Configuring network services and secure communications
wired or wireless network to support updates and customization.
You may need to obtain an IP address by DHCP (Dynamic Host Configuration
Protocol), or assign one statically. First, confirm your IP address using the command
ifconfig
command from a terminal window, as shown in the following screenshot:
IP address is 192.168.1.11....
If an IP address was not obtained, an address can be assigned by DHCP using the
command dhclient eth0 (or other available interfaces, which will depend on the specific configuration of the system being used).
If a static IP address is used, additional information may be required. For example,
you can assign a static IP of 192.168.1.11as follows:
inet addr:192.168.1.11
Bcast:192.168.1.255
Mask:255.255.255.0
Securing communications with Secure Shell
To minimise detection by a target network during testing, Kali does not enable any
externally-listening network services. Some services, such as Secure Shell (SSH),
are already installed. However, they must be enabled prior to use.
Kali comes preconfigured with default SSH keys. Before starting the SSH service,
it's a good idea to disable the default keys and generate a unique key set for use.
Move the default SSH keys to a backup folder, and then generate a new SSH key set
using the following command:
dpkg-reconfigure openssh-server
commands...
1.cd/etc/ssh/ //open up the ssh directory
2.mkdir keys_default // this command will make an new directry(mkdir) name keys_default
3.mv ssh_host_*Keys_default //this command will move directory ssh_host to keys_default directry
4.dpkg-reconfigure openssh-server //dpkg-debian package managing command in Linux distribution
actually these commands for the beginners i means who install kali recently or he don't change the the configuration of the kali secure shell.
To start the SSH service using the menu,
select Applications | Kali Linux |System Services | SSHD | SSHD Start.
or
To start SSH from the command line, use the command line
/etc/init.d/ssh start
To verify that SSH is running, perform a netstat query,
command...
netstat -antp
The SSH daemon is listening on port 22 in the previous example.
To stop SSH, use
the following command:
/etc/init.d/ssh stop
To stop the SSH service using the menu,
select Applications | Kali Linux |System Services | SSHD | SSHD Stop
The Debian package management system
Debian's package management system relies on discrete bundled applications called packages. Packages can be installed or removed by the user to customize the environment, and support tasks such as penetration testing. They can also extend the functionality of Kali, supporting tasks, such as communications (Skype, instant
messaging, and secure e-mails) or documentation (OpenOffice and Microsoft Office running under Wine).
Packages are stored in repositories and are downloaded to the system user to ensure the integrity of the package.Packages and repositories By default, Kali uses only the official Kali repositories. It is possible that an incomplete installation process may not add the repositories to the correct sources.
list file, or that you may wish to extend the available repositories when new applications are added.
Updating the source.list file can be done from the command line
echo debhttp://http.kali.org/kiali kali main contrib non-free >> /etc/apt/sources.list,
or
by using a text editor.
The default package repositories that should be present in /etc/apt/sources.list
are listed as follows; if not present, edit the sources.list file to include them:
## Kali
deb http://http.kali.org/kali kali main contrib non-free
## Kali-dev
deb http://http.kali.org/kali kali-dev main contrib non-free
## Kali Security updates
deb http://security.kali.org/kali-security kali/updates main
contrib non-free
Not every Kali tool is presently maintained in the official tool repositories. If you choose to update a tool manually, it is possible that you will overwrite existing packaged files and break dependencies. Therefore, some tools that have not been
officially moved to Debian repositories, such as the aircrack-ng, dnsrecon, sqlmap,beef-xss, and Social Engineering Toolkit (se-toolkit), are maintained in the Bleeding Edge repository. This repository may also be added to sources.list using the
following command line:
## Bleeding Edge repository
deb http://repo.kali.org/kali kali kali-bleeding-edge main
DPKG :
Dpkg is Debian's package management system. This command-line application is used to install, remove, and query packages. In general, dpkg performs actions on individual packages.
dpkg is particularly useful in compiling a list of installed
applications in Kali using the command:
dpkg -l > list.txt.
If you want to know if a specific tool is installed, use
dpkg -l |grep <tool name>.
Using Advanced Packaging Tools(APT)
Advanced Packaging Tools (APT), extend the functionalities of dkpg by searching repositories and installing or upgrading packages along with all the required dependencies. The APT can also be used to upgrade a complete distribution.
The most common apt commands are as follows:
• apt-get update:
This is used to resynchronize the local package index
files with their source as defined in /etc/apt/sources.list. The update
command should always be used first, before performing an upgrade or
dist-upgrade.
• apt-get upgrade:
This is used to install the newest versions of all packages
installed on the system using /etc/apt/sources.list. Packages that are
installed on Kali with new versions available are upgraded. The upgrade
command will not change or delete packages that are not being upgraded,
and it will not install packages that are not already present.
• apt-get dist-upgrade:
This upgrades all packages currently installed on
the system and their dependencies. It also removes obsolete packages from
the system.
The apt-get command can also be used to show a full description of a
package and identify its dependencies
apt-cache show <package name>
or remove a package
apt-get remove <package name>.
The easiest way to do this is to create an update.sh script that includes the
following command line:
apt-get update && apt-get upgrade –y && apt-get dist-upgrade –y
Some applications are not upgraded by the apt-get command. For example,
the local copy of the exploit-db archive must be manually upgraded. Create a script named update.sh and add the following commands to it, to automate the update process:
cd /usr/share/exploitdb
wget http://www.exploit-db.com/archive.tar.bz2
tar –xvjf archive.tar.bz2
rm archive.tar.bz2
Configuring and customizing Kali Linux
Resetting the root password
To change a user password, use the following command:
passwd root
Adding a non-root user
Many of the applications provided in Kali must run with root-level privileges in order to function. Root-level privileges do possess a certain amount of risk, for example, miskeying a command or using the wrong command can cause applications to fail or even damage the system being tested. In some cases, it is preferable to test with user-level privileges. In fact, some applications force the use
of lower-privilege accounts.
