Security Testing with Kali Linux: Intro and Installation

I've always been intrigued by security testing. I was part of a security testing team at my last position, tinkering with a security testing guide written by The Open Web Application Security Project (OWASP) to review our web and mobile apps, so when I came across a security testing group, I had to attend! 

The organizer of the Boston Kali Linux Users Group suggested before the Beginners Kali Linux w/ Railsgoat  event participants should have a running virtual machine with Kali Linux installed on it. To help us, the organizer Apollo Clark created a tutorial for both Mac  and Windows. It's a good thing, too. I have tinkered with Red Hat Linux, but not for many years. 

What is Kali Linux?

According to the Kali.Org site: 

"Kali Linux is a Debian-based Linux distribution aimed at advanced Penetration Testing and Security Auditing. Kali contains several hundred tools aimed at various information security tasks, such as  Penetration Testing, Forensics and Reverse Engineering. Kali Linux is developed, funded and maintained by Offensive Security, a leading information security training company. 

"Kali Linux was released on the 13th March, 2013 as a complete, top-to-bottom rebuild of BackTrack Linux, adhering completely to Debian development standards". 

According to Wikipedia: 

"Kali Linux [...] is maintained and funded by Offensive Security Ltd. It was developed by Mati Aharoni and Devon Kearns of Offensive Security through the rewrite of BackTrack, their previous forensics Linux distribution. 

"Kali Linux is preinstalled with over 600 penetration-testing programs, including nmap (a port scanner), Wireshark (a packet analyzer), John the Ripper (a password cracker), Aircrack-ng (a software suite for penetration-testing wireless LANs), Burp suite and OWASP ZAP (both web application security scanners).[3][4] Kali Linux can run natively when installed on a computer's hard disk, can be booted from a live CD or live USB, or it can run within a virtual machine".

How did Kali Linux come about?

From Behind the app: The Story of Kali Linux:

"Where did the idea for Kali come from? Were you trying to solve a problem you'd experienced, or did the inspiration come from somewhere else?" 

Mati Aharoni: "The idea for a Live Linux distribution which contains a bunch of security tools was born out of necessity many years ago, when I faced a perplexing dilemma on a security engagement. I was not allowed to bring any hardware to the engagement—and what's more, I was only allowed to use onsite computers on the condition that I would not touch their hard disks or modify them in any way. (I actually was allowed to bring a laptop onsite, however it would be taken on exit).
"After thinking long and hard, I figured that these seemingly impossible work conditions could be met by adding a few tools to an existing bootable Live Linux CD (Knoppix 2.0, to those familiar with ancient history). Once created, I would be able to bring in the CD to the engagement, boot an onsite computer with the CD, and work directly out of RAM. At the end of the engagement, I would be able to destroy the CD without too much heart-ache. And so I started a Linux Security based Distribution, ten years ago!"

What is VirtualBox? 

According to Wikipedia:

"VirtualBox was initially offered by Innotek GmbH from Weinstadt, Germany under a proprietary software license, making one version of the product available at no cost for personal or evaluation use, subject to the VirtualBox Personal Use and Evaluation License (PUEL). In January 2007, based on counsel by LiSoG, Innotek GmbH released VirtualBox Open Source Edition (OSE) as free and open-source software, subject to the requirements of the GNU General Public License (GPL), version 2. 

"Innotek GmbH also contributed to the development of OS/2 and Linux support in virtualization[14] and OS/2 ports[15] of products from Connectix which were later acquired by Microsoft. Specifically, Innotek developed the “additions” code in both Microsoft Virtual PC and Microsoft Virtual Server, which enables various host-guest OS interactions like shared clipboards or dynamic viewport resizing. 

"Sun Microsystems acquired Innotek in February 2008. 

"Oracle Corporation acquired Sun in January 2010 and re-branded the product as 'Oracle VM VirtualBox' ".

Installation instructions for Kali Linux on a MacBook

Below is a brief overview of the Mac Installation video Apollo Clark posted on YouTube. I found the overview to be too fast-paced since I am more familiar with Windows and Macs than with Unix / Linux, so I have outlines a few of the steps. 

