Kali Linux Penetration Testing Techniques Training Course

Course overview

Security teams need evidence-based answers to practical questions: which systems are exposed, how an attacker could move from an initial foothold to sensitive data, and which remediation actions will reduce risk first. Kali Linux provides a purpose-built environment for authorised penetration testing, but effective use requires more than running scanner commands. Practitioners must scope tests safely, validate findings manually, distinguish exploitable weaknesses from noise, preserve useful evidence, and communicate risk in terms that system owners can act on.

This five-day intermediate course develops a repeatable penetration testing workflow using Kali Linux. Participants conduct reconnaissance, network discovery, service enumeration, web application testing, vulnerability validation, controlled exploitation in isolated lab systems, privilege-escalation analysis, and post-exploitation evidence collection. They use Nmap to build an attack-surface map, Burp Suite to test web requests and sessions, Metasploit Framework to validate selected vulnerabilities, and Kali Linux utilities for password auditing, file transfer, and reporting. The course also covers rules of engagement, test scoping, evidence handling, CVSS-informed prioritisation, and remediation-focused reporting.

Teaching combines instructor demonstrations with guided work in segmented virtual lab environments that emulate a corporate network and web application estate. Each exercise requires participants to document commands, assumptions, screenshots, findings, affected assets, and recommended fixes. By the end of the course, each participant produces a structured penetration test report and executive findings summary for the lab engagement, including an attack-path narrative, validated evidence, prioritised remediation plan, and retest criteria. This course is particularly valuable for technical staff who support internal security assurance, vulnerability management, infrastructure operations, or application security programmes.

Course objectives

By the end of this course, participants will be able to:

• Define authorised penetration-test scope, rules of engagement, asset boundaries, and evidence-handling requirements
• Configure a Kali Linux assessment workspace with secure networking, note-taking, and organised evidence directories
• Perform host discovery, port scanning, service fingerprinting, and network enumeration using Nmap
• Test web application requests, authentication flows, session handling, and input validation using Burp Suite
• Validate selected vulnerabilities in an isolated lab using Metasploit Framework and manual verification techniques
• Analyse Linux and Windows privilege-escalation paths from enumerated permissions, services, and configurations
• Document attack paths, affected assets, proof-of-concept evidence, and remediation recommendations in a penetration-test report
• Prioritise findings using business context, exploitability, impact, and CVSS-informed risk ratings

Benefits of attending

Target competencies

Who should attend

• Penetration Testers — who need a disciplined Kali Linux workflow for authorised infrastructure and web assessments
• Cyber Security Analysts — who investigate vulnerabilities and need to distinguish validated exposure from scanner output
• Security Engineers — who design and operate controls and need to test how those controls perform against realistic attack paths
• Network Administrators — who manage exposed services and need to recognise enumeration techniques and remediate configuration weaknesses
• Systems Administrators — who administer Linux and Windows estates and need to identify privilege-escalation and credential-exposure risks
• Application Security Analysts — who assess web applications and need practical Burp Suite testing and evidence-reporting skills

Requirements and prerequisites

Participants should be comfortable using a Linux command line, navigating directories, editing text files, and running standard networking commands. Prior knowledge of TCP/IP, common ports and protocols, DNS, HTTP/HTTPS, authentication concepts, and basic Windows and Linux administration is assumed. Experience reading vulnerability scan results or using a virtual machine is helpful. Participants should understand that testing must be authorised and confined to defined scope. Prior programming experience, advanced exploit development, malware analysis, and previous Metasploit or Burp Suite experience are not required; these tools are taught through guided lab exercises.

Training methodology

The instructor introduces each testing phase through short demonstrations in Kali Linux, followed by guided exercises against isolated virtual machines and a deliberately vulnerable web application. Participants work from a written scope, record commands and evidence, compare enumeration results, and discuss why a finding is or is not reportable. Small-group review sessions examine attack paths and remediation options from both tester and system-owner perspectives. The final day uses a timed, scoped lab engagement in which participants assemble technical findings, an executive summary, and a prioritised remediation plan.

