Kali Linux, for Ethical Hacking – Tools to Support Cyber Security.
By Lisa Christian.
Kali Linux is a Debian based operating system, that is a version of Linux. It is a platform.
It supports:
Penetration testing,
Security Research,
Computer Forensics, and
Reverse Engineering.
It is made predominately for network analysers and penetration testers. It allows the security tester to not stand out in the crowd and go online, undercover.
There are 600 tools in Kali Linux, that the tester can use.
It is very versatile for security. It simplifies ethical hacking.
It is also used for security auditing.
Kali Linux, is not illegal, but if used for hacking deliberately, then the act of hacking is illegal.
Kali Linux and its tools are all open source, so free to use. There is a version called Win-Kex, which is a full experience of Kali Linux on a Windows based machine.
Here are some helpful tools in Kali Linux:
Burp Suite – for security testing of web applications.
Star Killer – an exploitation tool for penetration testing.
Hydra – login cracker for several protocols, eg ftp.
John the Ripper – weak password cracker.
Maltego – forensic investigations.
Metasploit – for vulnerability research.
Nmap – for port scanning.
Sqlmap – for testing sql injections.
Wire Shark – protocol analyzer.
Ffuf – web fuzzer, for example if post paramaters are not encrypted, then the tester can check web fuzzing.
Following is an in-depth summary to using all of the tools in Kali Linux.
Burp Suite:
Burp suite is a platform that is considered integrated in performing for cyber security testing within web applications.
It gives a thorough mapping and analysis the application's attack surface. This tool supports testing to find and exploit security vulnerabilities.
It has advanced manual techniques and automation, giving the tester complete control of the testing processes.
hydra: hydra uses brute force attacks to crack passwords.
nmap: provides information on network and services on the user’s computer. Takes a target ip address and then provides the details.
parsero: a python script, written to read robot.txt files and disallow entries. Parsec is the windows version.
hashcat: password cracking tool, for win or linux.
beef-xss: browser exploitation framework project tool.
cryptsetup: an interface for configuring block encryption.
powershell: powershell is a command line scripting language, that can be used on win or linux.
metasploit-framework: a ruby based, pen testing tool.
wireshark: network traffic analyzer.
sqlmap: sql injection testing tool. Eg for websites with backend databases.
aircrack-ng: a powerful testing tool for cracking and monitoring wifi.
gobuster: scans a website, for directories and paths, then displays them. Lin based.
ettercap: allows for packets in the network to be dissected and inserted. Lin based.
maltego: is used “to gather, analyze, and visualize publicly available information, uncovering relationships and patterns between entities like domains, IP addresses, social media profiles”, etc. (stationx.net, 2024.)
wifite: a linux tool, used to crack wep and wpa wifi networks. Aircrack-ng is the windows version.
nikto: a web application and website scanner that helps check for vulnerabilities in a website.
netdiscover: used for gathering information about a target, eg in reconnaissance in cyber security (for wireless networks that don’t have a dhcp).
crunch: is a word list generating tool that can be used for brute force attacks. – Linux based.
cewl: a custom word list generator tool, that generates passwords based on the domain name and hacking and extracting the meta data information. It can also generate email lists, that can then be used in brute force attacks, for example if the user used their email address as a username.
Comments
Post a Comment