kali-suite Monorepo

Legal Notice: This repository and all included services are provided strictly for defensive security research and education on assets you own or have explicit written authorization to test. Do not deploy or use these tools against networks or data without permission.

Overview

kali-suite is a monorepo that packages eight lab-oriented, defensive services for analyzing pre-collected security artifacts. Each service is isolated, Docker-ready, and deployable to Render via the supplied Blueprint. All tooling operates in read-only or dry-run modes by default—no active or unauthorized scanning is performed.

Repository Layout

.
├── README.md
├── render.yaml
├── docker-compose.yaml
├── .gitignore
├── scripts/
│   └── local_build.sh
└── services/
    ├── nmap-report/
    ├── pcap-explorer/
    ├── lab-deployer/
    ├── recon-pipeline/
    ├── siem-adapter/
    ├── vuln-ticketer/
    ├── teaching-notebook/
    └── gui-wrapper/

Each service folder contains an application, container configuration, requirements, and service-specific README with legal and operational guidance.

Quickstart

Local Development

1. Ensure Docker and Docker Compose are installed.

2. Execute the bundled helper script:

   ./scripts/local_build.sh

   This builds all service images and runs the suite via docker compose. Source folders are mounted for live editing.

3. Visit the service endpoints (default network kali_suite_net) at the ports defined in docker-compose.yaml.

To stop the stack:

docker compose down

Deploy to Render

1. Push this repository to your own GitHub account.
2. In Render, create a new Blueprint and point it at the repo.
3. Review and adjust environment variables for services requiring secrets:
   • siem-adapter: WEBHOOK_URL, DRY_RUN
   • vuln-ticketer: GITHUB_TOKEN, DRY_RUN
4. Deploy the Blueprint; Render will provision each Docker-based web service using the respective folders.

Safety Defaults

All services operate in simulated or dry-run mode unless explicitly configured otherwise:

• siem-adapter posts to webhooks only when DRY_RUN=false and WEBHOOK_URL is provided.
• vuln-ticketer only creates live GitHub issues when DRY_RUN=false and a valid GITHUB_TOKEN is supplied; otherwise it writes to a local JSON ticket log.
• lab-deployer produces offline Vagrant/Ansible bundles and never launches VMs on the server.
• Artifact-processing services (nmap-report, pcap-explorer, recon-pipeline) accept pre-generated files and merely parse, normalize, or visualize them.

Always confirm that uploaded files and lab deployments belong to environments you are authorized to inspect.

Contributing

Contributions should maintain the defensive, authorization-first philosophy of this suite. Do not add functionality that initiates network scans or offensive actions.