Skip to content
CBT Nuggets
DemoBook a Demo

Introduction to CySA+

This skill provides an in-depth introduction to CompTIA CySA, focusing on cybersecurity analysis. It covers the setup of a virtual environment using Oracle VirtualBox, the installation of Kali Linux, and the use of various cybersecurity tools, including Metasploit. The course emphasizes practical, hands-on learning to reinforce security principles and prepare learners for advanced security analysis tasks.

Full skill from CySA+. Preview the training IT teams trust.

Updated

45m

Skill 1 of 19 in CySA+

What you'll learn

  • Install VirtualBox on a host system to create an isolated virtual lab environment for security practice
  • Install Kali in VirtualBox, including disk partitioning on the VDI and the GRUB boot loader
  • Update and upgrade Kali tools and packages from its repositories using sudo and apt in the terminal
  • Explain why commands that affect the operating system require administrative rights via sudo on POSIX-based systems
  • Identify how Kali's preinstalled tools are categorized and locate Metasploit for later testing
  • Set up a Windows 11 virtual machine in VirtualBox as a practice target alongside Kali

Free 45-minute video lesson with a full transcript and knowledge checks. No account needed to watch.

Welcome to CySA+

CompTIA offers us a certification that sits in between Security+ and CASP. Where Security+ is about the basic understanding of security and policy on an IT system or network, and CASP is an advanced understanding of that overall security policy for the organization, CySA+ is that perfect area for us that are focused on security analysis.

Knowledge Check

CompTIA+ sits in between which other CompTIA certifications?

Select all that apply.

Getting our tools ready

As we progress through content for CySA+, we need to get some tools ready for some practical testing. But we don't want to mess up our host system with some of the tools and practices we learn about. For this, we'll set up a virtual environment using Oracle VirtualBox.

Why VirtuaBox? Mostly because it's free. But more to the point, VirtualBox is just right for what we're doing inside of this course. It creates a virtual environment that doesn't require too much maintenance and we can still access the internet or external networks inside of the virtual machines we create if we want to.


How do we know which version of VirtualBox to download? That's easy if we're using Windows as our physical host. We just select "Windows hosts" on the download page and go from there. But what if we have a Mac?

Inside of our Mac terminal (or command prompt if you're used to Windows), we can type in the command 'arch' to figure out what kind of architecture or platform the CPU is. Oracle only supports i386, x64, or x86_64 for full VirtualBox release. If your system is 'arm64' (as is the case in the picture above), you'll need to download a Beta copy of VirtualBox.


Knowledge Check

Which versions of Mac are fully supported for VirtualBox? (choose 3)

Select all that apply.

Putting an OS inside of VirtualBox

Well, we have VirtualBox installed but we need an operating system to use inside of that virtual environment. So, let's take a look at finding Kali and installing it.


The term "pre-allocated" refers to how storage space is allocated for a virtual machine (VM) in a virtualization environment, such as VMware, VirtualBox, or Hyper-V. These approaches have distinct differences:

Pre-allocated (also known as Thick Provisioning):

· In a pre-allocated storage configuration, the entire amount of storage you allocate to a virtual machine is reserved on the physical storage medium upfront.

· Regardless of how much data the VM actually uses, the full allocated space is immediately consumed on the host storage.

· This method can provide better performance for the VM because there is no need to dynamically allocate space as data is written, as with thin provisioning.

Not pre-allocated (also known as Thin Provisioning):

· In a thin provisioning setup, the virtual machine is allocated only a portion of the storage space upfront, and the remaining storage space is allocated on-demand as the VM writes data.

· This means that, initially, the VM takes up very little physical storage space, and storage is allocated and consumed as the VM needs it.

· Thin provisioning is more storage-efficient because you don't allocate space that may not be immediately needed, but it can lead to fragmentation and, in some cases, performance degradation when the storage fills up.


Knowledge Check

If our physical system has 8GB of RAM, we can allocate all 8GB of that RAM to a virtual machine without any problems.

Installing the Kali operating system in VirtualBox

As we being to install Kali in our virtual environment, we need to know the difference between an installed operating system on the hard drive and a Live Operating System. In our video, we install Kali on the virtual hard drive for a traditional feel and practice.

A live operating system, also known as a live OS or live CD/DVD/USB, is an operating system that can be run directly from external media, such as a CD, DVD, or USB drive, without the need for installation on the computer's hard drive. Live operating systems are designed to provide a functional and complete computing environment without making any changes to the host computer's existing operating system or files.

Live operating systems do not need to be installed on a computer's internal storage (i.e. hard drive or SSD). Instead, they are booted directly from external media.

When you boot a computer from a live CD/DVD or USB, the operating system is loaded into the computer's RAM (random access memory). This allows you to use the operating system and its applications as if it were installed locally.

A live OS creates a temporary computing environment that is separate from the host computer's existing operating system. It does not make any permanent changes to the computer's storage.

