KLCP Exam - Guided By RedBlock

KLCP Field Guide — Kali Linux Certified Professional (OffSec PEN-103) · Professional Edition

A thorough, documentation-grade study reference for KLCP, built around Kali Linux Revealed (PEN-103). The exam is knowledge-based (80 MCQs, closed-book, drawn from the book), so this edition emphasizes defaults, behavior, and the exact commands — each with example output, config samples, and the "why/gotcha" the exam probes.

Per-topic format: concept → commands → example output/config → documentation & gotchas. All commands target your own Kali install/lab. Official docs to keep open: Kali Docs (https://www.kali.org/docs/), Kali Tools (https://www.kali.org/tools/), Debian Administrator's Handbook, man/info pages, and /usr/share/doc/.

Table of Contents

1. About Kali Linux

2. Download & Verify Kali

3. Installing Kali (all methods)

4. The Linux Filesystem (FHS) & Shell Fundamentals

5. Users, Groups & Permissions

6. Services, systemd & the Boot Process

7. Configuring Kali (network, hostname, SSH, PostgreSQL)

8. Getting Help & Documentation

9. Debian Package Management (APT & dpkg)

10. Advanced Package Usage

11. Securing & Monitoring Kali

12. Customizing & Building Kali (live-build, persistence)

13. Kali Metapackages & Tool Categories

14. Kali in the Enterprise

15. Introduction to Security Assessments

16. Exam Tips, Quick Reference & Glossary

1. About Kali Linux

Definition. Kali Linux is a free, open-source, Debian-derived distribution built for penetration testing, security auditing, digital forensics, and reverse engineering, maintained by OffSec (formerly Offensive Security). It descends from BackTrack (its predecessor) and was rebuilt on a pure Debian foundation.

Key characteristics (high-yield):

Kali's purpose & audience. Kali is a specialist, all-in-one security toolbox for professionals — deliberately not pitched as a general-purpose daily desktop. OffSec frames it as a single, curated platform so assessors get consistent tooling.

Kali policies the exam tests:

• Default-disabled network services — Kali ships a policy (/usr/sbin/policy-rc.d behavior + systemd defaults) so installing a network daemon does not make it start on boot.

• Single curated toolset and metapackages (see §13).

• Minimal exposure philosophy — you turn on only what you need.

Kali variants/platforms: desktop ISO, VM images (VMware/VirtualBox/QEMU/Hyper-V), ARM (Raspberry Pi, etc.), WSL, Docker/Podman, Cloud (AWS/Azure/GCP), Kali NetHunter (Android mobile), and Kali Purple (defensive/blue-team edition).

2. Download & Verify Kali

Integrity and authenticity — the exam wants both steps and the reasoning.

# (1) Integrity: does my file match the published hash?
sha256sum kali-linux-2024.x-installer-amd64.iso
# compare to the value in the official SHA256SUMS

# (2) Authenticity: is the SHA256SUMS list itself genuinely from Kali?
wget https://cdimage.kali.org/current/SHA256SUMS
wget https://cdimage.kali.org/current/SHA256SUMS.gpg
wget -q -O - https://archive.kali.org/archive-key.asc | gpg --import
gpg --verify SHA256SUMS.gpg SHA256SUMS
# -> "gpg: Good signature from \"Kali Linux Repository <[email protected]>\""
sha256sum -c SHA256SUMS 2>&1 | grep OK

Example (verify success):

gpg: Good signature from "Kali Linux Repository <[email protected]>"
Primary key fingerprint: 44C6 513A 8E4F B3D3 0875  F758 ED44 4FF0 7D8D 0BF6
kali-linux-2024.x-installer-amd64.iso: OK

Why both: a matching checksum only proves the download didn't corrupt. The GPG signature proves the checksum list is authentic — otherwise an attacker who swapped the ISO could also swap a plain checksum. Confirm the key fingerprint matches the one published by Kali.

Image types to know: Installer, NetInstaller (small, pulls packages during install), Live (run without installing; supports persistence), Weekly builds, Virtual/Cloud/ARM/Mobile.

