Kennedy Muthii

Test archived L3MON on Kali with Genymotion: start the panel, patch and install a lab APK, verify client behavior, then analyze the APK with aapt, apktool, and JADX.

Create Thinkst Canarytokens on canarytokens.org, test a Web bug from Kali with curl, read the alert history, then choose document, AWS, Kubernetes, cloned-site, and MCP honeytokens for authorized detection.

Install Ghost Framework 8.0.0 on Kali, connect it to a Genymotion Android 10 guest over ADB, enumerate the device, and compare Ghost commands with direct adb shell in an authorized lab.

Test the old ADB Android lock screen bypass claims on rooted Genymotion, see why gesture.key fails on modern Android, and learn which recovery options still apply.

Install Zphisher on Kali Linux, run a Facebook-style login template on localhost, submit dummy form data with curl, and inspect auth capture files to see how the phishing workflow works.

Review FiercePhish as a legacy Laravel phishing framework: inspect the official installer, note Ubuntu-only limits on modern Linux, and map campaign concepts without live delivery.

Create harmless PDF payload examples with JavaScript, embedded attachments, and URLs, then analyze them on Kali with PDFiD, pdf-parser, ExifTool, and qpdf.

Create a forensic disk image with Exterro FTK Imager, choose E01 settings, record evidence metadata, verify MD5 and SHA1 hashes, mount the image read-only, and keep acquisition logs.

Test DVWA web login brute-force protection on Kali with a small password list, Hydra http-get-form, Burp Intruder, CSRF and rate-limit caveats, and false-positive checks.

Learn how Browser-in-the-Browser (BITB) phishing fakes an SSO login window inside a real page, how to spot painted address bars, and how passkeys and awareness limit the attack.

Build an authorized ThePhish lab on Kali with TheHive 4 and Cortex, submit a sanitized .eml sample, review observables and analyzer verdicts, and see where MISP fits.

Install Andriller CE 3.6.3 on Kali, create known Genymotion artifacts, run an ADB acquisition, and verify SMS, call logs, and SQLite data in the HTML report.

Install Apktool 3.0.3 on Kali, decode InsecureShop into resources and Smali, make a harmless label change, rebuild with apktool b, sign with apksigner, and install on Genymotion while explaining signature mismatch on …

Find InsecureShop cleartext SharedPreferences credentials on rooted Genymotion, then practice SQLite and file inspection with clearly labeled training data and scoped-storage caveats.

Enumerate InsecureShop deep-link intent filters, trigger custom schemes with adb, attack weak URL validation, and check App Links verification state.

Install Drozer 3.1.0 and the matching Agent on Kali and Genymotion, enumerate InsecureShop components, start an exported activity, and inspect a permission-gated content provider with careful result wording.

Find android:exported activities, services, and receivers in InsecureShop, prove reachability with adb and Drozer, and show why export alone is not a vulnerability.

Install Objection 1.12.5 on Kali, attach to InsecureShop through frida-server on rooted Genymotion, enumerate components and storage paths, and try built-in Android jobs for SSL pinning and root detection before writing …

Pin Frida 17.17.0 on Kali, install a matching frida-server on rooted Genymotion, enumerate InsecureShop, and hook Java methods to observe and modify runtime values over ADB.

Prove Burp CA trust first, identify Android certificate pinning, then bypass Network Security Config and OkHttp pins with Objection and targeted Frida scripts on an authorized training APK so HTTPS appears in Burp.

Route an Android emulator or device through Burp Suite on Kali, install the Burp CA for your Android version, verify HTTPS in a browser first, then diagnose proxy and trust issues before testing apps.

Run MobSF 4.5.2 in Docker on Kali, scan the InsecureShop APK, triage static findings against MASVS, and validate an exported activity on Genymotion with the Dynamic Analyzer.

Install APKHunt on Kali, scan InsecureShop, and manually validate MASVS-style static findings including an exported-activity false negative.

Build a free Android pentesting lab on Kali with Android Studio AVD, pick a Google APIs image without Play Store, verify adb, and sideload a vulnerable APK for authorized mobile testing.

Learn how doxxing works through usernames, social profiles, public records, data brokers and other exposed clues, what an IP can reveal, and how to audit and reduce your own online footprint.

Use WPScan 4 on Kali to fingerprint WordPress, get an API token for CVE data, enumerate plugins themes and users, read vulnerability results, and validate findings in an authorized Docker lab.

Set up ProxyChains on Kali Linux with proxychains4 and the tor daemon, edit proxychains4.conf for Tor SOCKS, verify with check.torproject.org, and run authorized tools through a proxy chain.

Linux reverse shell cheat sheet for authorized labs: Netcat variants, bash and Python callbacks, socat, bind shells, TTY upgrade, and listener troubleshooting on Kali.

Learn how to test SSH logins with Hydra and Medusa on Kali Linux using username and password lists, controlled threads, credential verification, and practical troubleshooting.

Build targeted Kali password wordlists with CeWL, CUPP, and Crunch: choose the right strategy, clean and merge seeds, and know when hashcat masks beat storing every candidate.