New to using Kali, but I do a lot of security work in other distros on the “good” side. So SEIM and Network is all good. But Kali has so many tools it would be good to know how this malicious stuff works and is made.
Can anyone give me some simple and not patronizing gitgud tips on where to start. Like I’ve used Hydra since people try (and fail) to use that one a lot. But I know on here people use the in built software to use the exploit database etc and free viruses are sent round. How do people do that (on a basic level) for example.
An experienced hand would be welcomed for some questions and answers please.
Thanks
exploit database is designed for you to find exploits that you can use for your pentest work.
lets say I scan a network, find a server running, and what is running on it, could be a webserver, an email server, a database etc.
next, I would have a look at exploit database to see if that particular version of software, or service has any known exploits, say an outdated apache server version for example, and it would help me craft an exploit to attack it with.
The end goal of any pen test is to compromise the system, ideally giving me full control over it (root) and then report my findings to the the company that employed me to test said system, with a written report and advice on how to harden the system so the bad actors can’t do what I’ve just done.
and of course, be paid for my time in finding this out.
There are plenty of bug bounty programs like synack, bugcrowd, and hackerone for example (there are more) that you can register for, some you need some certs, and they act as the middle man, with companies registering with them for testers on their platform, and they will tell you what is in scope and what is not.
If you just want to learn, try hack the box, good challenges, with tutorials as well, and again, if you get good enough, links to recruiters in the field!