Live operating systems are highly portable and can be run on different computers, as long as they support booting from external media. This makes them useful for tasks like system recovery, diagnostics, or testing without altering the host system.

Live operating systems typically come with a range of pre-installed applications, and you can often save data and settings on the external media (e.g., USB drive) for future use.

Live operating systems are commonly used for various purposes, including system troubleshooting, data recovery, security assessments, testing, and demonstrations. They are especially valuable in situations where you want to assess or use a different operating system without affecting the computer's existing setup.

Knowledge Check

We did not install a Live OS for Kali.

Booting into our Virtual Operating System (Kali)

The first order of business we need to tend to is making sure our Kali OS is up to date. This includes system files and programs included in our Kali distribution. We may have an older version of the Kali ISO and some updates are required in order to properly leverage some of the programs within the OS.

Before running any commands inside of the terminal, we need to check and verify if the command is affecting the operating system or needs elevated rights. If so, we start our commands off with 'sudo'. This is similar to the "Run As" function inside of Windows. But, this will only work if the user we're logged in as has administrative permissions on the system we're logged in to. If we're logged in as a regular user and try a sudo in terminal, we'll get a form of access denied.

The two commands that we run in order to do this update are:

sudo apt update

This command runs a check against the predefined repositories and gathers a list of files and programs that need updates.

sudo apt upgrade

This command begins the update process by downloading the files needed and then checks for installation verification.

sudo apt update && apt upgrade

And we can combine the two commands with && to allow an update against the repositories and then an automatic installation. We will still need to verify the install with a yes or no. But the && is how we combine multiple commands together inside of POSIX-based systems.

Knowledge Check

The command we use to update and upgrade our Kali OS at the same time is which of the following?


After we complete the Kali update, you'll notice that the OS is up to date with the latest distribution available on the Kali website. This allows us to use older ISO downloads of Kali and just update after install if we are limited on time or internet connection.


There are a lot of tools that come with Kali by default. And there are plenty of tools you can download through the 'apt' command. As we go through this course together, we'll be downloading individual tools for testing. But if you'd like to see the list of tools and some of the user guides, check out the Kali Tools page.

Metasploit

Throughout our course together, we'll be using a variety of tools to reinforce our understanding and practice. One tool in particular is Metasploit. Think of Metasploit as the Swiss Army Knife of pen testing a multitude of potential vulnerabilities.

Metasploit isn't just available inside of Kali. It can even be used within a Windows operating system. But for the purposes of this course, we'll primarily be working out of Kali when it comes to Metasploit. You can check out the different variation of Metasploit for different operating systems at their site.

Knowledge Check

Looking back in our Metasploit video, the command that was displayed to run Metasploit suite for the first time was which of the following:

Wrapping up with a Practical Challenge

As we start to wrap up this skill together, we have a challenge for those playing at home. One of the things we'll need in this course for practice later is a virtual machine to test against. For this, we'll need a target. And ours will be a Windows 11 Pro system made inside of VirtualBox.

With everything we've covered concerning VirtualBox and operating system installs, see if you can install Windows 11 Pro in your own virtual environment. We'll just be using the evaluation copy of Windows so we don't have to spend any extra funds on our learning. So, hop on over to the official Microsoft Windows 11 download site for the ISO.

I hope this skill was helpful in letting you set up and prepare the necessary components of what we'll be using through out this skill together. We'll be expanding on this skill as we progress through the course.

Knowledge Check

Were you able to set up your Kali box at home?

This interactive assessment is available in the full learning experience.

Want to answer questions like this yourself?
with no purchase required. Already have an account?

View Transcript

Welcome to CySA+

0:00Hi, Eric here. You may remember me from such classics as, hold on, let me get my notes straight here. Enterprise Security Essentials, Hacking Tools, Techniques and Incident Handling, one of my personal favorites, Networking, Monitoring, and Threat Detection, a new one, and a classic in the making, An Intro to Digital Forensics. In this course, we're diving into the world of CompTIA with CYSA+, which is for cybersecurity analysts. Now, you may be wondering, addendum.

0:32That's right, we're learning the new stuff when CS0-003. Now, we always know that technology is always advancing and so are the certifications and therefore, the curriculum surrounding those technical certifications. And that's what we're trying to do here at CBT Nuggets, is keep up with the curriculum that is always advancing. Now, you may be wondering where CYSA+ sits inside of our CompTIA structure. Well, it sits in between Security+ and CASP.

1:03So if this is your introduction to CompTIA, does that mean you need to take this course? Absolutely, because some of us may be well versed in cybersecurity, but just haven't been too deep inside of CompTIA just yet. See, if you've been keeping up with my courses here, where we've been learning together, this is our first dive together inside of CompTIA, where our other ones have been inside of other realms. So CYSA+ may be a perfect fit for where we're at in our technical understanding and learning progression.

1:33It doesn't necessarily mean that we're outside of our learning scope here. That's what this course is for, because we're gonna try to make this as easy as possible in terms of understanding. But if you ever do find yourself off the beaten path too far inside of this course, that's okay too. That doesn't necessarily mean that you have to give up. Don't ever give up. Keep learning, always do it. Trust me, it's worth it because there are plenty of resources here on CBT Nuggets to help us get back to where we need to be and take us even further.

2:03So if you have to, take a pause, go search the catalog here at CBT Nuggets and see if we have skills, because I know we do. They cover a lot of this stuff in more in depth and help us get us to that point where we need to be together. Because I know for a fact that Bob covers a lot of great material inside of Security+, and that is the course in CompTIA land that is right before this one. So if you're brand new to IT, cybersecurity in general, don't you worry, we're gonna take care of you, I'm with you.

Getting our tools ready

0:00So before we get too much further into this actual skill and start diving into the curriculum for CySA+, we need to get a couple of prerequisites out of the way first before we get too far into the weeds of what's actually going on and there causes a lot of confusion. And in order to do that, we're going to be installing VirtualBox. Now, we're going to be doing this together in this little nugget here. And that's because I want to make sure that we all understand what is going on and making sure that we're having our virtual environment set up.

0:32Virtual environment, you say? Yes. Because throughout this course, we're going to be trying to stick to what I've been going with for the other courses I've been involved with, and that is putting pen to paper or actual practice to what we're learning. See, I'm a learn by doing, and as much as I love reading and understanding the curriculum inside the book itself, if I can actually put some actual practice to what's going on, it kind of sticks with me a little bit better. So inside of CySA+ material, there's going to be some times where we actually break open some tools and start doing a little bit of practice to see if we understand and can truly test out some of those security practices.

1:12Now, we're going to be using VirtualBox for this demonstration. And to do that, I'm going to be on the Downloads of VirtualBox page. And I'm going to be putting links for everything below. And we're going to select, for this case, our Windows host. Now, there is something I want to add here real quick, and that is, for Macs, I just recently learned that if you open up your terminal and type in the command arch, you'll be given an output of what kind of architecture platform that you have on your particular laptop.

1:42for Macs, right? And the reason this is important is because if you have a 32 or 64-bit kind of traditional, if you will, that the Mac host here for VirtualBox will work. However, if you have an ARM64, and that's A-R-M-6-4, you'll definitely need to take a look at some of the beta releases that VirtualBox has to offer because the Mac installation here does not natively work inside of that main architecture, that is ARM64.

2:13So I've had some trouble with it, just keep that in mind. And while we download this and then go to our Downloads folder to see that it's downloaded all the way. You see it right here, I'm going to double-click on VirtualBox. My screen may go black because that is the UAC, user access control inside of Windows. I'll drag everything over it here and minimize that for us. And while we're installing, I do want to expand on just a couple of things for us real quick. The reason that we're going to be using VirtualBox as we click Next for our intro and go Next again for our basic installation of VirtualBox 7 is because we want to make sure that if we have any mistakes inside of what we're doing for our practice, that it's not affecting the actual host itself.

2:57And as I click Yes for proceed with the installation and proceed with installing the missing independencies, such as Python because it is required for VirtualBox. Those mistakes can cause problems to the actual system itself based on some of the tools that we may use for malicious intent, but for study. Well, if we keep it contained inside of a virtual environment, such as VirtualBox, we'll be able to minimize damage to our host, if not mitigate it altogether.

3:30Because inside of that virtual environment, it's contained. It has a virtual hard drive, it has virtual RAM, and we can install different operating systems virtually to simulate that practice. And they also have capabilities on the internet themselves, which will demonstrate here in the next couple of videos. Now, we're going to go ahead and start VirtualBox. Now, why are we using VirtualBox? Some of you may be asking, why not VMware? Well, in some of the other courses that I do here on CBT Nuggets, I do touch on VMware.

4:02And the difference is, is that VirtualBox is perfect for this course because it's free and it doesn't necessarily fill us up with too many bells and whistles that we don't need or can't really configure. Whereas VirtualBox here, if I open it up real quick, boom, there we go. Now, I kept the default settings because I uninstalled it and reinstalled it so that way we could do it together. But this is the standard display we get when VirtualBox is installed. But VMware comes with a lot more detailed-oriented settings capabilities that aren't necessarily needed in something like CySA+ curriculum.

4:40So we're going to be using VirtualBox because I like keeping the cost to the actual learner as low as possible because I like keeping my costs low as possible. So, I'm going to wrap this one up here, and as we move on, we'll go into the next set of tools that we need inside of our VirtualBox environment.

Putting an OS inside of VirtualBox

0:00All right, so that's not the only tool that we need to install. Now that we have a virtual environment ready for us to be able to put the virtual operating system into on our host system here, we need to be able to install that operating system. And the one that we're gonna be using for this particular course is Kali. Now again, this may seem familiar to our other courses where we use Kali for pen testing and network analysis, but here we're gonna be applying it to the CYSA curriculum to make sure that we understand those security principles that will lead us into that higher level of understanding for security policy.

