Install Kali Linux

Kali is the security-focused Linux distribution most professionals learn on. It comes pre-loaded with hundreds of security tools — Nmap, Burp Suite, Metasploit, Wireshark, John the Ripper, and more — all ready to use. In this lesson you'll add it as a VM inside VirtualBox.

Two ways to install (pick the easy one)

There are two paths:

• Pre-built VirtualBox image (recommended for beginners). Download a Kali VM someone else already built, import it, done. About 15 minutes.
• ISO from scratch. Download an installer ISO, create an empty VM, walk through the installer. About 40 minutes. Useful later for practice; skip for now.

We'll do the pre-built image.

Step 1 — Download the Kali VirtualBox image

1. Go to kali.org/get-kali/#kali-virtual-machines.
2. Choose Kali Linux VirtualBox 64-bit (or 32-bit if you're on very old hardware).
3. Download the file. It's ~3–4 GB — grab a drink.

You'll also see a SHA256 hash on the download page. This is a fingerprint that proves the file wasn't tampered with. We use hashes constantly in security — first taste right here.

# Verify the download matches Kali's published hash:
# On Linux / macOS:
shasum -a 256 kali-linux-*.7z

# On Windows PowerShell:
Get-FileHash kali-linux-*.7z -Algorithm SHA256

Compare the output to the hash on kali.org. Match = good file. Mismatch = re-download.

If an attacker replaced the file on a mirror with a malicious one, the hash would be different. Verifying hashes is a cheap habit that has caught real supply-chain attacks. Do it every time you download tools.

Step 2 — Extract the archive

The download is a .7z archive. Extract it with 7-Zip (Windows), The Unarchiver (Mac), or 7z x kali-linux-*.7z on Linux.

Inside you'll find a folder with .vbox and .vmdk files — that's the pre-built VM.

Step 3 — Import into VirtualBox

1. Open VirtualBox.
2. Double-click the .vbox file (or Machine → Add in VirtualBox and select it).
3. The Kali VM appears in your list.
4. Before starting it, click Settings and adjust:
   • System → Base Memory: 4096 MB minimum (2048 works but sluggish). More = smoother.
   • System → Processor: 2 CPUs minimum.
   • Display → Video Memory: 128 MB.
   • Network → Adapter 1: for now leave as NAT — it gets internet without exposing your host.

Click OK and start the VM.

Step 4 — Log in

Default credentials for the pre-built image are:

Username: kali
Password: kali

Change the password immediately with the passwd command after logging in (next lesson).

[Your first Kali desktop]

You should see the Kali desktop — a dark theme, a menu with dozens of security tools, and a terminal you can open. Congratulations: you now own a hacker's workstation.

Step 5 — First updates

Open a terminal (top-left menu, or Ctrl+Alt+T) and run:

# Update package lists and install updates
sudo apt update && sudo apt upgrade -y

You'll be asked for your password (the one you'll change next lesson). This takes 10–30 minutes on first run. Do it, get coffee.

Common install issues

A quick tour of what's already installed

Kali ships with hundreds of tools pre-installed, organized into categories accessible from its applications menu — worth a brief browse now, even though you won't use most of them for a while:

• Information Gathering — recon tools (Path 14), including nmap, theHarvester.
• Web Application Analysis — Burp Suite, sqlmap (Path 11).
• Password Attacks — hashcat, john (referenced in Path 06's crypto material).
• Exploitation Tools — Metasploit Framework (Path 14).
• Sniffing & Spoofing — Wireshark (Path 12).
• Forensics — Autopsy, Volatility (Path 16's DFIR lab).

You'll formally meet most of these tools by name throughout the rest of this course — this browse is just so the menu feels familiar rather than overwhelming the first time you actually need something from it.

Older Kali versions ran everything as root by default — a convenient but genuinely risky default, since any tool you ran (or any mistake you made) had full system privileges automatically. Modern Kali defaults to a standard, non-root kali user instead, requiring explicit sudo for privileged actions — directly applying the principle of least privilege from Path 00's fundamentals, now to your own primary security workstation.

Alternative — Kali in Docker or WSL

For lighter footprints:

• Kali in WSL: wsl --install -d kali-linux on Windows — command-line only, no GUI, but very fast.
• Kali in Docker: docker run -it --rm kalilinux/kali-rolling — a throwaway Kali container in seconds.

Both are useful supplements to a real VM, not full replacements. Some tools need the VM's graphical apps (Burp, Wireshark).

🧪 Lab — Take your first snapshot

Snapshots are your safety net. Take one right now before you touch anything.

1. Shut down the VM cleanly (top-left menu → Power Off).
2. In VirtualBox Manager, select Kali → click the Snapshots button (top right).
3. Click Take and name it fresh-install.

Now if you ever break Kali beyond repair, you can restore this snapshot in seconds. We'll use snapshots deliberately in the next lesson.

What single command updates the package lists and applies all available updates in Kali?

Key terms

• Kali Linux — Debian-based security distro pre-loaded with tools.
• VirtualBox image (OVA/VMDK) — pre-built VM you import instead of installing.
• SHA256 hash — fingerprint proving a file wasn't tampered with.
• Snapshot — a saved VM state you can restore.
• Guest Additions — VirtualBox add-ons for smooth display, clipboard, and shared folders.

Recap

• Download the pre-built Kali VirtualBox image; verify its SHA256 hash.
• Import into VirtualBox, give it 4 GB RAM and 2 CPUs.
• Default login is kali / kali — change immediately.
• Update everything with sudo apt update && sudo apt upgrade -y.
• Take a fresh-install snapshot before touching anything.

References

• Kali VM images — official downloads.
• Kali Docs — installation help and tips.
• Guest Additions guide — install for smooth VM experience.
• Kali tools list — every pre-installed tool with docs.

Next up → Snapshots & lab safety