Kali Linux

All posts tagged Kali Linux

Good morning everybody. In Part 1 of this series, we saw how one of the most popular shells can be used to hack a website. However popularity has its own disadvantages, at the least in the field of cyber security. The C99 php shell is very well known among the antivirus. Any common antivirus will easily detect it as malware. Although it is unlikely that web servers will be installed with antivirus, still it is good to stay one step ahead. So today we will see some of the least popular but still effective web shells.

As you all know, Kali Linux is one of the best pentesting distros available. It would be very disappointing if it didn’t have web shells in its arsenal. Open a terminal and navigate to the directory “/usr/share/webshells” as shown below. As you can see, web shells are classified according to the language of the website we are trying to hack. Today we will see about PHP shells. So go into that directory and do an “ls”. You can see the shells below.


Now let us see their features by uploading each one them into web server we want to hack. See how to upload the shells.

  1. simple-backdoor.php

As the name clearly tells, the functioning of this shell is very simple. It is used to execute some commands on the target web server. Let us go to the shell’s link after uploading and execute the “net user” command as shown below. As already used in Part 1, this command gives us all the users present on the Window’s system.


Similarly let us execute another powerful command “systeminfo” to get the web server’s whole information as shown below. Sorry about the censor.




The php-backdoor, as the name implies  is file upload shell just used to add more backdoors. It helps us in the case where we can’t easily upload any additional files we want.


I works akin to file upload function in our Part 1. As you can see below, it has upload form and a function to execute commands. We can also connect to the database.




Every shell doesn’t require us to visit the web server. In fact we can make the webserver visit us. Enter the php-reverse-shell. As its name says, it makes a reverse connection to our attacker system. In order for this shell to make a reverse connection, it needs an IP address. So before uploading this shell we need to change the IP address in the script to our IP address ( Kali Linux ) as shown below. Save it and close it.


Next, let us start a netcat listener in one of the terminal. If you are new to netcat the command “nc -v -n -l -p 1234” tells netcat to listen verbosely on port 1234. Remember the port number should be same as we specified above.


Now when we upload the shell, On kali linux we will get a terminal as shown below. Hit “ls” to see the contents of the directory.



The qsd-php-backdoor is compatible with both Linux and Windows web servers. As we upload it, it will detect whether the web server is Windows or Linux and then acts accordingly. The screenshot is shown below. As you can see we can move to the root directory of web server and come back, execute shell commands and SQL queries.


You already know what happens when we execute “systeminfo” command as shown below.


That’s about web shells in Kali Linux. Hope it was helpful.

Good evening Friends. Today we will see how to install Veil Evasion in Kali Linux. Although this howto is made on Kali Linux Sana, it is same for all the versions of Kali. For the novices, Veil-Evasion is a tool to generate payload executables that bypass common antivirus solutions. First of all download and save the zip file of veil evasion as shown below from here.


Next, Open terminal and go to the directory where the zip has been downloaded. Commonly it is root or Downloads. Mine is in root. Next unzip the contents of the zip file by using command unzip “Veil-Evasion-master.zip” as shown below.


When unzipping is finished, type “ls” command once again. You will see a new directory “Veil-Evasion-master”. Change into that directory as shown below and type “ls” to see the contents of that directory.


There will be a dircetory named “setup”. Change into that directory. You will see a file named “setup.sh”. Execute that file using command  “./setup.shveil4

It will prompt you a question whether you want to continue with the installation or not. Type “y”.


The installation will start. It will ask you whether to install Wine. Click on “Install”.


Next it will install Python. Click on “Next”.


Click on “Next”.


If it asks you to overwrite existing files of any Python, select “yes”.


Click on “Next” for the below window.


Finsih the installation by clicking on “finish”.


Next, the system will ask you to install pywin32. Pywin32 is a set of extension modules that provides access to many of the Windows API functions. Click on “Next”.


Click on “Next”.


Click on “Next”.


Click on “Finish” the script.


Next it will install pycrypto. Click on “Next”.


Click On “Next”.


Select language as “English” and click on “OK”.


Next it prompt you to install Ruby. Accept the license and click on “Next”.


Click on Install.


Click on Finish to to finish the installation of Ruby.


You will see the below screen as the installation finishes.


