Choosing Your Kali Linux Desktop Enviroment

Kali Linux has evolved significantly over recent years. It is now a rolling distribution offering multiple desktop environments and various kernel architectures. You can run Kali on a tiny Raspberry Pi or on a full-fledged workstation built for speed and power. By adding a regular user account and a few extra packages, you can even use Kali as your daily driver. This section explores several desktop environments and their strengths and weaknesses to help you decide which distribution to download for your hacking tasks. If you are new to Linux, this will also give you some insight into Linnux internals and its design.

Desktop Environments vs Window Managers

A key distinction that helps you understand how desktops work in Kali and other Linux systems is the window manager. A desktop environment (GUI) typically includes folders, wallpaper, widgets, icons, windows, toolbars, and application interfaces. The Microsoft Windows desktop is probably the first similar construct you encountered. Your smartphone also has a desktop environment, and the failure of Windows 8 was an attempt to merge Windows CE (phone GUI) with the Windows 7/Server 2003 GUI. Microsoft assumed more workstations would have touch capabilities; the hardware was available, but monitors were expensive and adoption limited.

On Kali, the desktop environment usually communicates with the X Window System or Wayland, which runs directly on top of the hardware, and interacts with a window manager application that provides the look and feel. Several window managers can be used with nearly any desktop environment in Kali. One such manager is Enlightenment, included as E17 in Kali ISO downloads. The main difference between E17 and full desktop environments such as KDE or Gnome is that E17 has very few applications built specifically for it, whereas KDE and Gnome ship with dedicated applications that may pull in numerous dependencies if run under other desktops. Kate and gedit are the dedicated text editors for KDE and Gnome respectively.

Enlightenment (E17)

Installing the E17 ISO is similar to installing any other desktop, provided you use the default options. The standard boot screen drops you into runlevel 3 with only a command- line interface, so you must use startx to see the graphical desktop, as shown below:

When you first log into the E17 environment, you will be presented with a series of questions that you already answered during installation: language (default American English), keyboard layout (default English US), hardware profile (Mobile or Computer), title bar size (0.8 to 2.0), window focus (click or mouse hover – Linux default is mouse hover), whether to enable Connman (the Enlightenment network connection manager), and compositing (the source of most visual effects; you may want hardware-accelerated compositing on bare metal installations or disable it on low-RAM setups):

You can also enable update checks (disable this if operating within a target network to avoid suspicion) and a taskbar. After configuration, E17 displays the default desktop. The first thing you may notice is the plain white background. The top menu row comes from VirtualBox. The bottom menu bar is reminiscent of the Apple Mac dock, and a floating menu appears when you right-click the desktop:

The basic default file manager window is readable but unexciting. By clicking the desktop menu you can add gadgets; the following screenshot shows the right-click menu from a backlight gadget. You can move all gadgets until you click "Stop Moving Gadgets":

E17 issues: almost all security tools are categorised under "Other" in the application menu, which can become cluttered. Also, if you open the click menu near the right screen border, submenus may extend off-screen. The overstuffed "Other" menu is shown below:

Finally, this version of Enlightenment is several years old; the current main release is 22. Perhaps Offensive Security decided to freeze Enlightenment at major version 17 because the Enlightenment developers were moving to Wayland, while E17 in Kali uses xorg. To check which window system your Kali is running, type xdpyinfo. If it fails, you are in a pure Wayland environment; if it returns video configuration lines, xorg is in use:

The simplest way to access all security tools seems to be through the "Run Everything" dialog, but I encountered errors when trying to open the default terminal emulator xterm that way. To install synaptic:

# apt install synaptic

To change the wallpaper in E17, go to Applications | Settings | Wallpaper Settings. You can choose your own image or one of the factory images:

Gnome Desktop

During the Backtrack era (Kali’s predecessor), the default desktop was a very stripped‑down KDE version. When Backtrack was retired and Offensive Security released Kali, the default changed to Gnome. Gnome is slightly reminiscent of the Windows 3.11 look and feel and uses less memory to draw the desktop than KDE. The default Kali desktop environment is Gnome 3. A standard installation looks like this:

The toolbar on the left edge is a favourites group. When you open an application, its icon appears in the favourites group, as seen here with OWASP ZAP:

The security tools menu is under the Applications tab at the top‑left corner. It is a well‑categorised list that makes finding tools easier:

Changing the desktop image in Gnome 3 is easy, but the settings menu is a bit hidden – it is tucked under the upper‑right icon. The system menu includes sound volume control, network connection dialog, and the settings editor:

Most Gnome settings can be reached through the settings dialog, which contains panes for Wi‑Fi, background, notifications, search, region & language, universal access, online accounts, privacy, sharing, sound, power, and network. The following screenshot shows the desktop editor with the default background image:

To change the image, simply click on the image you wish to replace. A dialog will open allowing you to choose from several included pictures or your own image.

Gnome 3 issues: there does not seem to be an easy way to add applications to the favourites group, and the drop‑down menu bar uses sliders to navigate instead of full‑length submenus.

KDE Desktop

KDE has existed since the early days of Linux and is a favourite of many. Its look and feel is very similar to that of Windows, making it easy for users migrating from that platform. One advantage of KDE is its extreme configurability; if you do not like how something looks, you can change it. You can even revert KDE to a classic, spartan desktop, which helps with muscle memory because everything stays in the expected place. The next screenshot shows the default desktop with the application menu open:

A disadvantage of KDE is that because it is so highly configurable and ships with many built‑in features, it demands a modern machine with plenty of memory and a capable graphics card. It is also easy to mess up your settings. On the plus side, desktop widgets allow you to monitor system memory, CPU, and network usage at a glance, which is valuable when running resource‑intensive tools. KDE also handles multiple monitors well and can revert to a single monitor without restarting or reconfiguring – a great feature when you use a laptop that moves around frequently.

KDE issues: KDE is graphically heavy and not suitable for very old machines or those with low graphics memory. SHOW STOPPER! During one installation, the KDE instance loaded into a full‑screen CLI (tty1) and startx would not launch the GUI. This is easily fixed by installing the xinit package as root:

# xinit

LXDE Desktop

LXDE, the Lightweight X11 Desktop Environment, was designed in 2006 by Taiwanese programmer Hong Jen Yee. The installation encountered problems, but the Live CD worked well. The default desktop is reminiscent of Windows XP, with the menu start button at the bottom‑left corner:

To change the desktop background, go to Preferences | Desktop Preferences from the menu:

LXDE issues: SHOW STOPPER – graphical installation failed because no partition table was planned and no file system was to be created. A regular install also failed because no operating system was installed.

MATE Desktop

The MATE desktop is a fork of the now‑unmaintained Gnome 2 desktop environment. MATE stands for MATE Advanced Traditional Environment. MATE includes forks of many Gnome applications, and the developers have written new ones. The names are all in Spanish, reflecting MATE’s Argentinian origin. Key applications include:

• Caja: file manager (from Nautilus)
• Atril: document viewer (from Evince)
• Engrampa: archive manager
• MATE Terminal: terminal emulator (from GNOME Terminal)
• Marco: window manager (from Metacity)
• Mozo: menu item editor (from Alacarte)
• Pluma: text editor (from Gedit)

MATE’s first boot, and all subsequent boots, drops you into runlevel 3:

The default GUI is familiar to most Linux users, as it is nearly a mirror of Gnome 2:

The following screenshot shows all three system menus with representative submenus open. The Places menu opens Caja (file management) windows:

The Appearance preferences offer 12 presets that can be further customised:

MATE issues: dropping into runlevel 3 is inconvenient but manageable; you just type startx. Depending on the date you download MATE, you may or may not experience this issue.

Xfce Desktop

Xfce is a lightweight desktop environment, the personal favourite of Wolf Halton. The abbreviation is pronounced ex‑eff‑cee‑ee. It was originally an acronym for X‑Forms Common Environment, but now it uses the GTK toolkit instead of X‑Forms. Xfce was designed as a replacement for the proprietary Unix Common Desktop Environment (CDE) of 1996. The default Xfce desktop is shown below:

The bottom toolbar is minimal but fully functional:

• The first button minimises all windows and shows the desktop.
• The second button opens a command‑line terminal emulator.
• The third button opens the Thunar file manager.
• The fourth button opens the Firefox web browser.
• The fifth button is the application finder.
• The sixth button is the active user’s home directory.