0:36So we're gonna pop on over to our actual Kali box here, or not Kali Box, but the actual website where we can download Kali from. And again, I'm gonna be putting all the links for this below. And as you can see here on this website, we have many different options. So we're gonna be looking at virtual machines, which is the one here on the top right, and we can see here that it says for VMware and VirtualBox for prebuilt images. So as we go in there, you will see that we have VirtualBox64 in the middle. Now I'm gonna be selecting this because the system that I have installed VirtualBox on is a 64 bit operating system.

1:12If you do install this on a 32 bit, by all means, swap to 32 bit and we'll be back on here on 64 and we're gonna just download straight from the site itself. And once we have this downloaded, we will go ahead and move this to our folders and get everything organized and walk through the installation of the Kali OS together. Be right back as this downloads. Okay, so I've got it downloaded, and as you can see, I have it highlighted the Kali Linux ISO file that I downloaded directly from the site.

1:43And what we're gonna be doing here is go ahead and create a new folder on our host system, and we're gonna call this Kali CYSA. Now, the reason I'm creating this folder is because when we go back inside of VirtualBox itself, we're gonna be creating a new virtual machine, and that's with the new icon up at the top. And we have some different options that come up. We're gonna call this one Kali dash CYSA. And I'm gonna to change the folder to this one over to the actual folder that we just created inside of our physical hard drive on the physical post system.

2:19I'm gonna go inside a VirtualBox, see my Kali CYSA, and select that folder. Now the next thing that's gonna ask us is, is "Where is the ISO image located at?" Because if we're installing an operating system, we do need an ISO image and this ISO is basically replicating that disc or a CD ROM. And I'm gonna select other and go in and select inside of CBT, VirtualBox, and there's that Kali ISO. Now, by default, it identifies that this is a Linux based operating system or POSIX based, anything that derives from Unix and it picks up that it is Ubuntu 64 bit.

2:57That is the closest it can determine because Kali is kind of a mishmash of a bunch of different Linux distributions. Now we're gonna go and down to the hardware for this and select some different variables here. And that is the RAM and the processing power of our virtual machine. And this is limited to what the actual host system has capable or available for the system overall. So for instance, if we have 12 processing or cores, we can only allocate up to 12, but if we allocate all 12 of 'em, we won't have any left for the actual host system itself.

3:32So we might want to do two for this one, and I'm gonna slide that over to two. And the same thing goes for RAM. Now this system has a good bit of RAM on it, but in order for me to not overpower and not waste too much RAM while we're doing this, I'm just gonna set it to eight. I'm gonna slide it over to 8,000 something megabytes, 8192 for instance. And that way I know that we won't be using all of the RAM available to the system and cause problems on the physical host itself. Because if, let's say this system only had four gigs of RAM and I set this to eight, well now I've used up too much.

4:08And the same thing goes for the hard disk. And now in this case, we're gonna be looking at making sure that this is in the right folder and we're gonna be dedicating actual hard drive space to this virtual machine and it's gonna create that VDI file, which means virtual disc. And we're gonna allocate, I'm gonna allocate, let's say 60 gigs to this and we're gonna leave it at a VirtualBox disc image. Now this creates a file on your host system that the virtual machine will refer to as this system's hard drive.

4:43And if we want to pre allocate the file full size, what we're doing here is saying when we create this VDI or virtual disc image to go ahead and create all 60 gigs of it, instead of the opposite, which would be only create or use as much space as needed until we reach that maximum that we've set. And in this case it's 60 gigs. So if you leave this unchecked, there's a chance that you can go in there and only see that 25 gigs is being used, but you set it for 60, "Why not the whole 60?"

5:14Because you, we did not pre allocate all the way. Now I like pre allocating because that'll tell me if, one, if I have enough hard drive space and two, if let's say I have five gigs of hard drive space left and I need 10 gigs for the VDI, the system won't crash, it'll already have this allocated. So I don't have to worry about anything overriding that empty space on the hard drive. So those are the defaults. We're gonna click on finish. And what it's doing right now is it's creating the actual virtual machine files that go required in order to be able to run this on our host system.

5:52Now this may take a minute based on the type of system that we have and the processing power. So after this we will be right back and go ahead and crank up our virtual machine for the first time and make sure Kali is installed correctly.

Installing the Kali operating system in VirtualBox

0:00So our virtual machine has been created, but the operating system has not been fully installed yet. But before we get into that, let's take a look and make sure that we understand what's exactly going on under the hood. So we can see here that we have kali - cysi as our virtual machine, and it's not powered on yet. We've swap over to the actual folder that we created it in and created a sub folder. We go in there and we can see that we have the actual hard drive right here, the .vdi, and it's fully allocated for its 60 gigs. Now I know it's not 60 gigs exactly, it's 62 and some change.

