pentest-lab-notes 🧪¶

Penetration testing — learn from the attacker's perspective

Practice notes for penetration testing that stays entirely inside your own machine, on macOS (Apple Silicon). They walk through the full attack flow of nmap → Metasploit → meterpreter, written so you can reproduce it hands-on.

⚠️ Ground rule: only your own property, or targets you're authorized to test. The targets you stand up here are practice systems made intentionally vulnerable. Scanning or attacking other people's machines or services without permission is illegal. Keep your targets strictly limited to "practice containers inside your own machine," scanme.nmap.org (nmap's officially sanctioned practice target), and the like — always.

📖 The big picture — the flow an attacker follows (the kill chain)¶

flowchart LR
    A("① Recon"):::red --> B("② Open a way in"):::red --> C("③ Break in"):::red --> D("④ Dig in & steal"):::red --> E("⑤ Spread"):::red
    classDef red fill:#2d333b,stroke:#f85149,stroke-width:2px,color:#e6edf3
    linkStyle default stroke:#f85149,stroke-width:2px

Stage	What you do	Main tools	Chapter
① Recon	Get to know the target (nmap, but also OSINT and human recon)	nmap / whatweb, etc.	06
② Open a way in	Fire attack code that hits a weak spot	Metasploit (exploit)	07
③ Break in	Deliver the code that runs once you're inside	Metasploit (payload)	07
④ Dig in & steal	Set up re-entry and gather information	meterpreter	08
⑤ Spread	Use the foothold to pivot deeper inside	meterpreter (lateral movement)	09

🗺️ Table of contents¶

📘 Part I — Learn the fundamentals¶

#	Document	Contents
01	Pentest fundamentals and terminology	Black/gray/white box, 🔴 red / 🔵 blue / 🟣 purple teams, common terms
02	What each go-to tool is for	How nmap / Metasploit / Burp Suite / ZAP differ

🛠️ Part II — Build the environment¶

#	Document	Contents
03	Choose a setup pattern	Three patterns: Kali VM (the standard) / Mac native (quick) / attacker-in-a-container
04	Get the tools onto your Mac	Set up nmap / Docker / Metasploit
05	Stand up a practice target	Run an intentionally vulnerable practice target locally

🔴 Part III — The attack flow (red team techniques)¶

#	Document	Stage
06	Recon — nmap	① Recon
07	Exploitation — Metasploit	②③ Exploitation (exploit + payload)
08	Post-exploitation — meterpreter	④ Dig in & steal
09	Lateral movement & internal recon	⑤ Spread

🔵 Part IV — Defense and going further¶

#	Document	Contents
10	Defenders' tools (blue team)	Investigate planted backdoors and traces
11	Pentesting in the AI era	Gather info → have AI propose vulnerability candidates and an attack order → a human verifies

📎 Appendices¶

	Document	Contents
A	Reference (cheat sheet)	Quick reference for nmap options, meterpreter commands, and vulnerability databases
B	Run Kali Linux in a UTM VM	Includes workarounds for Apple Silicon snags
C	AI setup prompt collection	Paste them and AI helps with setup
D	The reverse shell won't come back	macOS Docker pitfalls and fixes
E	Safety rules for publishing	Consistent placeholder IPs, personal data, diagram colors

⚡ The "three commands" to learn first¶

nmap -sn 10.10.10.0/24         # ① Who's there? (host discovery)
sudo nmap -sS -sV 対象          # ② Open ports + versions (stealth)
sudo nmap -A 対象               # ③ The works (OS, details, scripts)

🏗️ The practice environment in this guide¶

flowchart TB
    subgraph net["Docker network (pentest-lab)"]
        ATK("attacker<br/>Metasploit container"):::red
        TGT("target<br/>vulnerable target server"):::blue
        ATK -->|"attack → reverse shell"| TGT
    end
    classDef red fill:#2d333b,stroke:#f85149,stroke-width:2px,color:#e6edf3
    classDef blue fill:#2d333b,stroke:#58a6ff,stroke-width:2px,color:#e6edf3
    linkStyle default stroke:#8b949e,stroke-width:2px

The trick is to put the attacker and the target on the same Docker network (the reason is in Appendix D).

📜 License / Disclaimer¶

This guide is for educational purposes.
The author assumes no responsibility whatsoever for any consequences of using the techniques described here against targets you are not authorized to test.
Always follow the principle of "only your own property, or targets you have written authorization to test."