5

I'm trying to enter the world of pentesting, and I've gone through quite a few tutorials in the past few days, and noticed that there's nearly no information regarding exploiting virtual machines while using Kali as the VM host.

Is there no data/research available because no one's tried it, or... There are some limitations, due to which, there is no data?

Improve this question
7
  • 1
    So ifi understand correctly your machine host is running kali? and you have some virtual machines running on it? what guest OS's are you running as virtual machines and have you looked at nmap and metasploit scanning tools?
    – octo-carrot
    Jul 13, 2016 at 15:18
  • Yes, the host runs Kali. I'm currently looking to find exploits in Windows XP, using metasploit. However, tutorials that I follow always run Kali as a virtual machine.
    – Athena
    Jul 13, 2016 at 15:20
  • That doesnt matter, you should still be able to follow the tutorials just fine. have you looked over the tools that kali comes with? tools.kali.org/tools-listing
    – octo-carrot
    Jul 13, 2016 at 15:23
  • I will admit, the link you've referred me to, I haven't seen before. I shall take my time to go through it all. However, I get errors when I try to follow the tutorials. And I assumed that it must be due to running a Kali host. I shall try once again.
    – Athena
    Jul 13, 2016 at 15:27
  • However, my question was more on the lines of... Why there isn't much material, where the host machine is Kali.
    – Athena
    Jul 13, 2016 at 15:28

2 Answers 2

Reset to default
11

In typical pentesting, Kali is just another tool, it's insecure by default, and is never recommended to be run as your primary OS without some serious baseline hardening. It's typically launched (as a virtual machine) when needed and "paused" or "stopped" when not. This helps keep your host (and files) protected.

Additionally, Kali is known to have bugs and occasionally with pentesting tools, you can bork your system. Virtual Machines allow you to take snapshots that you can revert back to in the event that you hose something.

Some people even revert after every client just to ensure that no data can leak from one organization to another because of the tester.

Improve this answer
2
  • Snapshots and reverting especially - Many a time I've installed things / updated in Kali & Backtrack to try new tools or get something to work and it's nerfed another application.
    – DKNUCKLES
    Jul 14, 2016 at 13:33
  • This is your answer, OP.
    – user53693
    Jul 14, 2016 at 13:51
7

As a developer of Kali, I can attest that this answer is very wrong. Kali is not insecure by default, and has the same security standards as Debian in a default installation. Kali is a Linux distribution aimed at Penetration Testing - as opposed to casual browsing or day-to-day computer activities - which is why some people prefer running it as a virtual image. People who use Kali on a daily basis, such as professional penetration testers will often run Kali on real hardware, such as laptops or NUC computers.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .