kali.org

Penetration testing is an authorized, simulated attack on a system, network, or application to find and validate exploitable weaknesses before a real attacker does. It requires written permission and a defined scope. Kali Linux supports this work as a preconfigured, Debian-based platform that bundles the tools and metapackages a tester needs, so you spend time testing rather than assembling and configuring a toolkit from scratch.

Penetration Testing vs. Related Security Tasks

Kali Linux is geared toward several information security tasks, and it helps to separate them before you pick a starting point.

Scanning produces candidates; penetration testing confirms which candidates are actually exploitable. That distinction matters when you report results, because an unverified scanner alert is not the same as a demonstrated compromise.

The Typical Phases of a Penetration Test

Most engagements follow a recognizable arc, though the boundaries blur in practice.

1. Reconnaissance — gather information about the target: hosts, services, people, exposed assets.
2. Scanning and enumeration — identify live systems, open ports, service versions, and potential entry points.
3. Exploitation — attempt to turn a candidate weakness into actual access.
4. Post-exploitation — determine what that access reaches, and whether it can be extended.
5. Reporting — document what was found, how it was validated, its impact, and how to fix it.

Reporting is not an afterthought. A test that finds a serious issue but cannot explain it to the people who must fix it has limited value.

Why a Preconfigured Distribution Matters

You can take any Linux and install pentesting tools on it, but you have to set the tools up manually and configure them. Kali is optimized to reduce that work, so a professional can sit down and go.

That optimization shows up in a few concrete ways:

• Tools are already present and configured. Kali's penetration testing platform contains a vast array of tools and utilities covering the workflow from information gathering to final reporting.
• Metapackages group tools by task. Instead of installing individual programs, you install a metapackage aimed at a specific job, which keeps an installation matched to what you actually do.
• It runs in many environments. Versions exist for mobile devices, containers, ARM, cloud providers, Windows Subsystem for Linux, pre-built virtual machines, and installer images, so you can bring the same environment to wherever the work happens.
• Customization is documented. A well-documented ISO customization process lets you generate a version tuned to your needs.

Kali describes itself as a platform rather than a collection of tools, and that framing is useful: the value is the integrated, maintained environment, not any single program.

What Tools Come With It

Kali's toolset spans the phases above. Named examples from the project include:

• Nmap — network discovery and port scanning
• Metasploit Framework — exploitation and post-exploitation
• Burp Suite — web application testing
• Hydra — credential testing
• John the Ripper — password cracking
• Aircrack-ng — wireless network assessment
• Maltego — information gathering and relationship mapping
• Responder — network name resolution and credential capture on local networks

Treat this as a starting map, not a complete inventory. The right subset depends entirely on what you are authorized to test.

Authorization Comes First

Testing a system you do not own or have written permission to test is not penetration testing — it is an attack, and it may be illegal. Before any technical work:

• Get written authorization from someone who can grant it.
• Define the scope: which hosts, networks, applications, and time windows are in bounds.
• Agree on rules of engagement, including what happens if you find something critical or cause disruption.
• Keep evidence handling and confidentiality expectations clear from the start.

If any of those are missing, stop and resolve them before running a tool.

Getting Started

If you want to learn the workflow, the practical path is:

1. Read Kali's documentation, which covers setup and includes tips and "recipes" for common situations.
2. Choose an edition that fits your environment — virtual machine, WSL, container, cloud, ARM, or mobile.
3. Install the metapackages matching the tasks you are learning.
4. Practice only on systems you own or are explicitly authorized to test, such as a lab you control.
5. Use the community resources — forums, Discord, the bug tracker, and tool listings — when you get stuck.

Kali's documentation is open, so it doubles as a reference and a place to contribute. For anyone deciding whether to start here: if your goal is authorized security assessment and you want a maintained, preconfigured environment rather than a hand-built toolkit, Kali is built for exactly that.

Cybersecurity is the practice of keeping your data, accounts, and services from being accessed, stolen, altered, or knocked offline by someone who shouldn't have them. For a personal site or small online presence, that reduces to a short list of concrete jobs: protect your login credentials, keep your software current, serve traffic over HTTPS, and lock down the domain and DNS layer that everything else depends on. You don't need an enterprise security team to cover the basics — but you do need to treat your registrar account and your hosting account as the two most valuable things you own, because whoever controls those controls the site.

What cybersecurity actually protects

It helps to separate the assets from the threats, because most small-site incidents come from a handful of causes.

The pattern: each asset has one or two controls that remove most of the risk. You don't need all of them on day one, but skipping the account and domain layers is the mistake that's hardest to undo.

