Subdomain Enumeration Tools and Examples on Kali Linux
Get subdomains on Kali with Subfinder, Assetfinder, Amass, and massdns — passive enumeration, JSON source attribution, merge and resolve pipelines, and DNS validation on the authorized zonetransfer.me training zone.
WPScan Tutorial: Scan WordPress Plugins, Themes, Users, and Vulnerabilities
Use WPScan 4 on Kali to fingerprint WordPress, get an API token for CVE data, enumerate plugins themes and users, read vulnerability results, and validate findings in an authorized Docker lab.
Proxmox Pentest Lab Setup: Isolated Bridge and Storage
Build the Proxmox VE foundation for a penetration testing lab: an internal bridge with no physical port for attack traffic, LVM-thin and ISO storage pools, static addressing for Kali and Windows targets, and direct Web …
How to Create a Windows RAT with msfvenom and Meterpreter
Learn how to create a Windows RAT in an authorized lab with msfvenom and Meterpreter on Kali. Generate the payload, configure multi/handler, receive the callback, and verify the session.
Linux Privilege Escalation: How to Escalate to Root
Escalate from a low-privilege Linux shell to root with an ordered guide: enumeration, sudo, SUID, capabilities, cron, PATH hijacking, passwd permissions, LinPEAS, and lab proofs.
Windows Privilege Escalation with winPEAS and SeImpersonate
Learn Windows privilege escalation with winPEAS, whoami /priv, unquoted service paths, and SeImpersonate token abuse with SweetPotato or PrintSpoofer to reach SYSTEM.
Password Spraying and Credential Stuffing on Active Directory
Password spray Active Directory with Kerbrute and NetExec on Kali. Check lockout policy and FGPP, validate users, spray Kerberos/SMB/LDAP, and test credential stuffing safely in GOAD-Light.
Nmap Scripting Engine (NSE) for Enumeration on Kali Linux
Use Nmap NSE scripts on Kali to enumerate SSH, HTTP, FTP, SMB, and TLS certificates with safe and discovery categories, script-args, and saved output against Metasploitable 2, scanme.nmap.org, and nmap.org in an …
SMTP and SMB Enumeration on Kali Linux
Enumerate SMTP users and SMB shares on Metasploitable 2 with smtp-user-enum, NetExec, enum4linux, and smbclient on Kali Linux in an authorized pentest lab.
Network Sniffing with Wireshark and tcpdump on Kali Linux
Capture and analyze Metasploitable 2 HTTP traffic with tcpdump and tshark on Kali Linux, then open the pcap in Wireshark for passive recon in an authorized pentest lab.
ffuf Web Fuzzing Tutorial: Directories, Parameters, and Virtual Hosts
Learn web fuzzing with ffuf on Kali: directory discovery, filters, auto calibration, parameter and POST JSON fuzzing, virtual hosts, recursion, Burp replay, plus a Wfuzz comparison for authorized labs.
How to Find Hidden Web and API Endpoints on Kali Linux
Find hidden web and API endpoints on Metasploitable 2 with API spec probes, browser traffic, Katana JS crawling, Gobuster, ffuf, dirb, and Nikto in an authorized Kali lab.
Metasploit Tutorial: From Vulnerability to Meterpreter Session
Walk from an Nmap finding to a Metasploit module, payload, handler, and Meterpreter session on Kali Linux with msfconsole, msfvenom, and exploit/multi/handler against Metasploitable 2.
Network Reconnaissance with Nmap on Kali Linux
Use Nmap on Kali Linux to find live hosts, open TCP/UDP ports, service versions, and OS details with tested Metasploitable and scanme.nmap.org examples.
DNS Enumeration and Subdomain Discovery on Kali Linux
Learn DNS enumeration on Kali Linux with tested dig, dnsenum, DNSRecon and Nmap examples. Find DNS records, subdomains, reverse names and misconfigured AXFR zone transfers.