3. Installing Kali (all methods)

Methods: graphical/text installer · encrypted LVM · unattended (preseed) · live USB (± persistence) · ARM images · VM appliances · WSL · Docker.

Standard / partitioning

The installer's guided modes range from all files in one partition (simplest) to separate /home, /var, and /tmp (more control/isolation). LVM lets you resize later:

sudo lvextend -L +10G /dev/vg/root && sudo resize2fs /dev/vg/root

Encrypted install — LUKS + LVM

Choose "Guided – use entire disk and set up encrypted LVM." This creates a LUKS-encrypted container holding an LVM volume group; you enter a passphrase at boot to unlock.

cryptsetup luksDump /dev/sda3          # inspect LUKS header/keyslots
cryptsetup luksAddKey /dev/sda3        # add a passphrase/keyslot
sudo cryptsetup luksAddNuke /dev/sda3  # add a "nuke" passphrase (kali-luks-nuke)

Nuke passphrase (exam fact): entering it at boot wipes the LUKS keyslots, making the encrypted data permanently unrecoverable — a self-destruct for high-risk travel.

Unattended install — preseed

Automate every installer answer via a preseed file.

# boot params:  auto=true priority=critical preseed/url=http://server/preseed.cfg
# preseed.cfg excerpts:
d-i debian-installer/locale string en_US.UTF-8
d-i keyboard-configuration/xkb-keymap select us
d-i netcfg/get_hostname string kali
d-i partman-auto/method string lvm
d-i partman-auto/choose_recipe select atomic
d-i passwd/user-fullname string Kali User
d-i passwd/username string kali
d-i passwd/user-password-crypted password $6$<hash>
tasksel tasksel/first multiselect standard

Other targets

# WSL
wsl --install -d kali-linux            # from Windows
# Docker
docker pull kalilinux/kali-rolling && docker run -it kalilinux/kali-rolling
# then inside: apt update && apt install -y kali-linux-headless

Troubleshooting: missing Wi-Fi/NIC → add non-free firmware; installer logs on tty4 (Alt+F4); always re-verify the boot medium's checksum if the installer misbehaves.

4. The Linux Filesystem (FHS) & Shell Fundamentals

Filesystem Hierarchy Standard

ls -la /; stat /etc/passwd; df -hT; mount | column -t; lsblk -f
du -sh /var/log; findmnt

Shell (bash/zsh) essentials

pwd; cd -; pushd/popd; ls -la; tree -L 2
cp -a src dst; mv a b; rm -rf dir; mkdir -p a/b/c; ln -s tgt link; ln tgt hard
find / -type f -name '*.conf' 2>/dev/null; locate nmap; which/type/whereis nmap

Globbing & expansion: * (any), ? (one char), [a-z], {a,b} brace expansion, ~ home, $(cmd) command substitution, $VAR variables. Redirection & pipes:

cmd > out 2>&1     # stdout+stderr to file
cmd >> out         # append
cmd < in           # stdin from file
cmd1 | cmd2        # pipe
cmd | tee file     # screen + file
cmd &              # background;  jobs; fg %1; bg %1;  Ctrl+Z suspend

Text processing (heavily used): cat less head tail grep egrep awk sed cut tr sort uniq wc column. Variables/aliases/history:

export EDITOR=vim; alias ll='ls -la'; echo $PATH; history; !!; !123

Archives/compression: tar -czvf a.tgz dir/, tar -xzvf a.tgz, gzip/gunzip, xz, zip/unzip, 7z. Editors: nano (Ctrl+O save, Ctrl+X exit); vim (i insert, Esc, :wq, :q!, /search).

