10 Things to Do After Installing Kali Linux

Summary

The video demonstrates Kali Linux workflows for network discovery, SMB/FTP access, password guessing and cracking, phishing-style credential capture, web scanning, OSINT, remote shells, and SQL injection testing. The presenter says exercises use systems he owns.

Key points

The presenter says the exercises use systems he owns, though he also describes scanning devices on public Wi-Fi networks.
Nmap is used to find network devices and services, enumerate SMB shares, and access a share.
Hydra tests common username and password lists against an SMB service; the demonstration then uses discovered credentials to access a protected share.
The Social Engineering Toolkit creates a fake Google login page, and credentials entered into it appear in the terminal.
An automated ZAP Proxy scan reports issues including absent anti-CSRF tokens, CSP-related alerts, private IP disclosure, and reflected XSS.
Metasploit checks for anonymous FTP access; a separate Netcat demonstration shows a callback and remote command execution through a service described as vulnerable to command injection.
SpiderFoot is used for OSINT, hashcat for password-hash cracking, and searchsploit with SQLmap to test SQL injection and retrieve database contents.

Article Details

Topics: [00:30] Nmap network scanning and SMB share access
[08:09] Hydra password guessing against a shared folder
[09:43] Credential harvesting with the Social Engineering Toolkit
[11:58] Automated web application scanning with ZAP Proxy
[14:02] Metasploit checks for anonymous FTP access
[16:10] OSINT collection with SpiderFoot
[20:01] Password-hash cracking with hashcat
[22:15] Exploit research and SQL injection testing with searchsploit and SQLmap

MITRE ATT&CK

T1046 · Network Service DiscoveryThe video demonstrates using Nmap to discover live network devices and identify their services.T1056.003 · Web Portal CaptureThe Social Engineering Toolkit is used to create a fake login page that captures entered credentials.T1110.001 · Password GuessingHydra is used with username and password lists to guess credentials for an SMB service.T1110.002 · Password Crackinghashcat is used to crack password hashes with commonly used passwords.T1135 · Network Share DiscoveryThe video demonstrates enumerating SMB shares to identify accessible network folders.T1595.002 · Vulnerability ScanningZAP Proxy is used to scan a web application for vulnerabilities.

Products

Kali Linux[05:01] just enter your password to Kali Linux.

Tools

hashcat[20:48] called hashcat that can allow us to Hydra[08:29] Hydra that can help us do just that. So Metasploit Framework[14:02] This is Metasploit. It is an netcat[18:33] So, this is going to be on Netcat, which Nmap[00:31] going to be Nmap. Nmap is a network Searchsploit[22:15] searchsploit comes into play. So, this Social Engineering Toolkit[09:44] tool called Social Engineering Toolkit.SpiderFoot[16:19] like SpiderFoot, and you can [snorts]sqlmap[23:45] combine it with SQLmap, which is an ZAP Proxy[12:05] option which is zap proxy. Hit enter on