The threat categories a small site actually faces

• Credential theft — reused or weak passwords, or credentials leaked from another breached service. This is the most common way small sites fall.
• Phishing — fake login pages or "your domain is expiring" emails designed to capture your registrar or hosting password.
• Malware and backdoors — usually arriving through an outdated CMS, plugin, or theme.
• DDoS — flooding a site until it's unreachable; often handled by your host or a CDN rather than by you.
• Misconfiguration — an open admin panel, directory listing, or default credentials left in place.

Notice that four of the five are about access, not exotic exploits. That's why the basics work.

Core protections to apply first

Use strong, unique passwords and a password manager

Every account tied to your site — registrar, host, CMS, email — should have a different password. A password manager makes this practical. The goal is that one leaked password can't be replayed anywhere else.

Turn on multi-factor authentication

MFA is the single highest-value control for your registrar and hosting accounts. Even if a password is stolen, an attacker without the second factor can't log in. Prefer an authenticator app or hardware key over SMS where the service supports it.

Serve everything over HTTPS

An HTTPS/TLS certificate encrypts traffic between visitors and your site and prevents browser "not secure" warnings. Most hosts and registrars offer a free certificate; the important part is that it's installed and that HTTP redirects to HTTPS.

Update promptly and keep the surface small

Apply CMS, plugin, and theme updates as they're released, and delete anything you're not using. Fewer components means fewer places for a known vulnerability to sit unpatched.

Apply least privilege

Give each person (and each integration) only the access they need. Don't run your site day-to-day from an administrator account, and don't hand out admin rights for tasks that don't require them.

Secure the domain and DNS layer

This layer is easy to overlook and expensive to lose, because a hijacked domain can point anywhere.

• Protect the registrar account with a unique password and MFA. Your registrar account is the root of control over the domain.
• Enable the registrar lock (often called a transfer lock or clientTransferProhibited) so the domain can't be moved without your action.
• Keep registrant contact email secure — that inbox is often the recovery path for the domain.
• Enable DNSSEC where your registrar and DNS provider support it, so responses can be cryptographically validated and spoofing is harder.
• Watch for unauthorized DNS changes — if records you didn't touch appear, treat it as a compromise.

Porkbun is an ICANN-accredited domain registrar, which means it operates under ICANN's registrar rules — relevant here because those rules govern transfers, locks, and registrant contact requirements. Its site lists Stripe among its payment platforms. Beyond that, check your specific registrar's and DNS provider's current feature set for lock and DNSSEC support, since availability varies.

Warning signs and first steps if something looks wrong

Watch for: unexpected DNS records, visitors reporting malware warnings, unexplained admin accounts, a sudden traffic drop, or emails about transfers you didn't request.

If you suspect a compromise:

1. Change passwords on registrar, hosting, and CMS accounts, starting with the registrar.
2. Revoke active sessions and reset MFA where possible.
3. Check DNS records against what you expect and revert unauthorized changes.
4. Restore from a known-good backup if files were altered.
5. Re-scan and update the software before reopening the site.

Containment first, then recovery — don't try to clean a live, still-compromised site.

What to outsource vs. manage yourself

Hosting-level security, CDN, and WAF are usually worth outsourcing because they require scale and constant attention. Account hygiene, MFA, updates, and domain/DNS protection are things you should keep in your own hands regardless of size — they're cheap to do and costly to skip.

Arx Libertatis is an improved, cross-platform, open-source engine for Arx Fatalis, the 2002 first-person RPG/dungeon crawler/immersive sim from Arkane Studios. To play on Linux, you install Arx Libertatis (official Linux builds are provided), then point it at a copy of the original Arx Fatalis game data — the engine itself does not include the game. You need to own or otherwise obtain Arx Fatalis or its demo before you can play.

What Arx Libertatis actually is

Arx Libertatis is a port and modernization of the Arx Fatalis engine, based on the publicly released Arx Fatalis source code and available under the GPL 3+ license. Version 1.2.1 supports modern systems, brings the game to new platforms, and removes bugs and limitations of the original release.

Two things follow from that:

• The engine is free and open source. You can download, inspect, and redistribute the code under the GPL.
• The game data is not included. The license covers the engine only. The art, audio, levels, and other assets remain part of the commercial game, so you must supply them yourself.

The game itself features crafting, melee and ranged combat, and a distinctive spellcasting system where you draw runes in real time to cast the spell you want.

What you need before installing

The original game is sold through storefronts such as GOG.com, the Microsoft Store, and the Bethesda Store, and it also has a demo. Any of these gives you the data files the engine needs.