Now let us see if our installation has been successful by starting the program. Go to the “Veil-Evasion-master” directory in which there is a python script called “Veil-Evasion.py”. Execute this script by typing command “./Veil-Evasion.py”.


This is how Veil-Evasion looks when started.







Hi everybody, the much awaited Kali Linux V2.0 Sana has been released. It can be downloaded from here. Another good news is there is a new version of Oracle VirtualBox named version 5.o available for download here. So let us see how to install Kali Linux V2.o Sana in Virtualbox 5.0.

Open VirtualBox and click on New virtual machine wizard. The below window will open. Give the name you like for the virtual machine. Assign type as “Linux” and version as “Debian(32-bit)”. Assign memory size of atleast 768MB and select the option “Create a virtual hard disk now”. Click on “Create”.


Choose the location where you want your virtual machine to be located. Keep the file size atleast 15GB. If you prefer to use your virtual machine in any other virtualization software like Vmware(VMDK) or others, choose appropriately else select VDI. Leave the storage to be “Dynamically allocated”. Click on “Create”.


Now go to Virtual machine settings, click on “system settings”, on the “processor” tab check the option “Enable PAE/NX” and click on “OK”.


Now power on the virtual machine and browse to  the iso file you downloaded from the website. Click on “Start”.


When the Boot menu appears, select “Install”.


Select the language you prefer for installation process using “space” bar and hit on “Enter” after selecting.


Select your appropriate location.


Select the keymap you prefer.


Enter the hostname for your system. I named it as Kali. Hit on “Continue”.


Assign a domain name if you want. You can leave it blank if you want. Click on “Continue”.


Assign the password for root account.


Confirm the root password.


Select the partitioning option you prefer. If you are a newbie, select the first option as shown below.


Select the disk to format. Obviously you will have only one disk to format.


Select the partitioning scheme you prefer. If you are a new user, select the first option as recommended.


A summary of your selections is listed. Proceed to finish partitioning and write changes to the disk as shown below.


Select “Yes” to write changes to disk.


Select a network mirror if you want otherwise select “no”.


If you get stuck on a blue screen for a bit long time as shown below, don’t panic. Just wait for the system to finish its job.


Next, install the Grub bootloader when prompted to install.


Select the hard disk on which to install GRUB bootloader. Since we have not partitioned our hard disk, that would be second choice as shown below.


The system will start installing. Once the installation is finished as shown below, click on “Continue” to restart the system.


Once system reboots, enter username. The default username is “root”. Click on “Next”.


Next, enter the password. That would be the password you configured above. Hope you have not forgotten it.


The new Kali Linux V2.0 Sana will look like below. Congrats, you have successfully installed Kali Linux in virtualbox.  Next, let’s install Virtualbox guest additions.


Go to Devices and click on “Insert Guest Additions CD image” as shown below.


You will see a CD image on the Desktop as shown below. The system will automatically prompt you to run the CD.


But when you click on “Run”, you will get the error as shown below.


Now open a teminal. Type command “cd /media“. Next type “ls“. type “cd cdrom” and type “ls” once again as shown below.  The guest addition CD is mounted at the location cdrom and we just navigated to that location. Copy the highlighted file as shown below to the root directory by using command “cp VBoxLinuxAdditions.run /root”.


Now navigate to the root directory by typing command “cd /root” and type ls to see if the file has been successfully copied to the directory. Now change the permissions of the file by using command “chmod 755 VBoxLinuxAdditions.run” . Now let us execute the file by typing “./VBoxLinuxAdditions.run


The file will start executing as shown below. Once it finishes execution, restart the system.


If everything goes well, guest additions will be installed successfully.


If you face any  problem, please leave comments below.

Here’s a video  version  how to install Kali Linux V2.0 Sana in virtualbox.

Hi Everybody, today we are going to see how to make live USB of Kali Linux. Live USB installation has many advantages like system administation, forensics and testing of the OS before making a hard drive installation. However what prompted me to make kali live USB  was wifi hacking. My laptop has a compatible adapter for wifi hacking but Kali Linux in Vmware Workstation recognizes your host’s wifi adapter as a ethernet adapter. So I thought I could postpone buying a usb wifi adapter for some time by making a live usb installation of kali linux.