0:33That's just how computers count. But we know that the hard drive itself has been fully allocated. So that way if we start running low on space inside of a hard drive, this will have its space allocated to it. Now these other two files, these are settings for that virtual box that we have just set up. Now we're gonna swap back over to our kali box and we're gonna right click and go to Start. And we're gonna select a Normal Start. Now what's happening here, since this is the first time it's cranking up, it's going to be reading that ISO file, the ISO of the actual kali box.

1:08Let me see if I can drag this over for us. As it does, its initial first time boot up. Now you'll see Auto capture keyboard. I'm gonna click in here and I'm gonna push down for our install. And that's because we want to install the actual Kali operating system on that virtual hard drive that we have instead of doing a live operating system, where a live operating system would load just inside the RAM. And when we turn the system off, it would poof. But since we're putting it on that hard drive, henceforth, every time that we crank up after install, Kali will always be here for us.

1:43Now I'm going to hit Enter so we can go ahead and install. And one thing I do wanna point out here is that you may think my mouse is lost or trapped or I don't know what's going on here. That's okay, just hit the right Ctrl button on your keyboard and the mouse will become free from the virtual machine and subjective to our will. But if we go inside that virtual machine again, we can see, let me clear that notification thing to the right, what's our language that we're using? And for this one, we're gonna be selecting English, We hit Enter.

2:16In our territories, the United States. And some of this may seem familiar for to other operating system installations. And that's okay. It just means that we're getting really good at what we're doing here. And the key map that we're using, and the key map is basically how do the keys line up on our keyboard based on the region, language, and other settings that we may have. We may need to change this, but we're gonna be going with American English and we're going and installing the files to the actual virtual hard drive, like a normal operating system.

2:48Now I'm gonna do a couple of cuts here and there just because I don't wanna waste anybody's time with what's going on. So I will be right back, but I promise I won't click anything ahead. And just like I promised I'm back, another box popped up asking us for more information and I wanted to make sure that we were all here together. Basically, what's our host name? What are we calling this system? And in this case, we're just gonna call it kali. We're gonna hit Enter for default. Now we're not using a domain in this course, so we're gonna leave this blank and hit Enter. Otherwise we would add that domain name in there. And that would be something along the lines of maybe like active directory.

3:22And for the first full user, we're gonna be typing in eric for this one. Now there is a default username root, and we'll set that password here shortly. Did it do anything? We need to actually tap to it and make sure that we can go to enter. Now for our password, we're just gonna be typing in password all lowercase see if that allows us to do that. We're gonna type in our password again to make sure that we did it right, and I'm just have it over to the actual Continue button.

3:52and hit Enter. And it took it. Now do remember, this is not the password you actually want to use on a real operating system. Now I am in central time because I am in the greatest state of all Texas. And we're gonna hit Enter for that and it's gonna continue and I will be right back to the next prompt. Oh wait, there it is. So how do we wanna install this? Do we want to use the entire disk? Do we want to use part of it? Well, we're gonna keep it simple. We're gonna be using the entire disk, and that's referring to the actual VDI or virtual disk image for virtual box.

4:24And that and inside of the actual virtual operating system, which is Kali here. It sees it as 0,0,0 SC3. Common to POSIX-based operating systems. It's wanting to ask us where we're putting everything at, and we're gonna leave everything in one partition. We can get more into detail of this way later on. Nothing to worry about here. We're gonna hit Enter and we're gonna review our changes real quick. And if we don't need to really change anything, we're gonna finish partitioning this disk and write everything to it so we can do the full install.

4:57And by default, it's going to have no highlighted here. But don't be fooled. We do wanna write these changes to disk and continue with our installation. Be right back. Okay, we're back. And now it's asking us what all do we want to install as far as default software sets. And we're gonna leave the defaults checked because we have the desktop environment selecting this item has no effect. We have the Xfce, which we'll get into later. That's the default desktop environment. And then the collection of tools, which is basically all the default tools that Kali will have to offer.

5:30But we'll be going over that list and more in depth later on throughout this course. And then the top 10 most popular tools, and that can be checked out on the actual Kali site itself, same as the actual recommended tools. So we're gonna go Tab to continue and make sure that it does that basic install. And what's happening is it's retrieving files from the actual Kali repository. We'll get way more into repository later in the course, but this confirms that we actually have connection to the actual internet itself.

6:00And if you don't believe me, run Wireshark can take check out some network monitoring and analysis. So at this point in the installation, it's asking us if we want to install the GRUB boot loader. And in this case, we're going to be selecting yes because this puts it on the primary drive. If we had more than one virtual disk or more than one physical hard drive on a host, if we were installing it on a physical host, we would select whichever drive that we wanted it to be on in case we were running multiple operating systems. We're gonna select yes and then we're going to select the /dev/sda, which is the virtual disk that we're working from.

