You have spent this course learning what web vulnerabilities are and that tools exist to find them. Now begins the part where you learn to drive those tools — and that starts with the environment that hosts them all: Kali Linux.
This is the orientation chapter for the Kali toolchain. It is a foundations lesson, not an exploitation walkthrough. The aim is simple but essential: you should be able to boot Kali, keep it current, locate the right tool for a job, and work in an organised, logged, repeatable way. Every later lesson in this phase — Nmap, Nikto, sqlmap, Hydra, Metasploit, Wireshark — assumes you can operate the environment those tools live in.
Scope warning. Kali is a collection of powerful, often intrusive tools. Installing it grants you capability, never permission. Throughout this lesson and every lesson after it, point your tools only at the bundled NovaCart, at systems you own, or at targets for which you hold explicit written authorisation. This is the rule from the ethics and authorization lesson, and it is absolute.
In this lesson you will:
- Understand what Kali Linux is (a curated, tool-laden distribution) and what it is not (a magic "hack" button, a daily-driver OS, or an authorisation to test anyone).
- Compare ways to run it — VM, bare-metal, WSL2, Docker, live USB — and when each fits.
- Learn the application menu categories, with focus on Web Application Analysis, and how to keep a rolling release current.
- Map the menus onto the recon → scan → exploit → post-exploit → report workflow.
- Pick up terminal hygiene —
tmux, output logging, and note-taking — and the habit of running non-root in an isolated lab.
Estimated time: ten to twelve minutes.
When you are ready, send the Continue signal.