Course outline

Day 1: Engagement setup and reconnaissance

• Penetration-testing lifecycle, legal authorisation, and rules of engagement
• Kali Linux virtual machine configuration and lab network connectivity
• Command-line navigation, package management, and evidence directory structure
• Target scoping, asset inventories, exclusions, and testing windows
• Passive reconnaissance using DNS records, public metadata, and service context
• Threat modelling an exposed network and web application estate
• Evidence capture standards, command logging, screenshots, and chain of custody

Workshop: Participants prepare a scoped assessment workspace and produce a rules-of-engagement checklist, target register, and evidence-capture plan for the lab environment.

Day 2: Network discovery and service enumeration

• Host discovery strategies for routed and local network segments
• Nmap port-scanning modes, timing templates, and scan accuracy trade-offs
• Service version detection, operating-system fingerprinting, and NSE scripts
• DNS, SMB, SSH, FTP, SNMP, and RPC enumeration techniques
• Interpreting banners, certificates, shares, users, and exposed management interfaces
• Correlating enumeration output with known vulnerabilities and misconfigurations
• Building an attack-surface map and identifying high-value validation targets

Workshop: Participants scan a segmented lab network with Nmap and produce an annotated attack-surface map showing hosts, services, likely owners, and priority targets.

Day 3: Web application assessment with Burp Suite

• Burp Suite proxy setup, target scope, HTTP history, and site mapping
• Intercepting and modifying HTTP requests, headers, cookies, and parameters
• Authentication testing, session management, and access-control checks
• Input-validation testing for injection, cross-site scripting, and file-upload weaknesses
• Burp Repeater and Intruder for controlled request replay and payload testing
• Manual validation of scanner findings and false-positive reduction
• Capturing reproducible proof of concept and web remediation guidance

Workshop: Participants assess a deliberately vulnerable web application through Burp Suite and produce two validated findings with reproduction steps, evidence, impact, and recommended fixes.

Day 4: Controlled exploitation and privilege analysis

• Exploit selection criteria, stability assessment, and safe validation boundaries
• Metasploit Framework modules, payload handling, sessions, and database workspace use
• Manual exploitation validation when automated modules are unsuitable
• Credential exposure, password auditing, and secure handling of recovered secrets
• Linux privilege-escalation enumeration of sudo rights, services, cron jobs, and file permissions
• Windows privilege-escalation enumeration of services, scheduled tasks, shares, and token privileges
• Post-exploitation evidence collection, lateral-movement constraints, and cleanup procedures

Workshop: Participants validate a permitted lab vulnerability, enumerate the resulting host for privilege-escalation paths, and produce an attack-path evidence record with cleanup notes.

Day 5: Reporting, remediation, and retesting

• Finding classification using likelihood, impact, exploitability, and CVSS-informed ratings
• Writing concise technical findings with affected assets and reproducible evidence
• Explaining attack paths and business consequences for non-technical stakeholders
• Developing remediation recommendations, compensating controls, and ownership actions
• Separating immediate containment, corrective actions, and strategic security improvements
• Retest planning, closure criteria, and residual-risk documentation
• Executive summary structure and stakeholder presentation of assessment results

Workshop: Participants complete a scoped end-of-course lab assessment and produce a penetration-test report, executive summary, prioritised remediation plan, and retest checklist.

Tools & standards covered

Kali Linux, Nmap, Burp Suite, Metasploit Framework

A typical training day

Live online deliveries follow the same structure in the East Africa Time zone, with shorter screen blocks and longer breaks.

What the fee includes

How you can take this course

Certification

Participants who complete the full five days receive the Skillset Development Certificate of Completion, stating the course title, course code, dates and delivery format — suitable for professional-development records and employer reimbursement.

Frequently asked questions