Here is an example of the opened home directory, terminal emulator, browser window, and application finder:

You can change the desktop background via four tabs that allow deeper subtle changes:

Xfce issues: there are no real show‑stoppers; Xfce is a very stable desktop environment.

Selecting the Look and Feel

Your use case will play a large role in choosing hardware and the level of customisation that satisfies you:

• If you always run from USB storage or optical disc, Gnome 3 (because it is the most tested by developers) or Xfce (because it uses the fewest resources) are best.
• If you install to a virtual machine, Xfce or LXDE are preferable because VMs tend to have lower resource levels.
• If you load onto a dedicated server or laptop, you likely have the highest resource levels and are less likely to break the OS often, so choose E17 or KDE for their customisability.
• If you already have deep knowledge of any desktop environment, you should probably choose that one for comfort.

Configuring Kali as Your Daily Driver

Kali has come a long way since its initial development. It was originally a stripped‑down version of Linux intended to run as a VM or from USB/CD. You will notice that Kali is designed to run under the root account; during installation, unlike most other distributions, there is no normal user account setup. This is understandable: in penetration testing you need direct access to hardware and system level, and prefixing every command with sudo is not a useful option.

The following screenshot shows the desktop of the machine Bo used while writing this chapter. Because he was composing documents, researching, and checking email, he used a basic unprivileged user account. Having different wallpapers for each account helps you remember how you are logged in and protects you from doing silly things in the root account:

The next screenshot shows the root desktop on the same machine. When you use this wallpaper, you will have no doubt where you are:

User Account Setup

Once Kali is up and running, you need to add a normal user account to the system to make it your daily driver. Most Kali distributions do not come with a user manager application. They can be installed, but the simplest method, which works across all distributions, is to use the old‑school useradd command in the terminal. This and all other user‑administration tasks are performed as root:

For example, to add a user alice with password SecureSecret789 (change the username and password to your own unique values):

useradd -m -U -G sudo -p SecureSecret789 alice

Flags used:

• -m – creates a home directory under /home.
• -U – creates a unique user group with the same name as the user.
• -G sudo – adds the user to the sudo group so that the normal account has sudo access.
• -p SecureSecret789 – sets the account password. Do not use something trivial here.
• alice – the new username.

Next, you need a few desktop applications. Kali’s repositories do not contain OpenOffice, so we will use LibreOffice. Mozilla Thunderbird is a useful mail/calendar tool. Kali does not ship with a mail client because it is designed to run as root. Warning: never open mail under the root account. Bad things can happen!

First, update the package list:

apt-get update

Then install LibreOffice and Thunderbird:

apt-get -y install libreoffice thunderbird

Alternatively:

apt install libreoffice thunderbird

The -y flag automatically answers "yes" to the installation. This may take a while; the following screenshot summarises the output of the second command:

Now you are ready. Change your root desktop to something that reminds you that you are logged in as root. Log out, enter the new user’s credentials at the login screen, and enjoy the security of a normal user account for everyday tasks. When you need to perform penetration testing, simply log in as root.

---

Sharpening the Axe: Setting Up Kali for Windows Penetration Testing

A craftsman is only as good as his tools, and tools need setup and maintenance. Now that you have an idea of which Kali Linux distribution interests you, this section will help you set up and configure a personal version of the platform. Kali Linux is versatile and can be used for many purposes. This section introduces the tools best suited to your Windows penetration testing requirements, the documentation tools we use to ensure test results are captured correctly, and the Linux services you need to operate those tools.

In Kali’s Gnome3 desktop menu there is a Favorites submenu that the creators consider the most indispensable weapons for a working security analyst:

• Firefox ESR
• Terminal
• Files (similar to Windows Explorer)
• metasploit framework
• armitage (Metasploit GUI front end)
• burpsuite
• beef xss framework
• faraday IDE
• Leafpad

Installing Kali Linux to an Encrypted USB Drive

Secure corporate environments present challenges for security engineers. Approved application lists, centrally managed antivirus, and rules against non‑corporate assets on the network all make testing difficult. Moreover, very few affordable penetration testing tools are written for Windows, and those that exist (such as Metasploit) often conflict with low‑level OS features. Antivirus will quarantine the tools shipped with Metasploit, and host‑based intrusion protection and local firewall rules will cause problems. PCI DSS 3.2.1 requires that any Windows machine handling payment data, or any machine on the same network, must be patched, run a firewall, and have antivirus installed. Disabling these protections is usually forbidden.

