Traditionally, I used netstat piped through grep for rapid network information extraction. My LLM and I automated the process and added a few more features :-D . Updates will keep rolling out. Tested on Kali Rolling .
A comprehensive network security audit script designed specifically for Kali Linux penetration testing environments. This script performs automated security checks to ensure your pentesting laptop isn't inadvertently exposing services or vulnerable to attacks.
- Port Scanning: Identifies all listening TCP/UDP ports with associated processes
- Connection Monitoring: Tracks established connections and connection states
- Interface Analysis: Detects promiscuous mode and VPN interfaces
- Firewall Assessment: Comprehensive firewall status (iptables, UFW, firewalld)
- Service Auditing: Monitors running services and daemons
- Process Analysis: Detects suspicious processes and unusual execution paths
- Configuration Review: Examines network parameters and DNS settings
- Kali-Specific Checks: Tailored for Kali Linux pentesting environment
- Nmap Integration: Self-scanning with TCP/UDP ports, OS detection, service enumeration
- Web Vulnerability Testing: Nikto scanning for local web servers
- SMB Enumeration: Comprehensive SMB analysis with enum4linux, smbclient, smbmap
- Service Banner Grabbing: SSH, FTP, DNS service identification
- Network Discovery: arp-scan, netdiscover, masscan, rustscan integration
- Color-coded Results: Red (critical), Yellow (warning), Green (good), Blue (info)
- ASCII Art Header: Professional presentation
- Organized Sections: Easy-to-scan categorized output
- Security Recommendations: Actionable advice for hardening
- Kali Linux (tested on 2023.x and later)
- Bash shell
- Root privileges (for comprehensive checks)
# Clone the repository
git clone https://github.com/yourusername/kali-network-audit.git
cd kali-network-audit
# Make the script executable
chmod +x kali_net_audit.sh
# Run the audit
sudo ./kali_net_audit.shwget https://raw.githubusercontent.com/yourusername/kali-network-audit/main/kali_net_audit.sh && chmod +x kali_net_audit.sh && sudo ./kali_net_audit.sh# Run with full privileges (recommended)
sudo ./kali_net_audit.sh
# Run as regular user (limited functionality)
./kali_net_audit.sh ██╗ ██╗ █████╗ ██╗ ██╗ ███╗ ██╗███████╗████████╗ █████╗ ██╗ ██╗██████╗ ██╗████████╗
██║ ██╔╝██╔══██╗██║ ██║ ████╗ ██║██╔════╝╚══██╔══╝ ██╔══██╗██║ ██║██╔══██╗██║╚══██╔══╝
█████╔╝ ███████║██║ ██║ ██╔██╗ ██║█████╗ ██║ ███████║██║ ██║██║ ██║██║ ██║ ██╔═██╗ ██╔══██║██║ ██║ ██║╚██╗██║██╔══╝ ██║ ██╔══██║██║ ██║██║ ██║██║ ██║ ██║ ██╗██║ ██║███████╗██║ ██║ ╚████║███████╗ ██║ ██║ ██║╚██████╔╝██████╔╝██║ ██║ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╚═══╝╚══════╝ ╚═╝ ╚═╝ ╚═╝ ╚═════╝ ╚═════╝ ╚═╝ ╚═╝ Network Security Audit Script - Wed Sep 17 15:30:45 CDT 2025
[✓] Running as root - full access mode
========================================
SYSTEM INFORMATION
========================================
Hostname: kali-laptop
Kernel: 6.1.0-kali7-amd64
Distro: Kali GNU/Linux Rolling
Uptime: up 2 hours, 15 minutes
Load Average: 0.08, 0.12, 0.09
[✓] Confirmed Kali Linux system
========================================
LISTENING PORTS & SERVICES ========================================
[i] Checking for listening TCP ports...
