Cybersecurity and Ethical Hacking Tutorials

Install Fail2ban, enable the sshd jail with sane bantime and ignoreip values, verify bans after failed SSH logins on RHEL and Debian, and unban trusted client addresses when needed.

Change or disable SELinux on Linux with setenforce for runtime permissive mode, semanage for one domain, grubby --args selinux=0 for permanent disable on RHEL 9 and 10, and a one-time GRUB edit when the system will not …

Block ICMP timestamp request (type 13) and reply (type 14) on Linux with firewalld rich rules, nftables, iptables, or UFW, then verify from a second host with nping before compliance scans run again.

The OpenSSH client reads ~/.ssh/config for host aliases, keys, ports, ProxyJump bastions, and connection reuse—this guide walks through examples and how to verify them with ssh -G.

Find where OpenSSL keeps openssl.cnf, trust-store certificates, libssl libraries, and the openssl binary on Linux and Windows. Use openssl version -d, which openssl, ldconfig, and OPENSSL_CONF when paths differ between …

Learn RHEL patch management with DNF: identify security advisories and CVEs, apply security-only updates, patch specific RHSA or CVEs, and verify remediation.

Reverse shell cheat sheet for authorized Kali labs: Netcat listeners, bash /dev/tcp one-liners, Python, Perl, and PHP callbacks, plus bind shells and common connection failures.

Install GNU flex and bison on Kali Linux as modern Lex and Yacc replacements, verify versions, compile a sample flex scanner, and remove the packages when the lab is done.

Build and install Pyrit 0.5.1 on Kali Linux from the JPaulMora GitHub tree with Python 2.7, fix GCC 14 compile flags, verify with pyrit list_cores and benchmark for authorized WPA lab work.

Install Gophish v0.12.1 on Kali Linux from the official GitHub release, configure config.json, start the admin UI on port 3333, and log in with the first-run password in an authorized phishing lab.

Install the Aircrack-ng suite and airmon-ng on Kali Linux with apt or a source build, verify SIMD support, list wireless interfaces, and enable monitor mode for authorized Wi-Fi labs.

Run Torshammer slow POST DoS tests on Kali Linux against local Apache or DVWA, compare DoS versus DDoS, and read curl timing before and during an authorized lab attack.

Hide and recover secret text inside JPEG and PNG images on Kali Linux with steghide and Stegosuite, compare OpenStego, and read capacity and encryption output in an authorized lab.

Install APKHunt on Kali Linux, scan Damn Vulnerable Bank and InsecureShop APKs with OWASP MASVS static rules, and read console and TXT reports in an authorized Android pentest lab.

Analyze the public Cridex banking trojan memory sample with Volatility 3 and Volatility 2 on Kali Linux—OS profile, process tree, network connections, and reader_sl.exe extraction.

Install Infoooze 1.3.1 on Kali Linux and run OSINT modules for port scanning, user-agent parsing, EXIF extraction, username recon, and HTTP headers in an authorized lab.

Install and run OWASP Nettacker 0.4.0 on Kali Linux with Docker, scan Metasploitable 2 using the port_scan module, and start the optional web UI with --start-api in an authorized lab.

Learn man-in-the-middle attacks with ARP spoofing on Kali Linux using arpspoof from dsniff, IP forwarding, and bidirectional poisoning against Metasploitable on an authorized VirtualBox host-only lab.

Setup ProxyChains on Kali Linux with proxychains4 and the tor daemon, edit proxychains4.conf for Tor SOCKS, verify with check.torproject.org, and route authorized lab tools through a proxy chain.

Fuzz web paths and parameters on Kali Linux with FFUF, Gobuster, Feroxbuster, Wfuzz, Dirsearch, and Burp Intruder against Metasploitable 2, with wordlist tips and false-positive filters for authorized testing.

Install Node.js and npm on Kali Linux from the rolling apt repository or per-user nvm, run a test script, switch versions with .nvmrc, and fix path and permission errors without NodeSource scripts.

Install .deb files on Kali Linux with apt install ./package.deb, inspect packages with dpkg-deb, fix broken dependencies, verify architecture, and remove or purge local installs safely.

Configure Kali Linux repositories in deb822 kali.sources, compare rolling and snapshot branches, add third-party repos safely with Signed-By, and fix common apt update errors on Kali Rolling 2026.2.

Install Tor Browser on Kali Linux from the official signed archive when torbrowser-launcher is missing, verify with GPG, launch without root, and troubleshoot connection and clock issues.

Find hidden web paths and API-style routes on Kali Linux with Gobuster, LinkFinder, gau, Nikto, and curl against Metasploitable 2 and authorized archive lookups on example.com.

Enumerate subdomains on Kali Linux with Subfinder, Assetfinder, Sublist3r, massdns, and Amass against the authorized zonetransfer.me training zone, then resolve brute-force candidates with a short wordlist.

Scan WordPress sites on Kali Linux with WPScan — refresh local metadata, enumerate versions, users, and installed plugins, query the WPScan API for CVEs, and test login passwords in an authorized Docker lab.

Install John the Ripper on Kali Linux with apt, verify formats and benchmarks, crack lab SHA-512 and MD5 hashes in wordlist, rules, single, and incremental modes, restore sessions, and audit ZIP and SSH key passwords …

Generate custom password wordlists on Kali Linux with Crunch — charset ranges, patterns, permutations, file splitting, and gzip output for authorized brute force and hash cracking labs.

Learn SSH brute force testing on Kali Linux with Hydra, Ncrack, Patator, Metasploit ssh_login, and Nmap ssh-brute against Metasploitable OpenSSH in an authorized lab.