Whatever, let’s get to how to make Kali Live USB. First we need to download software called win32diskimager from here,  Install the software and launch it. It will look like below.



Plug a USB drive into your laptop. Make sure it is atleast 4 GB.  In the “device” tab, select your USB drive. In the “image file” tab, browse to the iso image of Kali Linux as shown below.



Click on “Write”. That’s it you have successfully made a live USB of Kali linux. Hope that was helpful.


Kali Linux is the most advanced penetration testing distribution with a number of tools. While using these tools a measure of anonymity is required. Today we are going to see how to spoof your IP address in Kali Linux. First, check your IP address by visiting any website which shows your IP address ( http://www.whatismyip.com ). Then go to the site www.vpnbook.com.

Download the Euro1 Server OpenVPN certificate bundle as shown below. Note down the username and password given. We will need it in later steps.



When you click on the download link, the following window opens. Since it is a zip package, system will prompt whether to open it with unzip ( the default option ). Click on “OK”.



Open the terminal and navigate to the directory where the cocntents of the zip archive have been unzipped. Type the command “ls” to see the unzipped files. We are going to use the vpnbook-euro1-udp53.ovpn package.



OpenVPN has been installed by default in the Kali Linux distribution. Type the command “openvpn vpnbook-euro1-udp53.ovpn” to start the process.



The installation starts.  Enter the username and password we noted above when prompted.



After a short time, the process is completed. Check your IP address again. If everything goes well, your IP address will be changed.

Good evening everybody. Sometime back, I wrote an article on how to set up a virtual penetration testing lab using Vmware Workstation. But Vmware Workstation is a commercial product.

Today I am going to show you how to create a pentest lab in VirtualBox absolutely free of cost. I hope this tutorial will be helpful for many beginners into cyber security domain.

What do we need?

1. Oracle VirtualBox. (Download)

2. Kali Linux. (Download)

3. Metasploitable 2. (Download)

Oracle VirtualBox is the virtualization software we will be using to create our lab. We will be using Kali Linux as the attacker machine and Metasploitable 2 as the victim machine. Install Kali Linux and Metasploitable 2 in VirtualBox.

See how to install Kali Linux in VirtualBox.

See how to install Metasploitable in VirtualBox.



Select Kali Linux, Go to settings > network. Enable “network adapter 1″. Set the “Attached to” option to “internal network”. Set the name of the network adapter to “intnet”. Click on “OK” to save the settings.



Do the same for Metasploitable virtual machine.



Power on the metasploitable VM. Log into the system. Default username and password are “msfadmin”.



Type the command “ifconfig” to see the IP addresses of interfaces.



The ‘lo’ interface is the loopback. Now we are going to set the IP address on the interface “eth0”. Type the command “sudo ifconfig eth0 netmask up”. The sudo password is “msfadmin. Verify that the IP address is set by typing command “ifconfig”.



Power on Kali Linux. In the terminal, type command “ifconfig eth0 netmask up”. Verify if the IP address is set by typing command “ifconfig”.



Test whether this system can communicate with victim system by pinging the victim machine as shown below.



The connection is successful. Our penetration testing lab is ready. Happy practising.

NOTE : Kali Linux version 2017.1 has been released and I decided to update this howto. Ofcourse,  this guide also works with previous releases of Kali Linux. 

Hi Friends. as you already know, the latest version of Kali, Kali rolling edition 2017.1 has been released. The rolling edition of Kali Linux gives users the best of all worlds – the stability of Debian, together with the latest versions of the many outstanding penetration testing tools created and shared by the information security community. The best feature I like in this version is constantly updated tools. Now let us see how to install this latest version of Kali linux in virtualbox and I assure you, this will be the easiest guide.

For this howto, I am using the latest version of Oracle Virtualbox, i.e version 5.1.22. Ever since Sana has been released, the makers of Kali Linux have also released Pre-built virtual images for virtualbox and Vmware. We will use that virtualbox image in this howto. Go here and download the Pre-built virtualbox image. They are as shown below (Download the latest version).


This howto is using the Kali Linux 32bit VBox PAE . Your downloaded contents should look like below. As you can see, we have an ova file.


Now open Virtualbox and click on File>Import Appliance as shown below.


A window like below will open.


Now browse to the location of the ova file we just downloaded as shown below and  click on Next.