5. Users, Groups & Permissions

Identity & account files

id; whoami; groups; who; w
getent passwd kali; getent group sudo
cat /etc/passwd    # name:x:UID:GID:GECOS:home:shell
cat /etc/group     # group:x:GID:members
sudo cat /etc/shadow   # name:$hash:lastchg:min:max:warn:inactive:expire

Managing accounts

sudo adduser alice                  # Debian-friendly (creates home, group, prompts)
sudo useradd -m -s /bin/bash bob    # low-level
sudo usermod -aG sudo,adm alice     # APPEND to groups (-a is mandatory!)
sudo passwd alice                   # set password
sudo chage -l alice                 # password aging;  -M 90 -m 7 -W 14 to set
sudo deluser --remove-home bob; sudo groupadd pentest; sudo delgroup pentest
su - alice          # switch user (login shell);   sudo -i / sudo -s

Gotcha: usermod -G replaces all supplementary groups; -aG appends. Forgetting -a can drop a user out of sudo.

Permission model

ls -l file    # -rwxr-x---  type|owner|group|other

• Numeric: r=4 w=2 x=1 → sum per triad. chmod 750 file = rwx r-x ---.

• Symbolic: chmod u+x,g-w,o=r file; recursive chmod -R.

chown alice:pentest file; chgrp pentest file; chown -R alice dir
umask            # mask; 022 => files 644, dirs 755;  027 => 640 / 750

Special bits (exam-critical):

chmod 4755 /path/bin   # SUID       (find / -perm -4000 to audit)
chmod 2775 /shared     # SGID dir
chmod 1777 /tmp        # sticky

ACLs (fine-grained, beyond rwx)

getfacl file
setfacl -m u:bob:rw,g:pentest:r file    # grant
setfacl -x u:bob file                    # remove one
setfacl -b file                          # strip all ACLs
# a '+' after the mode in `ls -l` means an ACL is present

6. Services, systemd & the Boot Process

Kali uses systemd (PID 1).

systemctl status ssh                    # state + recent logs
systemctl start|stop|restart|reload ssh
systemctl enable|disable ssh            # boot autostart on/off
systemctl enable --now ssh              # enable + start together
systemctl mask svc                      # fully block a unit
systemctl list-units --type=service --state=running
systemctl list-unit-files --state=enabled
systemctl cat ssh                       # show unit definition
systemctl daemon-reload                 # after editing unit files

Unit types: .service, .socket, .timer (cron-like), .target (groupings), .mount, .path. journald logs:

journalctl -u ssh -e           # a unit's logs (end)
journalctl -b                  # this boot;  -b -1 previous boot
journalctl -p err              # priority filter
journalctl --since "1 hour ago" -f   # follow

Kali policy gotcha: installing a network service does not auto-enable it (restricted-services policy). You must systemctl enable explicitly.

sudo apt install apache2       # installed but NOT started/enabled on Kali
sudo systemctl enable --now apache2

Boot chain: firmware (BIOS/UEFI) → GRUB (/etc/default/grub, sudo update-grub) → kernel + initramfs (update-initramfs -u) → systemd → target.

systemctl get-default                       # graphical.target / multi-user.target
sudo systemctl set-default multi-user.target
systemctl isolate multi-user.target         # switch now (like old runlevels)

7. Configuring Kali (network, hostname, SSH, PostgreSQL)

Networking

# NetworkManager (desktop default)
nmcli device status; nmcli connection show; nmcli con up "Wired connection 1"; nmtui
# ip tooling
ip -brief addr; ip route; ip link set eth0 up/down; ip neigh
# DNS
cat /etc/resolv.conf; resolvectl status 2>/dev/null

Static config via ifupdown (/etc/network/interfaces):

auto eth0
iface eth0 inet static
    address 192.168.1.50/24
    gateway 192.168.1.1
    dns-nameservers 1.1.1.1 9.9.9.9

sudo systemctl restart networking     # apply ifupdown changes

Hostname & hosts

hostnamectl set-hostname kali-lab
cat /etc/hostname /etc/hosts

SSH server (disabled by default)

sudo systemctl enable --now ssh
sudoedit /etc/ssh/sshd_config     # Port, PermitRootLogin, PasswordAuthentication, AllowUsers
sudo systemctl restart ssh
# CRITICAL on cloned images — regenerate unique host keys:
sudo rm /etc/ssh/ssh_host_* && sudo dpkg-reconfigure openssh-server