ARP Spoofing MITM Attack with Bettercap and Ettercap
Learn how ARP spoofing creates an on-path MITM position on Kali Linux with Bettercap and Ettercap, verify poisoning with victim ARP tables and Wireshark, and see why HTTPS stays encrypted.
Kali Linux Vulnerability Scanner Tools: Which Scanner Should You Use?
Choose a Kali Linux vulnerability scanner by use case—Nmap, Nikto, Nuclei, Greenbone/GVM, Nessus, Burp, ZAP, and specialized tools—with a practical workflow for authorized pentests.
BloodHound Active Directory Attack Path Mapping on GOAD-Light
Collect GOAD-Light Active Directory data with bloodhound-ce-python on Kali, ingest into BloodHound CE on the same attacker VM, and map shortest attack paths to Domain Admins in an authorized Proxmox lab.
OpenVAS / Greenbone Tutorial: Install, Scan, and Read Results
Install Greenbone Vulnerability Manager on Kali Linux, wait for feed sync, create a scan target and task, read severity and QoD in reports, and fix common no-scan-config errors.
Modify Bash and Python Scripts for Recon and Enumeration
Modify Bash and Python recon scripts on Kali Linux—loops, functions, arithmetic, and Nmap wrappers—to port-scan, HTTP-probe, and ping-sweep Metasploitable 2 in an authorized lab.
Banner Grabbing and Service Enumeration on Kali Linux
Learn banner grabbing on Kali Linux with Nmap, Netcat, curl, and HTTP examples. Identify SSH, FTP, SMTP, and web service banners, then verify versions before CVE research.
Shodan Tutorial: How to Use Shodan on Kali Linux
Shodan tutorial for Kali Linux — install the CLI, initialize your API key, run shodan host and count, learn filter syntax, and see what the tested account unlocked. Optional Censys corroboration for authorized pentests.
Penetration Testing Pre-Engagement: Scoping and Agreements
Learn how to scope a penetration test before testing begins: define objectives, create target and exclusion lists, choose black, gray, or white-box testing, and document NDA, SoW, authorization, and cloud boundaries.
How to Set Up ProxyChains on Kali Linux with Tor
Set up ProxyChains on Kali Linux with proxychains4 and the tor daemon, edit proxychains4.conf for Tor SOCKS, verify with check.torproject.org, and run authorized tools through a proxy chain.
CompTIA PenTest+ (PT0-003) Cheat Sheet: Domains, Tools & Commands
CompTIA PenTest+ PT0-003 cheat sheet: domain weights, essential command matrix, and per-domain tool recall for engagement, recon, vulnerability analysis, attacks, and post-exploitation, with three lab-tested Nmap and DNS …
Data Exfiltration Techniques: Staging, HTTPS, DNS, ICMP & Covert Channels
Learn collection vs staging vs exfiltration with ATT&CK IDs, compare HTTPS DNS cloud FTP SFTP email ICMP and physical channels, run a localhost dummy transfer lab, and map detection and reporting for PenTest+.
C2 Frameworks: Sliver, Mythic, Metasploit and How CALDERA Fits
Compare Sliver, Mythic, Metasploit, and CALDERA for PenTest+ labs: what C2 is, sessions vs beacons, which tool to learn first, and a short localhost hostname check-in demo.
Reverse Shell Cheat Sheet: Netcat, Bash, Python & TTY Upgrade
Linux reverse shell cheat sheet for authorized labs: Netcat variants, bash and Python callbacks, socat, bind shells, TTY upgrade, and listener troubleshooting on Kali.
Penetration Test Cleanup and Restoration Checklist
Penetration test cleanup checklist for authorized engagements: artifact logging, stop listeners, remove persistence and tools, restore config, rotate credentials, preserve evidence, verify restoration, and client …
SSH Pivoting and Tunneling: Port Forwarding, SOCKS & sshuttle
Reach an internal service through a dual-homed jump host using SSH local, remote, and dynamic SOCKS forwards, ProxyChains, sshuttle, and Metasploit route basics — with a namespace pivot practice lab you build on Kali …