This guide provides step-by-step instructions to set up a Kali Linux-like penetration testing environment on macOS using Homebrew.
-
Homebrew - macOS package manager. If you don't have Homebrew installed, install it first:
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
-
macOS Terminal or iTerm2 (optional for enhanced terminal experience).
Some tools require additional Homebrew repositories:
brew tap homebrew/cask
brew tap homebrew/core
Run the following command to install the required tools:
brew install --formula wireshark nmap masscan nikto sqlmap aircrack-ng hcxtools hydra whois theharvester hashcat john python ruby netcat tcpdump gnupg binwalk && brew install --cask burp-suite zaproxy docker virtualbox
The volatility
package is not available through Homebrew but can be installed manually:
pip install volatility
git clone https://github.com/volatilityfoundation/volatility.git
cd volatility
python setup.py install
Metasploit is not available via Homebrew. You can install it via Docker or manually:
docker pull metasploitframework/metasploit-framework
docker run -it --rm metasploitframework/metasploit-framework
curl https://raw.githubusercontent.com/rapid7/metasploit-framework/master/scripts/omnibus_installer.sh | bash
-
Add Wireshark to PATH:
echo 'export PATH="/Applications/Wireshark.app/Contents/MacOS:$PATH"' >> ~/.zshrc source ~/.zshrc
-
Launch Docker and VirtualBox:
- Start Docker Desktop from Applications.
- Open VirtualBox for virtual machines.
Tool | Description |
---|---|
Wireshark | Packet analyzer |
Nmap | Network scanner |
Masscan | High-speed port scanner |
Nikto | Web server vulnerability scanner |
Sqlmap | SQL injection tool |
Aircrack-ng | Wireless network cracker |
Hcxtools | WPA handshake tools |
Hydra | Password brute-force tool |
WhoIs | Domain lookup utility |
The Harvester | Subdomain and email reconnaissance |
Hashcat | GPU-accelerated password cracker |
John the Ripper | Multi-platform password cracker |
Python | Programming language for scripting and tools |
Ruby | Programming language for Metasploit and tools |
Netcat | Networking utility |
Tcpdump | Command-line packet analyzer |
GnuPG | Encryption and signing utility |
Binwalk | Firmware analysis tool |
Burp Suite | Web application security testing tool |
OWASP ZAP | Web application penetration testing tool |
Docker | Containerized environments for penetration tools |
VirtualBox | Virtualization for running Kali Linux VMs |
- Permission Errors: Run commands with
sudo
if necessary, but avoid doing so unless required. - Missing Tools: Some tools might require manual installation or alternative approaches (e.g., Docker containers).
Feel free to submit pull requests or open issues if you'd like to improve this guide or add more tools!