TCP Listening Ports:
[PRIVILEGED] tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=1492,fd=3))
[USER] tcp LISTEN 0 50 *:1716 *:* users:(("kdeconnectd",pid=2756,fd=7))
- Listening TCP/UDP ports
- Established connections
- Network interface status
- Promiscuous mode detection
- VPN tunnel interfaces
- Routing table analysis
- DNS configuration
- iptables rules and policies
- UFW (Uncomplicated Firewall) status
- firewalld configuration
- Network security parameters
- SystemD service status
- Failed service detection
- Web server checks (Apache, Nginx)
- Database server monitoring
- SSH service analysis
- Nmap self-scanning (TCP/UDP, OS detection, service enumeration)
- Web vulnerability scanning with Nikto (if web servers detected)
- SMB enumeration with enum4linux, smbclient, smbmap
- NetBIOS information gathering
- SMB protocol version detection (SMBv1 vulnerability check)
- Service banner grabbing (SSH, FTP, DNS)
- Anonymous access checks (FTP, SMB)
- arp-scan local network discovery
- netdiscover passive reconnaissance
- masscan fast port scanning
- rustscan modern port scanning
- tcpdump traffic analysis
- WiFi network enumeration
- Default Kali services status
- Metasploit database check
- Pentesting tool process detection
- Security recommendations
- Suspicious process locations
- Hidden process detection
- Network connection mapping
- System update status
The script provides tailored recommendations including:
- SSH hardening strategies
- Firewall policy improvements
- Service management best practices
- Update and maintenance reminders
- Kali Linux specific security guidance
# Ensure script is executable
chmod +x kali_net_audit.sh
# Run with appropriate privileges
sudo ./kali_net_audit.shMost tools are included in Kali Linux by default. If you encounter missing commands:
# Update package list
sudo apt update
# Install common network tools
sudo apt install net-tools iproute2 lsofIf you see "NO FIREWALL PROTECTION DETECTED":
# Enable UFW
sudo ufw enable# Or configure iptables
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT- 🔴 RED: Critical security issues requiring immediate attention
- 🟡 YELLOW: Warnings that should be reviewed
- 🟢 GREEN: Good security practices detected
- 🔵 BLUE: Informational messages
- SSH Running: Normal for remote access but ensure it's secured
- KDE Connect: Legitimate but consider firewall rules
- No Firewall: High priority - enable protection
- Multiple Connections: Monitor for unusual activity
After running this audit, consider these complementary security tools:
# Comprehensive system audit
sudo lynis audit system
# Rootkit scanner
sudo rkhunter --check
# Network mapper (scan yourself)
nmap -sS localhost
# Web vulnerability scanner
nikto -h http://localhost
# SMB enumeration suite
enum4linux localhost
smbclient -L localhost -N
smbmap -H localhost
# Process monitor
sudo netstat -tulnp
# Real-time network monitoring
sudo ss -tuln4 | watch -n 1
# Advanced SMB testing
nbtscan localhost
rpcclient -U "" localhost
# DNS enumeration
fierce -dns localhost
dnsrecon -d localhostContributions are welcome! Please feel free to submit pull requests or open issues for:
- Additional security checks
- Bug fixes
- Performance improvements
- Documentation updates
- Kali Linux tool integrations
- Maintain existing color coding scheme
- Add comments for complex logic
- Test on multiple Kali versions
- Update documentation for new features
This project is licensed under the MIT License - see the LICENSE file for details.
This tool is intended for educational purposes and authorized penetration testing only. Users are responsible for complying with applicable laws and obtaining proper authorization before using this tool on any systems they do not own or have explicit permission to test.
Use responsibly and ethically.
- Issues: GitHub Issues
- Discussions: GitHub Discussions
- Documentation: Wiki
- v1.0: Initial release with comprehensive network security auditing
- v2.0: Enhanced edition with:
- Export capabilities (JSON/HTML reports)
- Nmap integration for self-scanning
- Network discovery tools integration (arp-scan, netdiscover, masscan, rustscan)
- Web vulnerability scanning with Nikto
- Comprehensive SMB enumeration (enum4linux, smbclient, smbmap)
- Service banner grabbing and protocol detection
- Advanced command-line options and verbose mode
- Future: Planning integration with more Kali tools and API endpoints
Made with ❤️ for the cybersecurity community
"Security is not a product, but a process." - Bruce Schneier