6:38And then it's going to start installing the GRUB and updating it, making sure that we have everything in line for being able to not only boot, but go into the Kali operating system once it's fully installed. Just like that, our installation is complete, we're gonna hit to Continue to restart this virtual machine and it's unmounting the ISO. So the next time that it boots up, it won't boot from disk or ISO in this case. And you can see that the GRUB loader was just there. And we are at our boot selection.

7:09I'm gonna move the keys up and down so it doesn't automatically go. And by default, it wants to go into Kali GNU/Linux. And we can go into advanced options. This would be like if we needed to do boot load or anything like that. But we're gonna ahead go ahead and hit Enter to load up Kali virtual machine operating system. And as we move forward throughout this course, this is what we'll be using, but we're not quite done yet. There are some tools inside of this operating system that we need to take a look at, and that's what we're gonna do next.

Booting into our Virtual Operating System (Kali)

0:00After our reboot, Kali is all the way installed and I know that the virtual machine is running and we have that window open, but I wanted to show you this real quick that's actually on the screen. And note that on the right side where my mouse is kind of swirling at right now, we can see a preview of what's actually going on inside of that virtual machine. Now I have it opened right here, and I'm sorry I can't expand this too much. That's kind of one of the differences between VirtualBox and VMware is that I can install VM tools and expand this. But in VirtualBox, we are kind of stuck with this until we actually go inside the OS.

0:35Now I'm gonna be logging in as Erik, that's the user account that we created when we did the initial install of the operating system itself. And the password that I had was "password", all lowercase. Now it's gonna take just a second to boot up, and this can be dependent upon the resources allocated to the virtual machine when we were initially creating it inside of our VirtualBox and not the installation of the OS itself. And as you can see here, it comes up to our standard background. Now this may vary based on the updated version of the ISO that you download from the Kali site, and that's why we're also gonna do a little house cleaning before we actually get too far into our course overall.

1:16And the first thing that we need to do is right click on the desktop and go to "Open Terminal Here". Now we're gonna do a couple of different checks real quick and the first one is, is we're going to ping google.com to verify our internet connectivity. And as we can see here, we are in fact pinging. And I'm gonna hit Ctrl + c because inside of Kali and POSIX-based systems, unless you specify the exact number of pings, it'll keep going until you tell it to stop. Now at this point, I can make my window a little bit bigger as you can see here, and that can make things a whole lot better for us, the learners, to be able to see what's actually going on.

1:53And I'm gonna type in clear just to simply clear my terminal window so we can actually get down to business here. Whenever we run commands inside of POSIX-based systems that have anything to do with the operating system whatsoever, we need to tell it to run with administrative rights. Now inside of Windows, this is usually done as right click and then run as administrator, or run as different user, et cetera. But inside of POSIX-based systems, we can kind of get away with this by doing sudo inside of our terminal.

2:24And sudo, which I believe stands for "Super User Do", as in "do that", then we type in our command. And at this point we're going to do a sudo apt get, or apt update, my bad. And it's gonna ask for our password because that's the, it wants to make sure that we are who we say we are. We didn't actually get into any kind of account without authorization. And as you can see here on the screen, it's going to a couple of different places to get a updated list of what's going on.

2:59And what it's doing in actuality is saying, "are we up to date inside of our operating system?" This is akin to kind of a Windows update, but we're inside of Kali. And this is also includes the tools that are installed in Kali by default when we went through the installation as well. So now that we have, we ran our update, which is updating our list of things that can be upgraded. We see that we have 1,750 programs or packages that can be upgraded and we just simply hit up and make sure, instead of update, we say upgrade.

3:35Now these two commands can be ran at the same time with ampersands, and we'll do that way later on in the course. But I'm running these separately to make sure that we understand the difference between "update" and "upgrade" as far as our apt goes inside of the terminal. So when we run it this time, notice it didn't ask for a password, that's because we're within that time limit of our session of using the password for sudo inside a terminal. Now, when I did the command of upgrade, you can see that these are all the packages that need to be updated inside of our Kali distribution here.

4:11And this is something that we need to do regardless of the version of the operating system we download from the Kali website. We always wanna make sure that we're up to date on tools, updates, patches, and anything else that may be covered by the upgrade and update, because some tools may have been modified to attack different versions of operating systems. There may have been a Windows update out there for Windows Professional that previous versions of Kali may not be able to exploit, but we're going to fix that by doing this update and upgrade.

4:46Now, I also wanna clarify too, it's not necessarily Kali, the operating system, that's doing the attacking later on, it's gonna be the programs within. And we will touch on that. Hold on one second. We're gonna hit "yes" for continue, and it's gonna contact our repositories that are in our sources.list. Now again, we'll be getting into that a little bit later, but these are the defaults set up inside of Kali as far as the operating system is installed. And as you can see here, it's now doing a bunch of gets, and so it's downloading the packages to the local operating system and getting them ready to install.