Installing Arx Libertatis on Linux

Arx Libertatis provides official builds for Windows and Linux. Beyond those, it has been packaged for macOS (Homebrew), FreeBSD, DragonFly BSD, NetBSD, OpenBSD, Haiku, and Pandora, and will likely compile and work on other operating systems.

On Linux, you have two practical routes:

Option 1: Use a distribution package

Check whether your distribution ships Arx Libertatis in its repositories. If it does, install it through your normal package manager. This is the least manual path and keeps updates tied to your system.

Option 2: Use the official Linux build

Download the Linux build from the project's download page and unpack it. This works regardless of whether your distribution packages the engine, and it lets you run a specific version such as 1.2.1.

If neither fits, the source is available on GitHub, so you can build it yourself — the project notes it will likely compile on other systems too.

Pointing the engine at your game data

The engine needs to find the Arx Fatalis data files. The general flow is:

1. Install or unpack Arx Libertatis using one of the routes above.
2. Locate your Arx Fatalis data. If you bought the game from a storefront, the installer places the data files somewhere on disk; if you have the demo, it comes as its own set of files.
3. Tell Arx Libertatis where that data is when you first launch it, or place the data where the engine expects it.
4. Launch the game and confirm it reaches the main menu.

The expected result at each step is simple: the engine starts, finds the data, and loads the game rather than exiting with a "data not found" style error.

If the game does not run

Check these in order:

• Data path is wrong. The most common failure is the engine not finding the Arx Fatalis data. Re-check the path you gave it.
• You installed the engine but not the game. Arx Libertatis alone cannot run — it has no assets of its own.
• Graphics/driver problems. Since the engine targets modern systems, most rendering issues trace back to drivers or to running an old build. Try the current release (1.2.1).
• Wrong build for your system. Make sure you grabbed the Linux build, not the Windows one, if you installed manually.

Where to go next

The project plans to keep improving and modernizing the engine and to enable community customizations and mods. If you want to follow development or get help, the project links to its GitHub repository, Mod DB page, and community forums such as the TTLG Forum and the GOG.com forum. There are also community projects built around the game, including the Arx Insanity Mod and other Arx mods.

Penetration testing is an authorized, simulated attack on a system, network, or application to find exploitable weaknesses before a real attacker does. It differs from automated vulnerability scanning in that a tester chains findings together, attempts exploitation, and reports business impact — not just a list of alerts. It applies when you have written authorization, a defined scope, and a reason to test (compliance, a new release, or a post-incident check). Without those three, the same activity is not a penetration test.

Penetration Testing vs. Related Assessments

These terms get used interchangeably, but they answer different questions:

Scanning is largely automated and broad; penetration testing is human-driven and deep. Red teaming is broader still and usually tests detection and response rather than individual vulnerabilities. A penetration test often starts with scanning and crawling, then diverges into manual exploitation.

The Typical Phases

1. Reconnaissance — gather information about the target: domains, subdomains, endpoints, technologies, exposed files.
2. Scanning and enumeration — identify live services, versions, and potential entry points.
3. Exploitation — attempt to leverage a weakness to gain access or prove impact.
4. Post-exploitation — determine what the foothold grants: lateral movement, data access, privilege escalation.
5. Reporting — document findings, reproduction steps, severity, and fixes.

Reconnaissance is where web crawlers earn their place. Before you can test an endpoint, you have to know it exists.

How Web Crawlers Support Reconnaissance

A crawler maps the attack surface by following links, submitting forms, and recording every response. For a penetration tester, the value is coverage: hidden endpoints, orphaned pages, and client-side code that manual browsing would miss.

SpiderSuite, a web crawler built for security professionals, illustrates this. Its Source View shows the complete HTTP response for each discovered resource — HTML, JSON, JavaScript, XML, and binary content — which helps testers find hidden endpoints and review client-side code during reconnaissance and content auditing. Its Graph View visualizes how pages, directories, endpoints, assets, and external resources connect, making critical paths, orphaned content, and hidden functionality easier to spot in large crawl results.

Crawl data also needs to move between tools. SpiderSuite supports importing HTTP archives (HAR), web archives (WARC), crawler exports, proxy captures, and its own project exports, and exporting to HAR, WARC, XML sitemaps, HTML reports, CSV, JSON, JSONL, filesystem mirroring, and AI-ready datasets. That matters in practice: reconnaissance output from one tool becomes input for exploitation or reporting in another, without repeating collection.