Additionally, you may need to perform external tests. Hanging a Windows machine directly on the public internet with all security applications turned off is unwise – it could be infected with a worm within 20 minutes.

The answer is an encrypted, bootable USB drive loaded with Kali Linux. Kali’s installation screen offers an option to install to a USB drive with "persistence," which lets you save files to the USB, but the drive is not encrypted. By performing a normal full installation with whole‑disk encryption, you protect the data if the USB is lost or stolen. In this section we will install Kali to a 64 GB USB drive. For everyday testing we use a 1 TB USB 3.0 drive, but 64 GB is a good size for most engagements.

Installation Prerequisites

You will need a 64 GB USB flash drive, a Kali DVD, and a machine with a DVD drive and the ability to boot from USB. Download Kali from www.kali.org/downloads/:

The next screenshot shows the available ISO files:

Booting and Configuration

Insert the DVD and USB drive, then boot the machine. Make sure the USB drive is inserted before boot so that the installer sees it. Choose "Graphical install" from the boot menu:

Set your country, language, and keyboard. Give the machine a unique hostname rather than the default; this helps when you have saved data and screenshots from multiple machines:

Next, enter a domain name. Use a real domain that you or your company controls, such as testing.example.com. Avoid fake domains like .local or .localdomain:

Set a strong root password. Remember, during penetration testing you will use the root account exclusively because you need to open and close ports and fully control the network stack:

Select your time zone. Many tools on Kali output timestamps that are legal evidence of your actions and when they occurred.

Drive Setup

Now it is time to set up the drive, encrypt it, and partition it. Choose "Guided – use entire disk and set up encrypted LVM" to fully encrypt the entire drive:

Caution! Carefully select the USB drive and not the local disk; choosing the local disk will erase its operating system. The next window shows the USB drive and a VMware virtual disk. Select the USB drive and click Continue:

When asked how to partition the drive, accept the default. Confirm that you want to write the changes; all data on the disk will be lost. The disk will be fully erased and encrypted – this may take about 30 minutes for a 64 GB drive. You will then be asked to create a passphrase for drive encryption. Use a long, memorable phrase, such as a line from a song or a poem. Even without numbers, a phrase like "Mary had a little lamb and took it to the fair" would take John the Ripper over a month to crack. Confirm the changes and choose "Finish partitioning and write changes to disk."

Partitioning will start:

When partitioning finishes, the system installation will begin. USB is a slow protocol compared to ATA hard drives, so be patient:

You will be asked whether to use a network mirror. Select Yes – this will choose a repository mirror close to your location and speed up future updates. After completion, reboot and remove the installation disk.

Booting Your New Kali Installation

Boot from the USB drive. You will first be prompted for the disk encryption passphrase (not the root login password). Enter the phrase and press Enter:

The system will then boot. On the e17 version you will see a terminal login screen; log in as root and type startx to launch the GUI. On the standard Gnome3 installation, a graphical login screen (GDM) appears:

Hacker Tip: Use these tools only on systems you own or have written authorisation to test. Unauthorised testing violates various laws and can lead to imprisonment.

Once logged in, check that everything is up‑to‑date. Open a terminal and run:

root@kalibook:~# apt-get update
root@kalibook:~# apt-get -y upgrade

Running Kali from a Live DVD

Running Kali from a live disk is best for forensics or recovery tasks. A live disk does not write to the computer’s hard drive. Some tools, such as OpenVAS, cannot work because they need to save configuration and file updates. To run Kali from DVD, simply boot from the disc. The boot screen offers several options:

• Live (amd64) – boots with a working network stack, good for recovering dead machines.
• Live (forensic mode) – does not touch the machine’s drives; memory is not flushed, allowing you to capture old memory and perform forensic copies.
• Live USB with persistence – requires installation to a USB drive; refer to kali.org/prst for a tutorial.
• Install – the Debian ncurses text‑based installer, suitable if you are comfortable with the command line.
• Graphical install – used for direct installation to hard disk or, as demonstrated, to a USB drive.

Installing and Configuring Applications

Most of what you need is pre‑installed on Kali. However, some useful applications are not included in the base installation. We will also set up and configure OpenVAS.

• Gedit – a better text editor than the default Leafpad. Install with: ``` root@kalibook:~# apt -y install gedit

• Geany – a cross‑platform code IDE with strong string‑editing, auto‑tag closing, and syntax highlighting. Install with: ``` root@kalibook:~# apt -y install geany

  
  ![Geany in Kali Linux](https://i-blog.csdnimg.cn/blog_migrate/ab0e80388919359951a9595b3954ce54.png)
  

• Terminator – a multi‑tasking terminal emulator that allows splitting the screen into several windows and broadcasting commands to all. Install with: ``` root@kalibook:~# apt -y install terminator

  
  ![Terminator](https://i-blog.csdnimg.cn/blog_migrate/e4f2de9641a1c944eb77ff744b78269c.png)
  

• Etherape – a visual passive/active network sniffer, excellent for Wi‑Fi networks. Install with: ``` root@kalibook:~# apt -y install etherape

  
  ![Etherape](https://i-blog.csdnimg.cn/blog_migrate/feda45a5dd4d1b033ffdc4215e4f74e7.png)
  
  

Setting Up and Configuring OpenVAS

Reconnaissance is everything, so a good vulnerability scanner is essential. Kali used to ship with OpenVAS pre‑installed; now you must install it:

root@kalibook:~# apt -y install openvas

Before use, it must be configured and updated. Kali includes a handy script found under Applications | Vulnerability Analysis | OpenVAS initial setup. Clicking this will run the script, set up self‑signed SSL certificates, download the latest vulnerability data, and generate a password for the admin account. Save this password; you will need it to log in. You can change it after first login.

There is also a setup check script under Applications | System Services | openvas check setup. It checks the services and configuration and provides help if something is wrong:

The script output shows that the services are running on the local interface only, which is acceptable for our work:

Now log into the Greenbone web interface at https://localhost:9392. Accept the self‑signed certificate warning. Log in as admin with the complex password generated during setup. Once logged in, navigate to Administration | Users, click the wrench icon next to admin, change the password to something still strong but more memorable, and click Save:

Reporting Your Tests

Clear documentation helps report your work. Two tools are presented:

• KeepNote – a standalone document organiser suitable for solo work. You can find it under Applications | Usual Applications | Office | KeepNote. The following screenshot shows a KeepNote setup for a short test:

  Hacker Note: To edit images, install GIMP with apt install gimp and drag images into KeepNote directories.

• Dradis – a web‑based document organiser for team collaboration, accessible at https://127.0.0.1:3004. It can be hosted on a remote secure server.

Running Services on Kali Linux

Several services you will want to start when needed. In Kali, you tend to shut down your workstation when you are not actively performing security analysis tasks, and you certainly do not want tools like OpenVAS or Metasploit accessible over the internet. This means you start them when needed and stop them when not.

You can control services from Applications | System Services or via the command line using systemctl. For example, to manage Apache2:

systemctl start apache2
systemctl status apache2
systemctl restart apache2
systemctl reload apache2
systemctl stop apache2

The following screenshot compares apache2ctl and systemctl status requests:

---

Information Gathering and Vulnerability Assessment

There is a misconception that all Windows systems are easy to compromise. This is not entirely true. Almost any Windows system can be hardened to the point where exploitation would take too long to be worthwhile. In this section, you will learn how to footprint your Windows network and discover vulnerabilities before the bad guys do.

Footprinting the Network

You cannot find your way without a good map. In hacker parlance, this is called footprinting. It is the first step of any legitimate hack operation and will save you both time and a great deal of frustration. The most important tool in any penetration tester’s toolbox is your mindset. You must have the mindset of a sniper. You learn your target’s habits and behaviour, understand the flow of traffic on the target’s network, find the target’s weaknesses, and then attack those weaknesses.