5:22Now this is going to take a little bit, and that's why we're going to do a pause in the recording, and we're magically gonna come back at the snap of a finger after this has all been installed and done so that way we don't have to wait for another hour. Are you ready? 1, 2, 3. (snaps fingers) Everything installed, and now we're left with a prompt of what do we want to do next? And that's because some of the things that installed require changes to the service and to the kernel overall inside the operating system. So do we wanna "restart these services during package upgrades without asking?"

5:56And we're gonna say "yes", because we don't wanna go through one by one and install all these, or restart all of these services individually. So again, this is gonna take a little bit because now we're going through services and installing things that are related to the kernel itself. So after another snap, we'll be back after this part finishes. (snaps fingers) Everything was fully installed and upgraded. And as you'll notice, we've had a little bit of a change inside of our Kali operating system here. And that's because regardless of what distribution of Kali we're on, reasonably, let's say within a year or two, if you are installing from a previous ISO, after you run the update on this and get everything downloaded from the repositories, it'll upgrade it, even look and all, to the current Kali distributions offered on their actual download website.

6:50And this works out in cases to where time is a factor and we have a Kali OS that's already installed on a virtual machine or an actual physical host, and we just wanna do an update to it real quick and not necessarily reinstall the entire OS. Maybe internet's an issue or something along those lines. But now that we have everything installed, I would highly recommend to go ahead and restart the system. But at this point, we're gonna take a pause and get ready for looking at some of the tools that we're gonna be using throughout the rest of this course.

Metasploit

0:00Now, there are a wide variety of tools inside of Kali as far as the operating system is concerned, because it's prepackaged with nearly everything and anything that we can think of to test out vulnerabilities, and cause just havoc and mayhem, or I mean pen testing purposes, making sure that we're staying inside of what our organization is allowing us to do, right? Yes, that's exactly where we were going in this. But we're gonna take a look around Kali real quick, and look at some of the default programs that we have installed and how they're categorized.

0:30And then we're gonna take a look at the one that we're gonna be using the most throughout this course to test everything, metasploit. Let's take a look. Inside of our Kali OS, we have the top left little dragon icon right there, very similar to Windows as our start menu. And you can see that we have different categories of what's actually going on here. And we have it broken down into different types of groups. We have information gathering, vulnerability analysis, web analysis tools, database, password, wireless, reverse engineering, exploitation, sniffing and spoofing, post exploitation, forensics, reporting, and social engineering, and my favorite, 42, the Kali offset links.

1:12Basically, if you are lost, go there, and you can find everything for the true answer of life, the universe, and everything. Now, I generally come in here and press the start button or the little dragon button, and just start typing in meta, as in META, and then see metasploit framework right there. Now, doing it this way is just done with regular user permissions, because even though we're logged in as an administrator inside of the OS, we have to run pseudo if we wanna be able to do anything, which is why this comes up. And we see pseudo password for Eric, and we know that that's lowercase password.

1:47And it's starting our database, and you'll see a little bit of ask yard here, just a second as it's going through its initial startup of creating internal databases, logs, getting everything ready for a fresh run right here, creating initial database schema. And depending on the allocation we did for resources on this particular system, this may take a little bit. Now, we do have a little good chunk of resources here for Kali as far as this virtual box VM is concerned.

2:19So we should be running pretty decently. And you can see here that we have been granted with a cal for this run. Now we're not gonna go too deep in the weeds on actually running metasploit for this particular skill. We will be doing this throughout the course. I just wanted to show you where it's at. And if you scroll up all the way up to the top and we highlight this line right here, you can actually see the command line that you would type in the terminal to be able to do this. See, the start icon or the little dragon icon is just basically a GUI overlay, because in a POSIX-based system, everything tries its best to run inside of the actual kernel or the terminal command line itself.

3:00Whereas inside of Windows, we usually get everything run as an executable inside of its own little environment. And that can be good and bad, depending on what we're trying to do. Whereas if the GUI fails here, if our start menu craps out and we don't see anything in the background and we just have nothing but terminal, we can still run these applications. Something to definitely keep in mind, and as we go through this course, it might be good to write some of these commands down. Hint, hint, nudge, nudge.

Wrapping up with a Practical Challenge

0:00All right everybody, I got a bit of a challenge for you for those playing at home. And we've already been through our VirtualBox installation. We've already installed Kali. We've even taken a spin at taking a look at Metasploit, just on the surface of it, but we're gonna need a target. And that target in this course is probably going to be a Windows box. And more specifically, since we wanna stay as up to date as possible, Windows 11. Now we're gonna be using Windows 11 Pro as some of our targeting objectives.

0:30And for that, I just wanna go over a couple of things with you real quick. Now, I'm gonna be having the link for this right above the video, and this is the site where you could download the installation media, whether it be ISO or whichever format that you prefer to do for your Windows 11 installation. And we wanna stay inside of our virtual environment, which brings me to this right here, which is our challenge for this skill. Now, again, for those playing at home, as we've gone through on how to install the VirtualBox, you won't need to do that again, but we will have to go through the setup of installing a new operating system.