PostgreSQL + Metasploit

sudo systemctl enable --now postgresql
sudo msfdb init && sudo msfdb status     # init the MSF database
msfconsole -q -x 'db_status; exit'

Shell / locale / time

chsh -s /usr/bin/zsh                 # default shell (Kali = zsh)
sudo dpkg-reconfigure locales; timedatectl set-timezone UTC

8. Getting Help & Documentation

man 5 sshd_config       # section 5 = config-file formats
man 8 systemctl         # section 8 = sysadmin commands
man -k firewall         # apropos: keyword search
whatis nmap; info coreutils
nmap --help | less; nmap -h
ls /usr/share/doc/<pkg>/   # READMEs, changelogs, examples
zless /usr/share/doc/<pkg>/changelog.Debian.gz

Man sections (memorize): 1 commands · 2 syscalls · 3 library · 4 devices · 5 file formats/config · 6 games · 7 misc/conventions · 8 sysadmin.

Official channels & when to use them:

• Kali Docs (kali.org/docs) — installation, usage, how-tos.

• Kali Tools (kali.org/tools) — per-tool documentation.

• Kali Forums / community — questions/help.

• Kali Bug Tracker (bugs.kali.org) — report reproducible bugs / packaging issues (not general Qs).

• /usr/share/doc, man, info — offline, authoritative.

9. Debian Package Management (APT & dpkg)

Two layers: APT (high-level, dependency-aware, talks to repositories) built on dpkg (low-level, one .deb).

APT — everyday commands

sudo apt update                 # refresh package indexes from sources.list
sudo apt upgrade                # upgrade installed pkgs; NEVER removes packages
sudo apt full-upgrade           # = dist-upgrade; MAY remove pkgs to satisfy deps
sudo apt install nmap           # install (+deps)
sudo apt install ./local.deb    # install a local .deb with dep resolution
sudo apt remove nmap            # remove, keep config
sudo apt purge nmap             # remove + config
sudo apt autoremove --purge     # drop orphaned deps
apt search term; apt show nmap; apt list --installed; apt list --upgradable
sudo apt-get clean; sudo apt-get autoclean   # clear cached .debs (/var/cache/apt/archives)

Rolling-Kali update habit:

sudo apt update && sudo apt full-upgrade -y && sudo apt autoremove -y

Sources, components & keys

cat /etc/apt/sources.list /etc/apt/sources.list.d/*.list

# canonical Kali source line:
deb http://http.kali.org/kali kali-rolling main contrib non-free non-free-firmware

Components: main (free, supported) · contrib (free, depends on non-free) · non-free (proprietary) · non-free-firmware (firmware blobs). Repo signing (fix NO_PUBKEY):

sudo wget https://archive.kali.org/archive-key.asc -O /etc/apt/trusted.gpg.d/kali-archive-keyring.asc
# modern style uses signed-by= in the sources line pointing at a keyring

apt-cache / apt-file (documentation & discovery)

apt-cache policy nmap        # installed + candidate versions and repo priorities
apt-cache depends nmap; apt-cache rdepends nmap   # forward / reverse deps
apt-cache show nmap
sudo apt install apt-file && sudo apt-file update
apt-file search bin/hydra    # which package provides a file you don't have yet

dpkg — single .deb layer

sudo dpkg -i package.deb          # install a local .deb (NO dep resolution)
sudo apt install -f               # fix broken/missing deps afterward
dpkg -l | grep nmap               # list installed (ii = installed)
dpkg -L nmap                      # files installed by a package
dpkg -S /usr/bin/nmap             # which package owns a file
dpkg -s nmap                      # status/details of installed package
dpkg --get-selections             # all package selection states
sudo dpkg -r nmap; sudo dpkg -P nmap   # remove / purge
sudo dpkg --configure -a          # finish interrupted installs

apt vs dpkg (classic exam contrast): apt/apt-get resolve dependencies and fetch from repos; dpkg operates on one local file and does not resolve deps (apt install -f cleans up). apt is a front-end that ultimately drives dpkg.

