1. Install the tool chain

sudo apt update
sudo apt install -y nmap wireshark tshark john hashcat hashid \
    binwalk exiftool steghide strings file imagemagick \
    python3 python3-pip sqlmap net-tools openssl gawk

# wordlists (rockyou ships with Kali, move it into a readable place)
sudo apt install -y wordlists
sudo locate rockyou.txt.gz
sudo gunzip /usr/share/wordlists/rockyou.txt.gz

# optional: offline GUI helpers
sudo apt install -y golang-github-gburca-go-dice
# CyberChef: download the offline release once, then serve it from /opt
#   https://gchq.github.io/CyberChef/  ->  cyberchef.html

2. The everyday commands

3. Tools per official area

Every challenge card links back to the section of this guide that matches its official area.

Essential Security Principles

# encoding / decoding
base64 -d file.txt                 tr 'A-Za-z' 'N-ZA-Mn-za-m'   # ROT13
xxd -r -p blob.hex > blob.bin     openssl enc -d -aes-256-cbc -in f -k KEY

# hashing and password cracking
md5sum file                        sha256sum file
hashid <hash>                         john --format=raw-md5 --wordlist=rockyou.txt hashes.txt
john --wordlist=rockyou.txt shadow.txt   hashcat -m 500 -a 0 shadow.txt rockyou.txt

# XOR and other symmetric tricks
python3 -c "d=open('blob','rb').read();k=b'key';print(bytes(b^k[i%len(k)] for i,b in enumerate(d)).decode())"

Basic Network Setup and Security

# addressing
ip -br addr                        ip route                ipcalc 192.168.10.77/26

# service discovery
nmap -sV -O -oX scan.xml 10.0.0.5  nmap -p- --open 10.0.0.5

# packet analysis
tshark -r capture.pcap -Y ftp      tshark -r capture.pcap -z follow,tcp,ascii,0
tshark -r capture.pcap -Y 'dns.qry.type==16' -T fields -e dns.txt

# firewall review
iptables -L -n -v                   iptables-save > rules.sh
grep '^-A INPUT' rules.sh

Endpoint Security Concepts

# logs and indicators of compromise
grep -i 'Accepted password' auth.log
grep -iE 'failed password|error|denied' auth.log | wc -l

# persistence
crontab -l                          ls -la /etc/cron.*        systemctl list-timers
grep -R 'base64 -d' /etc/systemd /etc/cron* 2>/dev/null

# file forensics
file mystery.bin                    strings -a mystery.bin | grep -i flag
exiftool photo.png                  binwalk photo.png        steghide extract -sf secret.txt -p pass photo.jpg

Vulnerability Assessment and Risk Management

# scan reports
grep -i 'severity' report.csv | sort -t, -k7 -nr | head
xmllint --xpath '//ReportItem[@cvss_base_score>9]' report.xml

# risk = likelihood x impact
awk -F, 'NR>1 && $6=="Critical" {print $1, $4, $7}' report.csv
# Critical = 4, High = 3, Medium = 2, Low = 1

# verification
nmap -sV -p 443 --script ssl-cert 10.10.5.12

Trivia round

# the numbers you need at your fingertips
grep -E '^(ssh|https|http)\b' /etc/services
cat /etc/services | grep -w 22
nmap --help | grep -A2 '\-sV'
# CVSS = Common Vulnerability Scoring System

4. Packets, quick recipes

# list every service nmap found, sorted
cat net_nmap_scan.txt | grep -E '^[0-9]+/tcp'

# extract the FTP credentials of a capture
tshark -r net_capture_login.pcap -Y ftp \
       -T fields -e ftp.request.command -e ftp.request.arg

# pull all DNS TXT payloads and rebuild the exfiltrated blob
tshark -r net_dns_exfil.pcap -Y 'dns.qry.type==16' \
       -T fields -e dns.txt | tr -d '\n' | base64 -d; echo

# carve every file out of a capture
tshark -r net_capture_login.pcap --export-objects http,/tmp/carved

5. Files, quick recipes

# decode an obfuscated payload and reverse it
echo <base64> | base64 -d | rev

# XOR a blob with a repeating key
python3 - <<'PY'
data = open('blob.bin','rb').read()
key  = b'olympics'
print(bytes(b ^ key[i % len(key)] for i, b in enumerate(data)).decode())
PY

# look at what is really inside an image
exiftool end_secret.png
binwalk end_secret.png
strings end_secret.png | grep CTF

6. Report and risk recipes

# the highest CVSS finding of a scan report
sort -t, -k7 -nr vam_scan_report.csv | head -3

# risk = likelihood x impact  (Critical 4, High 3, Medium 2, Low 1)
awk -F, 'NR>1 {print $1, $4, $6, $7}' vam_scan_report.csv

# the XML variant of the same report
xmllint --xpath '//ReportItem[@cvss_base_score>9]' vam_scan_report.xml

7. Static IP and LAN practice

The real competition expects the teams to build their own network. Practise the same steps on Kali before the event:

# show the current addressing
ip -br addr
ip route

# set a static address with NetworkManager
nmcli con show
nmcli con mod "Wired connection 1" ipv4.method manual \
       ipv4.addresses 192.168.10.50/24 ipv4.gateway 192.168.10.1 \
       ipv4.dns "8.8.8.8 1.1.1.1"
nmcli con up "Wired connection 1"

# or without NetworkManager
sudo ip addr add 192.168.10.50/24 dev eth0
sudo ip route add default via 192.168.10.1

# verify
ping -c 4 192.168.10.1
ping -c 4 8.8.8.8
nmcli device status

Connect two laptops with a UTP (cat5e/cat6) cable - a modern switch auto-MDI-X handles the crossover for you - give both machines an address in the same subnet and verify with ping and arp -n. Keep a screenshot of the working configuration, it is often worth marks.