1:09Now, I wanted to show you this right here to let you know that I've already got our Windows 11 Pro demo box set up, and we're gonna take a look at some of the settings on that behind the scenes. But more specifically, I wanted to show you inside of Windows 11 itself, when you type in the winver command, we have Windows 11 version 22H2. Whichever version that you install of Windows 11, depending on when you actually view this skill, that's okay, we'll try to keep it within generalized terms as far as some of the targeting methods go.

1:41That's okay, I'm gonna close that out and then I'm gonna pop back over to VirtualBox for a second just to go over some of my settings, just so you can get an idea or hints on how to do this on your own. So we'll Right Click on the actual Windows 11 VM that's running and go into our settings. And inside of system, you can see that I have the base memory set at eight gigs, and then I have the default chip set. I have the the default boot orders. And then under the processor tab, you can see that I have it set at two cores.

2:13And this is some of the stuff that we went over when we were initializing our Kali box to begin with. And do keep in mind that if you decide to run both of these boxes at the same time, you will still need an ample amount of resources to overflow, make sure that you have everything in order. Because if they're running two processors on the Windows 11 VM and two processors on the Kali VM, we'll definitely need more than four, logically, at least, for the system overall. Now, this one right here has 12 logical sockets for the processor, so that leaves us eight to mess with here on the host system itself.

2:51And inside of storage, you can see that I have the Windows 11 VDI, and if I select it, we have our location, Which in the D Drive VirtualBox folder that we created for our Kali VM. Now, I created a sub Windows 11 folder and moved everything inside of there, so I can kind of compartmentalize everything. But these are just some of the things to think about as we start building out our targeting boxes. Definitely some of the things to keep in mind as you start to progress and make your own virtual environment inside a VirtualBox, and remember that it needs to be on the same network as well too, but leaving everything by default on the network during installation will take care of that for us automatically.

3:35As this course continues, we'll talk about network segmentation and how to divide that up inside of VirtualBox to replicate some different VLANs, different networking requirements, routing, subnets, et cetera, et cetera. But definitely keep this in mind and know that this won't be the last time that we're inside creating VMs inside a VirtualBox.

Wrapping up with a Practical Challenge

0:00We have a lot of our preparatory work out of the way, and we got a basic understanding of our virtual environment inside a virtual box, and we have Kali installed, and we're even introduced ever so briefly to Metasploit. So let's go ahead and start knocking out those objectives one by one as we start making our way through CompTIA CySA+. I hope this has been informative for you, and I'd like to thank you for viewing.

Frequently asked questions

What does the Introduction to CySA+ lesson cover?

This lesson builds the practice lab used throughout the CySA+ course: the learner installs VirtualBox, installs Kali in a VirtualBox VM, updates its tools with sudo and apt, explores how Kali's preinstalled tools are categorized, and locates Metasploit. It closes with a challenge to set up a Windows 11 virtual machine as a practice target alongside Kali.

How long does the Introduction to CySA+ lesson take?

The lesson runs about 45 minutes. It is one of 19 skills in the CompTIA Cybersecurity Analyst CySA+ (CS0-003) course, which IT Directors and Training Managers can plan at about 15 hours per learner.

Why does the CySA+ course start by building a VirtualBox lab with Kali and Windows 11?

The course pairs CySA+ concepts with hands-on practice, so the lesson first creates an isolated virtual environment where a team member can safely test security practices. Kali and its tools, including Metasploit, are used throughout the course, and later lessons return to VirtualBox to replicate network segmentation, VLANs, routing, and subnets.

Why do Kali update commands need sudo?

On POSIX-based systems, commands that affect the operating system must run with administrative rights, which sudo provides from the terminal, similar to Run as administrator in Windows. The lesson uses sudo with apt to update and upgrade Kali's tools and packages from its repositories, keeping them current with newer operating system versions.

What background should a team member have before starting this CySA+ lesson?

The course is intermediate and professional-level, aimed at SOC analysts, security administrators, vulnerability management staff, and aspiring cybersecurity analysts, and is especially relevant for teams with 3 to 5 years of security experience preparing for CompTIA CySA+ CS0-003. This first lesson walks through the lab setup step by step, so the learner builds the environment alongside the trainer.

How can a Training Manager assign and track this lesson for an analyst team?

CBT Nuggets Playlists can sequence this setup lesson first, followed by monitoring and detection, vulnerability scanning and prioritization, and incident response by role or sprint. Team Reporting shows per-learner progress and completion, cohort and group views, and completion exports for audit evidence.

Team training path

Turn this skill into assignable team training

This free skill is a preview of the courses your team can assign, track, and report on with CBT Nuggets.

What's next?

Ready to keep going?

For your team

Bring this training to your team

See how CBT Nuggets helps IT teams close skills gaps, hit compliance targets, and prove training ROI.

Book a Demo
Just need CySA+?

Learning on your own? Browse individual plans ($49/month, billed annually) →

Not ready to buy?
with no purchase required. Already have an account?
Book a Demo