10. Advanced Package Usage

Holding (freeze a version)

sudo apt-mark hold metasploit-framework
apt-mark showhold
sudo apt-mark unhold metasploit-framework
echo "metasploit-framework hold" | sudo dpkg --set-selections   # dpkg way

Pinning / preferences (/etc/apt/preferences.d/)

# prefer kali-rolling; example priority
Package: *
Pin: release a=kali-rolling
Pin-Priority: 990

Priorities: >1000 downgrade-capable · 990 target-release default · 500 normal · <0 never. apt-cache policy shows the effective priority.

Source packages & building

# needs a deb-src line in sources.list
sudo apt build-dep <pkg>        # install build dependencies
apt source <pkg>                # fetch source
cd <pkg>-*/ && dpkg-buildpackage -us -uc   # build .deb(s)
sudo dpkg -i ../<pkg>_*.deb

Conffile conflicts on upgrade

When a package upgrade finds you've edited its config, dpkg prompts:

Configuration file '/etc/foo.conf'
  What would you like to do? Y/I/N/O/D/Z [default=N]
    Y/I  install the package maintainer's version
    N/O  keep your currently-installed version (safe default)
    D    show the diff;  Z  background a shell to inspect

Housekeeping & inspection

du -sh /var/cache/apt/archives      # cached debs
apt-mark showmanual                 # explicitly-installed pkgs
apt list '~i' 2>/dev/null           # installed (pattern)

11. Securing & Monitoring Kali

Principle: Kali is minimal by default — keep services off, enable only what a task needs, firewall the rest, patch continuously, monitor.

Firewall

sudo nft list ruleset                          # nftables (modern default)
sudo ufw enable; sudo ufw default deny incoming
sudo ufw allow 22/tcp; sudo ufw status verbose
sudo iptables -L -n -v                         # legacy view

Updates & auth hardening

sudo apt install unattended-upgrades && sudo dpkg-reconfigure unattended-upgrades
sudo passwd -l root                            # lock root (sudo model)
sudoedit /etc/ssh/sshd_config                  # PermitRootLogin no; key-only
sudo apt install fail2ban && sudo systemctl enable --now fail2ban

Monitoring & integrity

sudo apt install logcheck logwatch             # log summaries/alerts
sudo apt install aide && sudo aideinit && sudo aide --check   # file-integrity baseline
sudo apt install auditd && sudo systemctl enable --now auditd
last; lastb; journalctl -p err -b; who

MAC & device control (defense in depth)

aa-status                                       # AppArmor profiles
sudo apt install usbguard                       # control USB devices

Encryption at rest

gpg -c secret.txt                               # symmetric file encryption
cryptsetup luksFormat /dev/sdX; cryptsetup open /dev/sdX vault   # LUKS container

Documented Kali security policy mindset: define the machine's role → disable everything else → patch (apt full-upgrade) → monitor logs → back up. Kali's own "network services restricted by default" is the model to emulate.

12. Customizing & Building Kali (live-build, persistence)

Build a custom ISO with live-build

sudo apt install -y git live-build simple-cdd cdebootstrap
git clone https://gitlab.com/kalilinux/build-scripts/live-build-config.git
cd live-build-config

What you customize (directory map):

sudo ./build.sh --variant xfce --verbose        # produce a custom ISO
# choose architecture / variant as needed; output ISO lands in the build dir

Why: repeatable, standardized team images (your tools, wallpapers, users, configs) — pairs with preseed for zero-touch deployment.

Live-USB persistence

Add a partition labeled persistence with a persistence.conf:

# on the persistence partition (mounted at /mnt):
echo "/ union" | sudo tee /mnt/persistence.conf

Boot the live USB choosing "persistence" (or "encrypted persistence" for a LUKS-protected store) so changes survive reboots.

Kernel / driver & package tweaks

Use chroot hooks to rebuild the kernel or add drivers (e.g., specific Wi-Fi injection modules) and bake config into the ISO instead of post-install steps.

