Kali Linux Docker + Claude Skill

Token-Efficient Pentesting System for Claude Code

🎯 Overview

This project provides a comprehensive Kali Linux Docker container with 200+ pentesting tools, optimized for use with Claude Code through a custom skill. By using direct command execution instead of MCP protocol, this system achieves 70% token efficiency compared to traditional MCP server approaches.

🏗️ Architecture

┌─────────────────────────────────────────────────────────┐
│                    Claude Code                          │
│                                                         │
│  ┌──────────────────────────────────────────────────┐   │
│  │           kali-docker-pentesting skill           │   │
│  │  (Tool catalog + usage patterns)                 │   │
│  └──────────────────────────────────────────────────┘   │
│                         │                               │
│                         ▼                               │
│  ┌──────────────────────────────────────────────────┐   │
│  │              bash_tool                           │   │
│  │  (Direct docker exec commands)                   │   │
│  └──────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────┘
                         │
                         ▼
┌─────────────────────────────────────────────────────────┐
│            Kali Linux Docker Container                  │
│                                                         │
│  • 200+ pentesting tools                                │
│  • No MCP server overhead                               │
│  • Direct command execution                             │
│  • Persistent storage via volumes                       │
└─────────────────────────────────────────────────────────┘

📦 What’s Included

Docker Container

• Base: Kali Linux Rolling (kept current via in-place apt full-upgrade — see Updating)
• Tools: 200+ pentesting tools
  • Network scanners (nmap, masscan, zmap)
  • Web app testing (nikto, sqlmap, burp suite)
  • Password cracking (john, hashcat, hydra)
  • Wireless tools (aircrack-ng, wifite, reaver)
  • Forensics (volatility, binwalk, foremost)
  • Exploitation (metasploit, SET, beef)
  • LLM / prompt-injection testing (garak, promptmap2, promptfoo, PyRIT, agentic-radar) — see below
  • And much more!

LLM / Prompt-Injection Testing

For assessing LLM-backed applications (chatbots, RAG, AI agents) against prompt injection, jailbreaks, and data leakage — mapped to the OWASP Top 10 for LLM Applications and MITRE ATLAS:

These test a target LLM over the network and most also use a judge LLM — pass API keys at runtime via --env-file / -e (never bake keys into the image). Isolated from system Python via pipx and dedicated venvs. See SKILL.md for usage.

Claude Skill

• Complete tool catalog
• Usage examples for every tool
• Common pentesting workflows
• Troubleshooting guides
• Best practices

Supporting Files

• Dockerfile-kali-simple - Simplified container (no MCP)
• docker-compose-kali.yml - Easy container management
• SKILL.md - Claude skill documentation
• QUICK-START.md - Quick start guide

🚀 Quick Start

1. Build Container

# Clone or create project directory
mkdir kali-docker-pentest && cd kali-docker-pentest

# Copy files
# - Dockerfile-kali-simple (rename to Dockerfile)
# - docker-compose-kali.yml (rename to docker-compose.yml)

# Build
docker-compose build

2. Install Skill

# Copy skill to Claude skills directory
mkdir -p /mnt/skills/user/kali-docker-pentesting/
cp SKILL.md /mnt/skills/user/kali-docker-pentesting/

3. Start Container

docker-compose up -d

4. Test

docker exec kali-pentest nmap --version

💡 Usage Examples

With Claude Code

Simply ask Claude naturally:

You: "Scan 192.168.1.1 with nmap"
Claude: [Executes] docker exec kali-pentest nmap -sV 192.168.1.1

You: "Test http://testsite.local for SQL injection"
Claude: [Executes] docker exec kali-pentest sqlmap -u "http://testsite.local" --batch

You: "Crack these password hashes using rockyou"
Claude: [Executes workflow with john/hashcat]

Direct Command Line

# Network scanning
docker exec kali-pentest nmap -sV 192.168.1.0/24

# Web testing
docker exec kali-pentest nikto -h http://target.com

# Password cracking
docker exec kali-pentest john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# Interactive shell
docker exec -it kali-pentest /bin/bash

📊 Token Efficiency

Traditional MCP Server Approach

• Load MCP server: ~500 tokens
• JSON-RPC protocol: ~300 tokens
• Tool discovery: ~200 tokens
• Response formatting: ~200 tokens
• Total: ~1,200 tokens per interaction

This Approach (Skill + Direct Execution)

• Read skill: ~100 tokens
• Direct command: ~50 tokens
• Raw output: ~200 tokens
• Total: ~350 tokens per interaction

Result: 70% token savings! 🎉

📁 Project Structure

kali-docker-pentest/
├── Dockerfile                  # Container definition
├── docker-compose.yml         # Container orchestration
├── SKILL.md                   # Claude skill
├── QUICK-START.md            # Quick start guide
├── README.md                 # This file
├── workspace/                # Working files
├── results/                  # Scan outputs
├── wordlists/               # Custom wordlists
└── tools/                   # Additional tools

🔄 Updating the Container

Kali is a rolling release — keep the container current by upgrading packages in place rather than rebuilding (which would re-download the entire 27 GB+ toolset):

# 1. Back up the current image first (instant, enables rollback)
docker tag kali-comprehensive:latest kali-comprehensive:backup-$(date +%Y-%m-%d)

# 2. Full-upgrade inside the running container (non-interactive, keep existing configs)
docker exec kali-pentest bash -c \
  'export DEBIAN_FRONTEND=noninteractive; apt-get update && \
   apt-get -y -o Dpkg::Options::="--force-confold" full-upgrade && \
   apt-get -y autoremove && apt-get clean'

# 3. Persist the upgraded state back into the image
docker commit kali-pentest kali-comprehensive:latest

Roll back a bad upgrade with docker tag kali-comprehensive:backup-YYYY-MM-DD kali-comprehensive:latest.

Mirror tip: if http.kali.org is slow or drops connections, point the container’s /etc/apt/sources.list at the Cloudflare CDN: deb http://kali.download/kali kali-rolling main contrib non-free non-free-firmware.

A full clean rebuild (docker compose build) remains available when you want a fresh, smaller image from the newest base.

⚠️ Legal Notice

IMPORTANT: This toolset is for authorized security testing only.

• Always obtain written permission
• Test only systems you own or have authorization to test
• Follow responsible disclosure practices
• Comply with local laws and regulations
• Use ethically and legally

Unauthorized access to computer systems is illegal. The authors assume no liability for misuse of this software.

📚 Documentation

• QUICK-START.md - Comprehensive getting started guide
• SKILL.md - Complete tool catalog and usage
• Kali Docs - Official Kali documentation

---

Happy (ethical) hacking! 🛡️