how to setup the Kali Linux distro to perform penetration testing of your systems
I have a number of guides on moving hasting away form CPanel, Setting up VM’s on AWS, Vultr or Digital Ocean along with installing and managing WordPress from the command line. Securing your systems is very important (don’t stop) and keep learning (securing ubuntu in the cloud, securing checklist, run a Lynis system audit etc)
snip from: https://www.kali.org/about-us/
“Kali Linux is an open source project that is maintained and funded by Offensive Security, a provider of world-class information security training and penetration testing services. In addition to Kali Linux, Offensive Security also maintains the Exploit Database and the free online course, Metasploit Unleashed.”
I downloaded the torrent version (as the HTTP version kept stopping (even on 50/20 NBN).
After the download finished I checked the SHA sum to verify it’a integrity
A least it matched the known (or hacked) hash here.
Installing Parallels in a VM on OSX
I use Parallels 11 on OSX to set up a VM os Demina Kali, you can use VirtualBox, VMWare etc.
Hardware: 2x CPU, 2048MB Ram, 32MB Graphics, 64GB Disk.
I selected Graphical Install (English, Australia, American English, host: kali, network: hyrule, New South Wales, Partition: Guided – entire disk, Default, Default, Default, Continue, Yes, Network Mirror: Yes, No Proxy, Installed GRUB bootloader on VM HD.
Install Parallel Tools
Official Guide: https://kb.parallels.com/en/123968
I opened the VM then selected the Actions then Install Parallels Tools, this mounted /media/cdrom/, I copied all contents to /temp/
As recommended by the Parallels instal bash script I updated headers.
Then the following from https://kb.parallels.com/en/123968
Parallels will not install, I think I need to upgrade to parallel 12 or 12 as the printer driver detection is not detecting (even though it is installed).
Installing Google Chrome
I used the video below
I have to run chrome with
Running your first remote vulnerability scan in Kali
I found this video useful in helping me scan and check my systems for exploits
Simple exploit search in Armitage (metasploit)
A quick scan of my server revealed three ports open and (22, 80 and 443). Port 80 redirects to 443 and port 22 is firewalled. I have WordPress and exploits I rued failed to work thanks to patching (always stay ahead of patching and updating of software and the OS.
If you open the Check Exploits menu at the end of the Attacks menu you can do a bulk exploit check.
Kali also comes with a WordPress scanner
This will try and output everything from your web server and WordPress plugins.
/xmlrpc.php was found and I was advised to deny access to that file in NGINX. xmlrpc.php is ok but can be used in denial of service attacks.
I had a hit for a vulnerability in a Youtube Embed plugin but I had a patched version.
TIP: Check your WordPress often.
More to come (Draft Post).
Don’t have unwanted ports open, securely installed software, Use unattended security updates in Ubuntu, update WordPress frequently and limit plugins and also consider running more verbose audit tools like Lynis.
I hope this guide helps someone.
Ask a question or recommend an article
[contact-form-7 id=”30″ title=”Ask a Question”]
v1.2 added More Reading links.
v1.1 Added bulk exploit check.
v1.0 Initial post