Custom Kali Linux Environment in Docker

This project sets up a Kali Linux environment using Docker and Docker Compose. The resulting Docker image comes with a comprehensive selection of pre-installed pentesting tools, ideal for security testing and learning.

Project Contents

• Dockerfile: Defines the steps to build a custom Kali Linux image from the official kalilinux/kali-rolling image. During the build, it updates packages and installs various Kali metapackages and the hping3 tool.
• docker-compose.yml: A configuration file for Docker Compose that simplifies image building and container lifecycle management.

Prerequisites

• Docker Engine installed (Docker Instructions)
• Docker Compose V2 (usually included with Docker Desktop, or as a docker compose plugin)

Pre-installed Tools

The built Docker image will include the following tools and toolsets, thanks to the installation of the following metapackages and individual packages:

1. kali-linux-headless: Provides a base set of Kali Linux command-line tools, essential for operations without a graphical interface.
2. kali-tools-top10: Installs a curated collection of the 10 most popular and frequently used security tools in the Kali community.
3. kali-linux-default: Contains the standard set of tools found in a default Kali Linux installation, offering a wide range of utilities for various pentesting tasks.
4. kali-linux-large: Is one of the most complete metapackages, installing a vast selection of tools covering almost every category of security testing, from reconnaissance to post-exploitation.
5. hping3: A command-line tool oriented toward TCP/IP packet assembly and analysis. It is extremely useful for firewall testing, advanced port scanning, network testing, and can be used to simulate certain types of traffic for DoS testing.

Overview of Available Tools

Thanks to the installation of the aforementioned metapackages (especially kali-linux-large), you will have access to a wide range of tools covering various phases of a penetration test. Some of the categories and notable tool examples include:

• Information Gathering:

  • Nmap: Network scanning, host discovery, port and service detection, operating system identification.
  • dnsenum, sublist3r: DNS information and subdomain enumeration.
  • Recon-ng: A complete framework for web reconnaissance.
  • Wireshark (tshark in CLI): Powerful network protocol analyzer for inspecting traffic.

• Vulnerability Analysis:

  • Nikto: Vulnerability scanner for web servers.
  • Legion: Extensible and semi-automated framework for network scanning.
  • Tools for interacting with vulnerability databases.

• Web Application Analysis:

  • Burp Suite (Community Edition): Integrated suite for web application security testing (proxy, scanner, etc.).
  • OWASP ZAP (Zed Attack Proxy): Open-source web application security scanner.
  • sqlmap: Automated tool for SQL injection detection and exploitation.
  • gobuster, dirb: Tools for discovering content and directories on web servers.

• Password Attacks:

  • John the Ripper: Powerful password cracking program.
  • Hydra: Tool for performing brute-force attacks against network login services.
  • Hashcat: Advanced tool for hash cracking, with GPU support.

• Wireless Attacks:

  • Aircrack-ng suite: Complete suite for auditing Wi-Fi networks (packet capture, WEP/WPA/WPA2-PSK cracking, deauthentication attacks, etc.).

• Exploitation Tools:

  • Metasploit Framework: Extensive platform for developing, testing, and executing exploits.
  • SearchSploit: Command-line tool for searching the Exploit-DB exploit database.

• Sniffing and Spoofing:

  • Wireshark/tshark: Network traffic capture and analysis.
  • Ettercap: Suite for Man-in-the-Middle (MitM) attacks.
  • Responder: Tool for LLMNR, NBT-NS, and mDNS poisoning.

• Post-Exploitation:

  • Various utilities and frameworks for maintaining access, escalating privileges, and moving laterally in a compromised network.

• Forensics Tools:

  • Although full forensic analysis often requires specialized tools and a dedicated environment, kali-linux-large includes utilities that can be useful for file system analysis, data recovery, and investigation (e.g., Autopsy (CLI), sleuthkit, foremost).

• Reverse Engineering:

  • Tools like radare2, GDB (GNU Debugger).

• Reporting Tools:

  • Utilities to help document and present the findings of a penetration test.

• hping3:

  • For custom packet creation and analysis, firewall testing, and network traffic simulation.

This list is not exhaustive, as the metapackages install hundreds of tools. The best way to explore is to browse the application menu if you had a graphical environment, or use the command line to search (apt list --installed | grep <keyword>) and learn about each one.

Important: Due to the number of metapackages (especially kali-linux-large), the initial image build may take a considerable amount of time (several minutes, depending on your internet connection and hardware) and the resulting image will occupy significant disk space.

How to Run the Container

1. Clone or download the files: Make sure you have the Dockerfile and docker-compose.yml files in the same directory on your local machine.

2. Build the image and start the container: Open a terminal or command line, navigate to the directory where you saved the files, and run:

   docker compose up -d --build
   

   • docker compose up: This command builds (if necessary), creates, and starts the services defined in your docker-compose.yml.
   • -d: Runs the containers in "detached" mode (in the background).
   • --build: Forces the image to be rebuilt from the Dockerfile before starting the service. It is useful if you have made changes to the Dockerfile.

3. Verify that the container is running: You can list the running containers with:

   docker ps
   

   You should see a container named kali_custom_environment (or the name you have configured).

How to Access the Container (Interactive Shell)

Once the container is running, you can access an interactive bash session inside it to start using the tools. There are two main ways to do this:

1. Using the Docker Compose service name: If you are in the same directory as your docker-compose.yml, you can run:

   docker compose exec kali-custom /bin/bash
   

   (Where kali-custom is the service name defined in the docker-compose.yml).

2. Using the container name: If you know the container name (in this case, kali_custom_environment according to the provided docker-compose.yml), you can use the standard Docker command:

   docker exec -it kali_custom_environment /bin/bash
   

   • -i: Interactive mode (keeps STDIN open).
   • -t: Allocates a pseudo-TTY.

Once any of these commands are executed, you will be inside the Kali Linux container shell and can start using the installed tools.

Stopping the Container

To stop and remove the containers, networks, and volumes created by docker compose up, you can run from the same directory:

docker compose down

If you only want to stop the services without removing them:

docker compose stop

Ethical Use Reminder

The tools included in this Kali Linux environment are powerful and intended to be used for educational purposes and authorized security testing. Always ensure you have explicit, written permission before performing tests on any system or network that you do not own. Unauthorized use is illegal and unethical.