Step 1: 

• Download, Install, and Configure Oracle's VirtualBox and Extension Pack from http://virtualbox.org/wiki/Downloads according to the video. 

Step 2: 

• Make sure in the BIOS that you have enabled AMD

Step 3: 

• Download the Kali Linux 64 bit Torrent from http://www.kali.org/downloads/ . This is going to take a while. 

Step 4: 

• The tutorial doesn't mention that you need to then open up the Torrent file in a program such as UTorrent at http://www.utorrent.com/ ... when you download uTorrent, watch to make sure you aren't accidentally agreeing to change your Yahoo Search bar or install any extra toolbars you really don't want. 

Step 5:  

• Once you have uTorrent or another Torrent program, you will see the directory "kali-linux-1.1.0-amd64" that contains the file "kali-linux-1.1.0-amd64.iso" that will be booted up when the virtual machine starts up. By the way, PAE/NX stands for Physical Address Extension (PAE) and NX processor bit (NX).

Step 6: 

• Install Kali Linux on your new Debian virtual machine configuring the network, setting the root password and time zone, and partitioning the hard drive for the virtual machine. The GRUB Bootloader is the program that is based on the old GRand Unified Bootloader. 

Step 7: 

• Reboot the machine, choosing to boot up Kali GNU / Linux, with Linux 3.18.0-kali1-amd64 . After logging in as root, you install VirtualBox Guest additions for Kali Linux. 

Not familiar with Linux? Here's a brief description of the commands used in this section: 

sudo: Super "do": 

sudo allows a permitted user to execute a command as the superuser or another user, as specified in the sudoers file. The real and effective uid and gid are set to match those of the target user as specified in the passwd file (the group vector is also initialized when the target user is not root). By default, sudo requires that users authenticate themselves with a password (From Linux.About.com)

apt-get:

The Advanced Package Tool, or APT, is a free software user interface that works with core libraries to handle the installation and removal of software on the Debian GNU/Linux distribution and its variants.^[3] APT simplifies the process of managing software on Unix-like computer systems by automating the retrieval, configuration and installation of software packages, either from precompiled files or by compiling source code. (From Wikipedia)

nano:

nano is a text editor for Unix-like computing systems or operating environments using a command line interface. It emulates the Pico text editor, part of the Pine email client, and also provides additional functionality.^[1] In contrast to Pico, nano is licensed under the GNU General Public License (GPL) (From Wikipedia) 

... So, sudo nano /etc/apt/sources.list means to open as a super user, in the text-editor called nano, open Sources.List. 

Iceweasel: A rebranded version of Firefox:

Mozilla Foundation owns the trademark "Firefox"^[5] and claims the right to deny the use of the name and other trademarks to unofficial builds.^[6] The Debian Free Software Guidelines are used by the Debian project to determine whether a license is a free license, which in turn is used to determine whether something can be included in Debian. As the logo did not meet these requirements, it could not be used by software which was to be included in Debian. This effect of the Mozilla trademark policy led to a long debate within the Debian Project in 2004 and 2005. During this debate, the name "Iceweasel" was coined to refer to rebranded versions of Firefox. (Wikipedia)

Step 8: 

• Installing Kernel Headers: Uses the documentation at http://pantuts.com/2013/03/14/how-to-install-kernel-headers/

Step 9: 

• Get off Guest Additions CD the VBoxLinuxAdditions
• sudo chmod 775 VBoxLinuxAdditions.run

Step 10: 

• In VirtualBox, set up a shared clipboard and shared drag-and-drop. 

Step 11: 

• Set up a shared folder. 

Now, when you start up Kali Linux, you can go to Applications -> Kali Linux and see the Top Ten Security Tools, Information Gathering, Stress Testing, and others. 

Step 12: 

• Take a snapshot with VirtualBox of the system once it is freshly installed. 

-T.J. Maher
 Sr. QA Engineer, Fitbit
 Boston, MA

// Automated tester for [ 1 ] month and counting!

Please note: 'Adventures in Automation' is a personal blog about automated testing. It is not an official blog of Fitbit.com.