To create a non-root user, you can simply use the command adduser from the terminal
and follow the instructions that appear
command...
adduser noroot
after this it will ask for new password..but carefully beco'z password will not shown in the terminal..after this repeat the same password and press enter this will make your noroot user password.
it will ask some basic information write it or press enter will lead to save as default
tha's it.
Speeding up Kali operations
Several tools can be used to optimize and speed up Kali operations:
• if you are using a virtual machine, install the VM's software drive
package:
Guest Additions if you are running virtualbox
or
VMware Tools if you are running VMware .
• When creating a virtual machine, select a fixed disk size instead of one that is dynamically allocated. It is faster to add files to a fixed disk, and there is less file fragmentation.
• The preload application install through command :
apt-get install preload.
identifies a user's most commonly used programs and preloads binaries and dependencies into memory to provide faster access. It works automatically after the first restart following installation.
• BleachBit install through command :apt-get install bleachbit
frees disk space and improves privacy by freeing the cache, deleting cookies, clearing Internet history,shredding temporary files, deleting logs, and discarding other unnecessary files. Advanced features include shredding files to prevent recovery and
wiping free disk space to hide traces of files that have not been fully deleted.
• By default, Kali does not show all applications that are present in the start-up menu. Each application that is installed during the boot-up process slows the system data, and may impact memory use and system performance.
Install Boot Up Manager (BUM) to disable unnecessary services and applications
that are enabled during the boot up
install through command :
apt-get install bum
Installing third-party applications
their about 300+ pentration tool available in kalilinux...but some other addition tool that required can be install by command line
apt-get install..
or
by accessing a GitHub repository, and directly installing the application.
All tools should be installed from the Kali Linux repository using the apt-get install command. The install command can be executed from the command line in a terminal window,
or
the user may select a graphical package management tool.
Recommended third-party applications include:
• apt-file: This is a command-line tool to search within packages of the APT packaging system. It allows you to list contents of a package without installing or fetching it.
• gnome-tweak-tool: This allows users to change themes and rapidly configure desktop options.
• instanbul: This is a desktop screen recorder that allows you to make a movie of desktop activities.
or
• recordmydesktop: this one also use for video making or recors the kALI-LINUX SCREEN WHICH IS INBUILD OR PREINSTALL IN KALI.
RUN THROUGH TERMINAL...
COMMAND..
recordmydesktop --no-sound //actually not in all system bu in mysystem it doesnot support audio.
use command
recordmydesktop man //read the manual of recordmydesktop
• openoffice: This is an open source office productivity suite that assists in documentation.
• scrub: This is a secure deletion (anti-forensic) tool that securely deletes data to comply with stringent government standards using various overwrite patterns.
• shutter: This is a screenshot tool that captures images of a desktop,open window, or a selection.
• team viewer: This supports remote access and remote administration. It also allows testers to place a pre-configured computer (a dropbox) on the target network and control testing from a remote location.
• terminator: This is a replacement for the Linux terminal window that allows horizontal scrolling—no more wrapped text!
Some tools use the GitHub online repository for software development projects.
Many developers favor this open repository due to the flexibility of the Git revision system as well as the social-media aspects of the software sites. One tool that we will be using is
recon-ng, a web reconnaissance framework.
To clone the current version of recon-ng from the GitHub repository, use the following command line:
1. cd /opt
2. git clone https://LaNMaSteR53@bitbucket.org/LaNMaSteR53/recon-ng.git
3. cd opt/recon-ng
4 ./recon-ng.py
Finally, some applications must be manually installed. For example, to restore the
asynchronous port scanner Unicornscan, can back to Kali, you must:
• Ensure the dependencies are first present:
apt-get install flex
• Download the latest version of Unicornscan (www.unicornscan.org – the current version is unicornscan-0.4.7-2)
• Extract the contents of the file to a new directory:
tar jxf unicornscan-0.4.7-2.tar.bz2
• Change to the directory containing Unicornscan:
cd unicornscan-0.4.7/
• Compile the source code:
./configure CFLAGS=-D_GNU_SOURCE && make && make install
The exact dependencies and make install process will vary for each application, so you will need to refer to the developer's README file to ensure correct installation and configuration of these applications.
CUTYCAPT
CutyCapt, which is a cross-platform command-
line utility that captures a web page and creates a variety of image types, including PDF, PS, PNG, JPEG, TIFF, GIF, and BMP.
For example, to create an image of a specific size from the Google search page, enter the following from a command-line prompt:
cutycapt --url=http://www.google.com --out=google.png --min
width=300 --min-height=250
URL= write the url whose screenshot yoou wanna to take
--out= write the name of screenshot you want also what type of extention i ean..png ,.gif ,.bmp or .jpeg
--min-width=width of image
--min-height=height of image
CutyCapt is especially useful when demonstrating the presence of web-based
vulnerabilities such as cross-site scripting.
THAT'S IT FOR THIS ARTICLE IN NEXT ARTICLE WE WILL TALK ABOUT
INFORMATION GATHERING
for next tutorial on KALILINUX -basics click here
ZEROCOOL
SIGN OUT