Kali Linux is a Linux distribution built for security testing: it comes with several hundred testing tools already packaged, sorted by the job they do, so you can start checking a system the day you boot it. You can run it without touching your laptop's own operating system, but it only helps if you already know what you are looking for.
What Kali Linux is
Kali is an open-source distribution based on Debian, one of the oldest Linux distributions still in use. Underneath, it behaves like any Debian system, with the same apt package manager and the same file layout. If you run cat /etc/os-release on Kali, the ID_LIKE=debian line says as much.
It started life as BackTrack Linux and is now one of OffSec's community projects. It is a rolling distribution, so updates ship as soon as they are ready, and the team also publishes a tested 'point release' image every quarter for people who want a fixed starting point.
What makes it Kali rather than plain Debian is the set of choices made for penetration testing, which is the practice of attacking a system with permission to find its weak spots before someone else does:
- Network services are off by default. Installing a tool that ships a server does not quietly open a port on your machine.
- The kernel is patched for wireless injection, which some Wi-Fi testing tools need.
- The package sources are few and trusted. A small team builds and signs the packages, and the set of upstream repositories is kept to a minimum.
That last point has a cost. Kali is not meant to be a general-purpose desktop, and its own documentation says so. Adding random third-party repositories or PPAs to get everyday software is a common way to break an install. For coding, gaming or learning Linux itself, a mainstream distribution is the better choice, and Kali can live alongside it.
Why the tools come pre-packaged
You can install most security tools on any Linux machine. The trouble is doing it for dozens of them, each with its own dependencies and install steps, some of which conflict. Kali does that work once, tests the packages together, and keeps them updated through apt.
The tools are grouped into metapackages. A metapackage contains no software of its own; it is a list of dependencies, so installing it pulls in a whole set of tools at once. kali-linux-default is the set the standard desktop images include, kali-linux-large is the older default set, and kali-linux-everything installs every tool Kali packages.
The kali-tools-* metapackages split the same tools by job, which is how the 'sorted by job' idea works in practice. Here is the full list on a Kali machine:
A few examples: kali-tools-information-gathering for reconnaissance and finding out what is on a network, kali-tools-web for testing web applications, kali-tools-passwords for password cracking, kali-tools-forensics for investigating a system after the fact, and kali-tools-reporting for writing up what you found. If you only test web apps, you can start from a small install and add kali-tools-web with sudo apt install kali-tools-web, rather than carrying hundreds of tools you will never open.
Ways to run Kali
You do not have to replace your operating system to use Kali. The official download page offers several forms, and each trades convenience against access to the hardware.
Live USB
Write the image to a USB stick and boot from it. Kali runs from the stick and leaves the computer's own disk untouched, while still talking to the real hardware, such as the built-in Wi-Fi card. The cost is speed when there is a lot of disk activity, since everything runs from the stick.
Virtual machine
Kali publishes ready-made images for VMware and VirtualBox. A virtual machine keeps Kali isolated from your main system, and snapshots let you roll back after an experiment goes wrong. The trade-off is limited direct access to hardware, which matters for wireless testing, and higher memory and CPU needs, since two operating systems share one machine. Kali's own advice for a first install is to start in a virtual machine and move to real hardware once you are comfortable.
Container
With Docker or LXD you can pull a Kali image and get at the tools in seconds, without the overhead of a whole virtual machine. A container only gives you Kali's userland: the programs, not Kali's patched kernel, and no direct hardware access. For running a scanner against a test server, that is often all you need. The Docker video explains what a container is.
The other options
There are also installer images for running Kali directly on a disk, ARM images for single-board computers, cloud images, Kali NetHunter for Android phones, and Kali for the Windows Subsystem for Linux. WSL, like a container, gives you the tools but not Kali's kernel or direct hardware access.
As a rule of thumb: use a virtual machine to learn, a container for quick one-off tools, and a live USB or a proper install when you need the hardware itself.
A worked example: scanning your own server
Say you run a small online shop on one server you control, and it should answer on the web and nothing else. To check what it exposes, you point Nmap, one of the tools Kali ships, at it.
Nmap is a port scanner. A port is a numbered door on a machine that a program can listen behind: web servers usually listen on 80 and 443, and PostgreSQL databases on 5432. By default, nmap tuna-shop probes the 1,000 most common TCP ports on the host and reports the ones that answer.
The first scan shows two open ports, 80 for the web server and 5432 for PostgreSQL. After the database port is closed, a second scan shows only port 80:
Reading the first result:
80/tcp open httpis expected. 'Open' means a program is accepting connections on that port, and the shop's web server should be.5432/tcp open postgresqlis the problem. The database only needs to talk to the shop's own code, yet anyone who can reach the server can now try to log in to it, and every open port is a way in for an attacker.- 'Not shown: 998 closed tcp ports' means those ports answered Nmap's probe but nothing was listening behind them.
The fix happens on the server, not in Kali: tell PostgreSQL to listen only on the local machine, or block port 5432 with a firewall, whichever suits your setup. Then you scan again. The second result is the one you want: port 80 open and the other 999 closed.
That re-scan is the step people skip, and without it you are only assuming the fix worked.
Two details limit how far you can trust the result. The SERVICE column is Nmap's guess from the port number unless you ask it to probe further with -sV, so a database on an unusual port could be mislabelled. And port states depend on where you scan from: a port that is open from inside your network may show as filtered from the internet, because a firewall drops the probes. Scan from where an attacker would stand as well as from inside.
Kali is not a hack button
Kali makes the tools easy to get. It does not make them easy to use well. Nmap told you port 5432 was open; it did not tell you that a database should never face the internet, or how to close it. That judgement comes from knowing how networks and the services on them work, which is why Kali's documentation assumes you already know Linux, and why it pays to learn the basics of security testing first.
The other limit is permission. Only test systems you own, or ones you have written permission to test, with an agreed scope. Kali's documentation warns that using these tools without specific authorisation can cause real damage and carry personal and legal consequences. Scanning someone else's server 'just to see' counts.
For practice, you have plenty of safe targets: your own virtual machines, a deliberately vulnerable app running in a container on your laptop, or the kali-linux-labs metapackage, which installs environments built for learning and practising on.
Common mistakes
- Using Kali as an everyday desktop: it is built for testing, and adding unrelated repositories to make it one tends to break it.
- Installing everything at once:
kali-linux-everythingis large, so start small and add thekali-tools-*groups you need. - Trusting one clean scan: a scan only shows what is reachable from where you ran it, and only on the ports you scanned.
- Scanning without permission: test your own systems, or get written permission first.
Key takeaways
- Kali Linux is a Debian-based distribution from OffSec with several hundred security tools packaged and grouped into metapackages by job.
- You can run it from a USB stick, a virtual machine, a container or WSL, without installing it over your main system.
- Nmap lists the open ports on a host; each open port is a door to justify, close or protect, and you scan again after a fix.
- The tools only know what you know: interpreting results takes an understanding of networks and services.
- Only test what you own or have written permission to test.