A Concrete Reconnaissance Task

Say you're scoping a web application with a large, partly undocumented surface. A practical sequence:

• Seed the crawler with the in-scope base URL and any known entry points.
• Let it follow links and record responses across content types.
• Review the graph for clusters, orphaned nodes, and unexpected external connections.
• Inspect source responses for endpoints referenced in JavaScript but not linked in the UI.
• Export the results (e.g., HAR or CSV) for the exploitation and reporting phases.

The expected result is a mapped inventory of reachable content — not a vulnerability list. Exploitation still requires manual work.

Constraints You Must Respect

• Authorization — written permission from the system owner is the line between a penetration test and an illegal attack.
• Scope — which hosts, paths, and time windows are in bounds. Crawlers will happily wander outside scope if you let them.
• Rules of engagement — testing hours, rate limits, prohibited techniques, and emergency contacts.
• Data handling — how captured responses and any sensitive content are stored and destroyed.

These aren't formalities. A crawler that discovers a third-party endpoint or a production database backup creates a real obligation to stop and report, not to keep digging.

Choosing Tools for the Job

Match the tool to the phase rather than looking for one product that does everything:

• Reconnaissance and attack-surface mapping — crawlers and content discovery tools.
• Scanning — vulnerability scanners for broad, repeatable coverage.
• Interception and manual testing — proxies for inspecting and modifying traffic.
• Exploitation — frameworks and purpose-built scripts.
• Reporting — formats your stakeholders and ticketing systems can consume.

If your bottleneck is knowing what exists on a target, a crawler with strong analysis and export options addresses that directly. If your bottleneck is confirming exploitability, crawling is only the first step.

Kali Linux is an open-source, Debian-based Linux distribution built for information security work: penetration testing, security research, computer forensics, and reverse engineering. It is best understood not as "Linux with hacking tools installed" but as a pre-configured platform — the tools, dependencies, and configuration are already set up so a professional can sit down and start working. It is aimed at security and IT professionals assessing the security of systems, not at general desktop use.

What makes Kali different from a regular Linux distribution

You can take almost any Linux distribution and install penetration testing tools on it. The difference is the work that follows: installing each tool, resolving dependencies, and configuring them individually.

Kali's stated position is that it "is not about its tools, nor the operating system" — it is a platform. The value is in the reduction of setup work, plus the surrounding ecosystem: documentation, a customization process, and metapackages that group tools by the task a security professional is doing.

What Kali is actually used for

The distribution targets several related information security tasks:

• Penetration testing — assessing the security of systems and networks.
• Security research — studying vulnerabilities and attack techniques.
• Computer forensics — examining systems and artifacts after an incident.
• Reverse engineering — analyzing binaries and software behavior.

The workflow Kali supports spans the whole engagement, from information gathering through to final reporting. The tool listing on kali.org includes names such as Nmap, Metasploit Framework, Burp Suite, Aircrack-ng, Hydra, John the Ripper, Maltego, and Responder — a mix of reconnaissance, exploitation, password, and analysis tools rather than a single category.

Where you can run Kali

One of Kali's practical advantages is that a version is available for most environments you might work in. Documented options include:

• Pre-built virtual machine images
• Installer images for bare metal or a VM
• Containers
• ARM builds
• Cloud provider images
• Windows Subsystem for Linux (WSL)
• Mobile devices via Kali NetHunter

This matters for deciding how to use Kali: a VM or WSL install keeps it separate from your daily system, while a container or cloud image suits disposable or remote testing environments.

Customizing Kali to a specific job

Kali ships metapackages — grouped sets of tools optimized for a particular security task — so you can install the toolset that matches your role instead of the full collection. For deeper needs, the ISO customization process is documented and lets you generate an optimized build for your own requirements. Both paths are aimed at the same goal: a system that reflects the work you actually do.

Who should use it — and who should not

Kali fits security and IT professionals who need a ready-to-work environment for assessments and research. The documentation is written for both seasoned practitioners and newcomers, and the project maintains active forums, an IRC channel, a bug tracker, and community tool suggestions.

It is a poor fit as a general-purpose daily desktop. The tooling, configuration, and default posture are oriented toward testing, not everyday computing — which is why running it in a VM, container, or WSL instance alongside your normal system is a common approach.

Getting started

1. Decide on a deployment form (VM, WSL, container, installer, cloud, ARM, or mobile) based on where you need to work.
2. Download the corresponding image from kali.org.
3. Read the documentation pages for your chosen form before installing — they cover setup and common issues.
4. Add metapackages for the tasks you perform rather than installing everything.
5. Check the FAQ and known issues pages if something behaves unexpectedly; both are maintained on the site.

The official documentation is open and community-contributed, so it doubles as a place to look up "recipes" for specific problems and to contribute fixes back.