The system will present you a summary of settings used for  thsi VM. If you want to make any changes, change and click on Import.

The importing process will start as shown below. It will take some time, but it will be worth the wait.


After import is completed, a new virtual machine is automatically created as shown below.


Power on the machine. As the virtual machine powers up, it will prompt for username and password. The default username is “root” and password is “toor”.

Given below is our Kali Linux rolling 2017.1 successfully installed in Virtualbox. No need of installing guest additions. If you face any problems during installation, please comment. I will be happy to help you.





Nessus is a vulnerability scanner. My first disappointment  with Kali is that it excluded nessus from its vulnerability scanning tools. However it can be installed. Let us see how to install Nessus in Kali Linux. This guide works for all versions of Kali Linux. First download the nessus debian package from the website ( here ). Go to the directory into which the package has been downloaded. It should normally be in the Downloads directory in root directory.  Open a terminal, navigate to the “Downloads” folder and type “ls“. You can see the debian package of Nessus. Then type the command “dpkg -i  package name” as shown below.


Then type command “service nessusd start” to start the service.


Open a browser and type “https://kali:8834/” to see the web interface of nessus. You will see the below warning that the connection is untrusted.  Click on “I understand the risks” option.



You will get a popup to confirm the security exception. Click on that option.


Then you will get a welcome screen of nessus as shown below. Click on “Continue”.


Its time to create our initial account. Type the username and password you want to set up for the account. Click on Continue.


Its time to enter the activation code for Nessus. You can get the activation code from here. After entering activation code, click on Continue.


After activation is completed, it will download the nessus packages required. It may take a bit long time.


Then we need to wait some more time while the program initializes.


After the initialization is over, you will see the Nessus scan page as below.


Congrats, you have successfully installed Nessus in Kali Linux.


If you tried to start armitage on Kali Linux, it will show you the following error.



The error says that the service cannot connect to the database. Now let’s see how to configure armitage on Kali Linux. First, lets check if armitage is installed on our machine or not. Open terminal and type the command “apt-cache search armitage”Then type the command “apt-get install armitage”. If everything is right, it tells you that armitage is already installed.



Now let’s rectify the database connection problem. Type the command “service postgresql start”. This will start our database service. Then start metasploit service by typing the command “service metasploit start”


Then type the command “armitage”. You should successfully see armitage working.




Virtual penetration testing lab is a lab created on a single system using any virtualization software. It can be very helpful for people practising for CEH or similar certification. Any penetration testing lab has two machines, attacker and victim. In this lab we will set up Kali Linux as the attacker and Windows XP( most favourite victim machine ) as the victim. I am going to set up this lab in Vmware Workstation 9. Hope this will be helpful.

First of all install Kali Linux and Windows XP in Vmware Workstation.




Shut them down. In the Vmware Workstation menu, Select Edit” and click on Virtual Network editor.


The window below will open showing the virtual network adapters. Click on “Add network”.


Vmware provides nine virtual networks from 0 to 9. Vmnet0, Vmnet1 and Vmnet8 are automatically assigned for  bridged, Host-only and NAT types of network respectively. Select the network “Vmnet3″.


We can see that our network is added as Host-Type with a automatically assigned subnet IP.



Click on our network. We can see its settings below.



Deselect the option ‘Connect a host virtual adapter to the network‘.This will make our network a custom type. Change the subnet IP to choice is yours).  Select the ‘Use local DHCP service to distribute IP address to VMs‘ option. This will automatically assign IP addresses to our machines. Click on ‘DHCP settings‘.


You will see the below window. Make changes if you like. I am going to leave it default. Click OK twice to exit.



We have successfully created our custom network. Now let’s add our machines to the network. Open the tab of Kali Linux and click on ‘network adapter‘ setting.


In the settings, select the ‘custom radio button and select the network Vmnet3 from the dropdown menu. Click on OK.


Do the same for Windows XP. Then let’s boot up our victim machine and check it’s IP address by typing ‘ipconfig‘ in the command line.The DHCP server has automatically assigned it the IP address



Boot the attacker machine and check it’s ip address by typing ‘ifconfig’ in the terminal. It has been assigned the address


Ping the victim IP machine ( to see whether the two machines can communicate.



We have successfully created a virtual penetration testing lab. Happy testing.