Footprinting differs depending on whether your target is on an external public network or an internal LAN. We will cover both.

Nmap

You cannot talk about networks without mentioning Nmap. Nmap is the Swiss Army knife of network administration. It is not only a great footprinting tool but also the best and cheapest network analysis tool any system administrator can own:

• Checks if a single server port is up
• Heartbeat‑pings an entire network segment or several hosts
• Discovers machines even when ICMP (ping) is turned off
• Stress‑tests services

Nmap was created by Gordon Lyon (Fyodor) in 1997 and is still maintained at insecure.org. Since you are running Kali Linux, you already have Nmap installed.

An example of running Nmap against a Kali instance:

root@kalibook:~# nmap -A 10.0.0.4

Initially, no open ports were found. We started the built‑in web server with:

root@kalibook:~# /etc/init.d/apache2 start

Running the Nmap command again revealed the web server version and an OS guess:

Nmap also runs in the Git Bash application on Windows. If you become impatient, pressing the arrow keys will print a status line showing the percentage of scan completion:

Zenmap

Zenmap is the graphical front end for Nmap. It can be found under Kali Linux | Information Gathering | Network Scanners | Zenmap. One cool feature is that as you configure a scan using the buttons, Zenmap also writes out the command‑line version of the command, helping you learn the flags for the command‑line mode:

The "Intense scan" option generates nmap -T4 -A -v:

• -T4 – timing template (1 to 5); faster scans are coarser and more likely to be detected by an IDS.
• -A – enables OS detection, version detection, script scanning, and traceroute.
• -v – verbose (use -vv for very verbose).

A drop‑down box lists the most common scan types:

Verbosity Differences

The following three screenshots show the difference in verbosity during an OS scan. The topology tab and Hosts Viewer button give a good list of hosts. Addresses are colour‑coded: green indicates secure, yellow and red indicate vulnerable systems or services:

Scanning Network Ranges

If the network has ICMP turned off, ping sweeps take a long time. A standard UDP port scan tests 1,000 ports and may take about 21 hours. Use UDP scanning only with a very good reason.

Zenmap also has a useful Compare Results feature (Tools | Compare Results). The folowing screenshots show two scans of a network; the second scan discovered a new machine that was previously down. With -vv even more information is displayed:

To quickly find only Windows machines, use a fast scan: nmap -T4 -F 10.0.0.0/24 or the quick scan plus: nmap -sV -T4 -O -F --version-light 10.0.0.0/24. The output indicates that 10.0.0.12 is likely a Windows box:

Nmap can also be run from the Windows command line if allowed by company policy:

When viewing the Topology tab, you can adjust the size of groups. Clicking on a host brings it to the centre:

Annotated List of Nmap Command Options

Beyond the dropdown list in Zenmap, many commands and options customise scans. In a Linux box you can find more information via the help page (nmap -h), man page (man nmap), and info page (info nmap).

Below is a condensed annotated version of the Nmap 6.47 help file:

• TARGET SPECIFICATION: e.g., atlantacbudtech.com, 192.168.3.111;
  -iL <inputfilename> – read targets from file;
  -iR <num hosts> – choose random targets;
  --exclude <host1[,host2],…> – exclude hosts;
  --excludefile <exclude_file> – exclude list from file.
• HOST DISCOVERY:-sL – list scan; -sn – ping sweep; -Pn – treat all hosts as online; -PS/PA/PU/PY – TCP SYN/ACK/UDP/SCTP INIT discovery; -PE/PP/PM – ICMP echo, timestamp, netmask requests; -PO – IP protocol ping; -n/-R – never/always do DNS resolution.
  DNS resolution can reveal information but generates traffic that may alert administrators.
• SCAN TECHNIQUES:-sS/sT/sA/sW/sM – TCP SYN/Connect()/ACK/Window/Maimon scans; -sU – UDP scan; -sN/sF/sX – TCP Null, FIN, Xmas scans; --scanflags – custom TCP flags; -sI <zombie host> – idle scan; -sY/sZ – SCTP INIT/COOKIE-ECHO; -sO – IP protocol scan; -b <FTP relay host> – FTP bounce scan.
• PORT SPECIFICATION:-p <port ranges> – e.g., -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9; -F – fast mode; -r – sequential ports; --top-ports <number>; --port-ratio <ratio>.
• SERVICE/VERSION DETECTION:-sV; --version-intensity 0-9; --version-light/--version-all; --version-trace.
• SCRIPT SCAN:-sC (default scripts); --script=<Lua scripts>; --script-args; --script-trace; --script-updatedb.
• OS DETECTION:-O; --osscan-limit; --osscan-guess.
• TIMING AND PERFORMANCE:-T<0-5>; --min-hostgroup/max-hostgroup; --min-parallelism/max-parallelism; --min-rtt-timeout etc.; --max-retries; --host-timeout; --scan-delay; --min-rate/--max-rate.
• FIREWALL/IDS EVASION AND SPOOFING:-f (fragment packets); --mtu; -D <decoy1,decoy2[,ME],…>; -S <IP_Address>; -e <iface>; -g/--source-port <portnum>; --proxies; --data-length; --ip-options; --ttl; --spoof-mac; --badsum.
• OUTPUT:-oN/-oX/-oS/-oG <file>; -oA; -v/-vv; -d; --reason; --open; --packet-trace; --iflist; --log-errors; --append-output; --resume; --stylesheet; --webxml.
• MISC:-6 (IPv6); -A (aggressive scan); --datadir; --send-eth/--send-ip; --privileged/--unprivileged; -V; -h.

Examples:

nmap -v -A boweaver.com
nmap -v -sn 192.168.0.0/16 10.0.0.0/8
nmap -v -iR 10000 -Pn -p 80

Using OpenVAS

Nmap does a great job reporting ports and services but lacks the ability to scan for vulnerabilities. OpenVAS fills that gap. The OpenVAS people update their vulnerability lists weekly, so it is best to update before running a scan. From a terminal, run:

root@kalibook:~# openvas-nvt-sync
root@kalibook:~# openvas-scapdata-sync

The first time, you will be asked to migrate to using Rsync; type Y and press Enter. Then start the OpenVAS service from Applications | Kali Linux | System Services | OpenVAS | Start OpenVAS. Navigate to https://localhost:9392 and log in.

When not to use OpenVAS? Some corporate networks already have scanning services such as Qualys, Nexpose, or Nessus. Unless you suspect the official scanner is misconfigured or outdated, there is no need to duplicate the scan. Those services can export their data in XML format, which can be imported into tools like Metasploit.

To run your first scan, enter the target subnet or IP into the scan text box and click the button to start. You can also set up custom scans or schedule jobs. While scanning, you can go and have coffee – scanning an average network takes time:

When the scan completes, go to the Scan Management tab, select Reports from the dropdown, and you will see results ranked from highest to lowest severity. You can generate reports in various formats:

Using Maltego

Maltego is an information‑gathering tool that goes beyond network information; it can also collect data about people and companies from various sources. We will use it to gather network information about a public domain. On first launch, you need to register for the transform server (free, no spam). Choose the CE (Community Edition) version, create an account, solve the captcha, and click Finish. Drag the domain icon from the left toolbar onto the graph page. The default domain is paterva.com; change it in the Property View to a domain you own (e.g., boweaver.com). Right‑click the domain icon and choose "Run Transforms" (the double arrow) to fetch information. Maltego will query online sources and return the owner, IP addresses, physical locations, and more:

Data collected showed the domain was registered with GoDaddy, DNS admin email was postmaster@boweaver.com, mail server was bomail, and a relationship to boweaver.net. Right‑clicking the website and choosing "Resolve to IP" revealed the IP address, allocated netblock, Autonomous System Number (ASN), and that the site is hosted in a Digital Ocean datacenter in New York:

Maltego allows saving to CSV, generating reports, or exporting the graph as an image:

Using KeepNote

Penetration testing collects a tremendous amount of data. KeepNote is a simple note‑taking application that allows you to save manual exploitation output, scan data, and screenshots in a structured manner. Bo uses a folder framework: a client organisation folder, a dated test folder (e.g., Ext-20150315), and subdirectories for evidence, notes, and scan documents. All screenshots go into evidence, KeepNote files into notes, and scans into scans-docs. This structure helps when you need to refer back months later or if legal proceedings require documentation:

---

Sniffing and Spoofing Network Traffic

Sniffing network traffic helps you understand what services users are accessing that you can exploit. IP spoofing can poison a system’s DNS or ARP cache, redirecting all traffic to a man‑in‑the‑middle host. Both techniques are frequently used against Windows endpoints, and you need to understand the methods attackers will use.