13. Kali Metapackages & Tool Categories

Metapackages are packages that only depend on a set of tools, so you install groups at once.

apt search kali-linux; apt search kali-tools
sudo apt install kali-linux-large kali-tools-web

Tool menu categories (know the taxonomy): Information Gathering · Vulnerability Analysis · Web Application Analysis · Database Assessment · Password Attacks · Wireless Attacks · Reverse Engineering · Exploitation Tools · Sniffing & Spoofing · Post Exploitation · Forensics · Reporting Tools · Social Engineering Tools · System Services.

14. Kali in the Enterprise

Scaling Kali to a team/fleet (documented in Kali Linux Revealed):

• Configuration management with SaltStack — a salt-master pushes states to many salt-minion Kali hosts for consistent config.

sudo apt install salt-master salt-minion
sudo salt '*' test.ping; sudo salt '*' state.apply

• Network installs / PXE boot — TFTP + DHCP serve the installer + preseed to image many machines unattended.

• Local APT mirror — apt-mirror (config in /etc/apt/mirror.list) so a fleet updates from an internal source (bandwidth, control, offline).

• Custom ISOs (live-build, §12) as the org standard.

15. Introduction to Security Assessments

You use Kali to perform these; know the distinctions:

Assessment flow: scoping → information gathering → vulnerability analysis → exploitation → post-exploitation → reporting (the deliverable). Kali's menu categories map onto these phases, and OffSec stresses documentation/reporting as the professional output.

16. Exam Tips, Quick Reference & Glossary

Exam shape: 80 questions, multiple-choice, closed-book, drawn directly from Kali Linux Revealed. No live lab — it tests facts, defaults, and behavior. Study the book's chapters; this guide mirrors them.

High-yield facts:

• Kali = Debian-testing-based, rolling (kali-rolling), by OffSec; default DE Xfce, default shell zsh, non-root user + sudo since 2020.1.

• Network services disabled by default; installing ≠ enabling (systemctl enable --now).

• Verify downloads with checksum and GPG ("Good signature", check fingerprint).

• apt resolves deps; dpkg -i doesn't (apt install -f).

• apt upgrade never removes; full-upgrade/dist-upgrade may.

• Special bits: SUID 4000 / SGID 2000 / sticky 1000; /tmp = 1777; audit with find / -perm -4000.

• usermod -aG needs -a; -G alone replaces groups.

• Encrypted install = LUKS + LVM; nuke passphrase destroys keyslots.

• man §5 config files, §8 admin commands.

• Customize/build = live-build; live-USB persistence = persistence partition + persistence.conf (/ union).

• Report bugs at bugs.kali.org; ask questions on the forums.

One-line command reference:

sha256sum -c SHA256SUMS; gpg --verify SHA256SUMS.gpg SHA256SUMS   # verify
sudo apt update && sudo apt full-upgrade -y                       # roll forward
dpkg -S /path;  dpkg -L pkg;  apt-file search bin/tool            # ownership/discovery
sudo apt-mark hold pkg / unhold pkg                               # freeze
sudo systemctl enable --now svc                                   # start + boot
chmod 4755 / 2755 / 1777;  find / -perm -4000 2>/dev/null         # special bits
sudo usermod -aG sudo user;  chage -l user                        # accounts
getfacl file; setfacl -m u:bob:rw file                            # ACLs

Glossary:

• APT / dpkg — high-level (dep-aware) vs low-level (single .deb) package tools.

• Rolling release — continuously updated distro (kali-rolling).

• Metapackage — package that only depends on a group of others.

• FHS — Filesystem Hierarchy Standard.

• LUKS / LVM — disk encryption / logical volume management (encrypted install).

• Preseed — unattended-install answer file.

• live-build — custom-ISO build toolchain.

• Persistence — live-USB partition that retains changes.

• conffile — a package's config file dpkg tracks for upgrade conflicts.

• NetHunter / Kali Purple — mobile edition / defensive (blue-team) edition.

• SaltStack — config-management system Kali documents for fleets.

End of guide. Commands target your own Kali install/lab and mirror the Kali Linux Revealed material the KLCP exam is drawn from. Focus revision on defaults, package-management behavior, permissions/special bits, verification, and Kali's service policies.