Sniffing Network Traffic

Kali’s motto is the quieter you become, the more you are able to hear. That is the essence of network sniffing: you quietly listen, copying every packet. Passwords sent in cleartext (Telnet, FTP, HTTP) can be captured directly without cracking hashes. Sniffers are also invaluable for finding attackers and for network diagnostics.

tcpdump

tcpdump is a simple command‑line sniffer available on most routers, firewalls, and Linux/UNIX systems. A Windows version (microolap) and the open‑source WinDump exist as well. tcpdump is best used to capture traffic to a file for later analysis with a tool like Wireshark.

To see packets in real time:

tcpdump -v -i vmnet1

To write output to a .pcap file:

tcpdump -v -i vmnet1 -w kalibook-cap-20150411.pcap

On the Kali box, start the SSH service, transfer the file from the firewall with scp, then stop SSH. For Windows machines, you can use the built‑in FTP command or a tool like Core FTP. Set up an FTP server on Kali using Metasploit: create a public directory, set permissions to 777, copy the WinPcap driver and tcpdump.exe into it, then load the auxiliary FTP server module:

use auxiliary/server/ftp
set FTPROOT /root/public
run

WinDump (Windows tcpdump)

WinDump is the Windows version of tcpdump, open source under the BSD license. Download it from www.winpcap.org/windump/ along with the WinPcap driver. Once the driver is installed on the compromised Windows machine, you can capture packets from the command line:

.\WinDump.exe -w Win7-dump-20150411.pcap

Transfer the capture file back to Kali via SMB. In the MATE file manager, use Go | Location… and enter smb://10.0.2.101/C$, providing the compromised Windows credentials. Then drag the file to your evidence directory:

Wireshark

Wireshark is the industry‑standard packet analyser. It is pre‑installed on Kali. Open Wireshark (Applications | Kali Linux | Top 10 Security Tools), accept the root‑user warning, and load the .pcap file. The top pane lists captured packets; the middle pane shows the decoded packet details; the bottom pane displays the raw hex. Clicking a line in the middle pane highlights the corresponding bytes in the raw view.

In an SMB NTLMSSP packet, you can see the account name (IVEBEENHAD\Administrator) and extract the NTLM hash for pass‑the‑hash attacks or offline cracking with John the Ripper or Hydra:

Wireshark’s powerful Find function and display filters (e.g., ip != 10.0.0.232) help narrow down traffic. The Expression… button aids in building custom filters:

Spoofing Network Traffic

Spoofing comes in several forms: email spoofing for phishing, domain spoofing to poison routing tables, typosquatting, and IP spoofing with crafted packets. Ettercap is a powerful tool that can sniff, capture, and spoof traffic.

Ettercap

Launch Ettercap from Applications | Kali Linux | Sniffing/Spoofing | Network Sniffers | ettercap‑graphical. Start with Sniff | Unified sniffing…, select the interface, then begin the capture. Under Logging, log user messages to a file. Next, scan for hosts (Hosts | Scan for hosts). After the host list appears, go to Mitm | Arp poisoning… and choose to sniff remote connections. Once poisoning starts, traffic flows through Ettercap, and it will display NTLM password hashes of users such as Administrators. These can be fed directly into John the Ripper or Hashcat for cracking:

Ettercap on the Command Line

If you lack a graphical environment, Ettercap can be used via its Ncurses interface or in plain text mode. For curses mode, use:

root@kalibook:~# ettercap -C -m ettercap-msg.txt

Add -w ettercap-capture.pcap to save the full capture for later import into Wireshark. The following screenshots show the Curses and plain‑text interfaces: