Step 111. Installing Kali Linux — Setting Up the Attacker’s Workbench

Level 2 — Security Introduction and Attack Skill Basics | Difficulty ★★☆☆☆ | Estimated time: 2–3 hours (excluding download time)

Prerequisites: you’ve finished Step 16 (understanding virtualization) and Step 17 (creating VMs and snapshots). VirtualBox is installed and you’ve created and booted a VM. Internet connection required (image download, about 3–4GB).

What you need: a Windows PC, VirtualBox, an internet connection, 30GB+ of free disk space, 8GB+ RAM recommended.
Caution: ⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. Kali is an armory of powerful attack tools — from the moment you install it, where you point those tools is entirely your responsibility. The installation screens in this chapter are "Screen examples"; only the virtualization-check command was actually measured in the writing environment (2026-09-09).

Until now you’ve handled nmap, scripts, and wargame connections one at a time on "regular Linux." The actual working environment of penetration testers is a Linux where hundreds of these tools come pre-installed — Kali Linux. Today we install that workbench inside our lab. Rather than new concepts, "picking the official image" and "understanding the network defaults" are today’s core.

1. Learning Objectives

By the end of this chapter, you will be able to:

Explain what Kali Linux is and why it’s the security industry’s standard working environment
Choose and download the pre-built image for VirtualBox from kali.org
Register the image in VirtualBox, boot Kali, and change the default account
Tour Kali’s tool classification system (reconnaissance/vulnerability analysis/exploitation…)
Check on your own PC whether virtualization features (VT-x/AMD-V) are enabled

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	VirtualBox (host: Windows) + Kali Linux (guest)
Today’s commands	`systeminfo` (virtualization check, Windows); inside Kali: `nmap -V`, `msfconsole -v`, `passwd`
Concepts needed	Security-specialized distro, pre-built image vs installer ISO, tool classification system, NAT vs Host-only (concept)
Today’s artifact	1 bootable Kali VM + a "Kali clean state" snapshot

2-1. Kali Linux — Linux with Tools Pre-installed

Kali Linux is a Debian-family Linux distribution built for penetration testing and security assessment. The difference from a regular distro is simple — the tools you’ve learned so far and will learn ahead are all installed from the start. Hundreds of them: nmap, Metasploit, Burp Suite, Wireshark, John the Ripper, hashcat.

"Can’t I just install them one by one on Ubuntu?" — you can. But you’ll suffer version conflicts and dependency hell, and your environment will diverge from professional setups. Since Kali is the default environment for pentest certification exams, corporate red teams, and CTF players, using Kali is itself a way of matching the industry standard.

2-2. Installer ISO vs Pre-built Image

Kali.org’s download page has several kinds. Today we choose one of two:

Kind	Description	Time cost
Installer ISO	The regular installation disk, installed from scratch	Slow (installation process required)
Pre-built VM image	A whole virtual-disk file with installation already done	Fast — today’s choice

A pre-built image is a compressed "virtual disk containing an already-installed Kali." Just register it in VirtualBox and it boots immediately. Note that the VirtualBox and VMware versions are separate — you must pick the VirtualBox one. This is the first mistake point commonly seen in the writing environment.

2-3. The Tool Classification System — The Menu Is the Attack Sequence

Kali’s application menu classifies tools not alphabetically but in the order of attack phases:

Information Gathering — reconnaissance (nmap, etc.)
Vulnerability Analysis — vulnerability analysis
Web Application Analysis — web attacks
Exploitation Tools — exploitation (Metasploit, etc.)
Password Attacks — password attacks (John, hashcat)
Post Exploitation — post-compromise work

This classification is also this book’s Level 2 second-half syllabus. Just touring the menu teaches you "in what order a real penetration test proceeds."

2-4. Network Defaults — Why NAT Is Safe

VirtualBox’s default VM network is NAT (review Step 16). The VM can reach out to the internet, but other devices on your home network can’t connect directly into the VM. Right after installing Kali you’ll need updates, so this default fits.

Later, when we add a target VM (Metasploitable2) to the lab, we’ll use a Host-only network — a fully isolated virtual LAN that works only inside your PC. For today, remember just one line: "NAT = can go out, can’t be entered / Host-only = communicates only inside my PC, internet blocked."

3. Follow Along

3-1. Checking Virtualization — Pre-installation Inspection

Before creating the VM, confirm this PC is ready to run virtualization. In Windows Command Prompt or Git Bash:

Input (Windows)

systeminfo | findstr /i "Hyper-V"

Output (measured 2026-09-09):

Hyper-V Requirements:          A hypervisor has been detected. Features required for Hyper-V will not be displayed.

How to read it: this "a hypervisor has been detected" message means virtualization features (VT-x/AMD-V) are already enabled on this PC and a hypervisor is running (PCs using WSL2 are always in this state). If this item instead says "Virtualization … Disabled In Firmware," you must enable it in BIOS/UEFI as in Step 16, section 3-4.

For reference, on a PC with WSL installed, wsl -l -v shows the Linuxes already running on top of virtualization (measured 2026-09-09):

  NAME                   STATE           VERSION
* Codex-Security-Lab     Running         2

VERSION 2 means WSL2 — running on hardware virtualization — another piece of evidence that virtualization is enabled.

3-2. Downloading the Official Image

Type kali.org directly into your browser’s address bar (avoid fake sites in search ads — review the Step 16 habit)
Go to Get Kali → the Virtual Machines section
Select the 64-bit image for VirtualBox and download (a compressed file, about 3–4GB)

Screen example — the download item is named roughly like this:

kali-linux-2025.x-virtualbox-amd64.7z

Important: the filename must contain virtualbox. If you download one marked vmware, VirtualBox can’t open it. The download page also lists a checksum (SHA256) — the habit of verifying a downloaded file isn’t corrupted is a security basic:

Input (Windows PowerShell; output is a Screen example)

Get-FileHash .\kali-linux-2025.x-virtualbox-amd64.7z -Algorithm SHA256

Algorithm       Hash
---------       ----
SHA256          3F1A... (compare with the value on the download page)

How to read it: if the printed hash differs from the value on the kali.org page by even one character, the file is corrupted or tampered with — discard it and download again.

3-3. Registering in VirtualBox

Extract the downloaded archive (7-Zip required) and you’ll get a .vbox file and a .vdi virtual disk.

Extract (right-click → 7-Zip → Extract here)
Double-click the .vbox file in the extracted folder → the VM is automatically registered in VirtualBox
Select the registered VM and check memory in Settings — 4096MB (4GB) recommended, 2048MB minimum
Confirm the network is NAT (leave it if it’s the default)

Screen example — the VirtualBox Manager list:

Oracle VM VirtualBox Manager
├── (existing VMs...)
└── kali-linux-2025.x-virtualbox-amd64   ← newly registered
    Powered off / Memory 4096MB / NAT

3-4. First Boot and Changing the Default Account

Start the VM and a login screen appears. The pre-built image’s default account is public:

Username: kali / Password: kali

The very first thing to do after logging in is change the password. The default credentials are values the whole world knows, so they must not be left as-is.

Input (Kali terminal)

passwd

Screen example:

Changing password for kali.
Current password: (enter kali)
New password: (new password)
Retype new password: (enter again)
passwd: password updated successfully

How to read it: Linux displays nothing on screen while you type a password. The cursor doesn’t move, but input is being registered — don’t be alarmed (same as you learned in Step 17).

3-5. Tool Check — Confirming Familiar Faces

In the terminal, confirm the tools we know are really there.

Input (inside Kali)

nmap -V
msfconsole -v
which wireshark john hashcat burpsuite

Output example (not run — the writing environment has no Kali; compare with your screen):

Nmap version 7.95 ( https://nmap.org )
Framework: 6.4.x
/usr/bin/wireshark
/usr/bin/john
/usr/bin/hashcat
/usr/bin/burpsuite

How to read it: if paths and versions print for everything, the armory came in properly. The nmap you installed yourself on WSL in Step 81 comes pre-loaded here from the start. Open the application menu (the Kali logo at top left) and tour whether the 2-3 classification system — Information Gathering, Vulnerability Analysis, Exploitation Tools — is really there.

3-6. Snapshot — "Kali Clean State"

Take a snapshot before touching any more settings (review Step 17).

Shut Kali down cleanly (sudo poweroff or shutdown from the menu)
In VirtualBox Manager, select Kali → Snapshots tab → Take
Name: Kali clean state / Description: right after install, password changed

Why: from now on you’ll run all kinds of experiments on this Kali. If tool settings get tangled or the system breaks, this snapshot brings you back in seconds. "Snapshot before experimenting" is a habit that runs through this entire book.

4. Missions & Exercises

Mission — Kali Adoption Report

After finishing the Kali installation, write a short report:

The exact filename of the downloaded image, and whether you verified the checksum
VM specs record: memory, CPU count, network mode (check in the VirtualBox settings screen)
Whether the password change is complete (quote one line of the passwd result message)
Quote the first line of nmap -V output
The snapshot’s name and the time it was taken
One final line: "targets I may attack from this Kali / targets I must never attack"

How to verify yourself: if item 6 is written, you’re done. This document pairs with Step 16’s lab design document as a rules document.

Exercises

Exercise 1. Give two reasons for using Kali as a whole distribution rather than "installing tools one by one on Ubuntu."

Exercise 2. Explain the difference between a pre-built image and an installer ISO, and state which suits a beginner and why.

Exercise 3. Explain why the pre-built image’s default account (kali/kali) must not be left as-is, connecting it to the fact that this VM sits on a NAT network.

Exercise 4. Explain the significance of Kali’s tool menu being classified by phase order (recon → analysis → exploitation → post) instead of alphabetically.

5. Model Answers & Completion Criteria

Mission Model Answer

Report example (for format reference — filenames/versions vary by download date):

[Kali Adoption Report]
1. Image: kali-linux-2025.x-virtualbox-amd64.7z
   Checksum: Get-FileHash result confirmed to match kali.org's SHA256
2. VM specs: memory 4096MB / 2 CPUs / network NAT (default)
3. Password: changed — "passwd: password updated successfully"
4. Tools: "Nmap version 7.95 ( https://nmap.org )"
5. Snapshot: "Kali clean state" (installed 2026-09-XX)
6. Rule: from this Kali I attack only my lab's target VMs and
   legal wargame platforms. I never scan or attack any system outside the lab.

How to verify: ① is checksum verification recorded? ② is the network mode stated? ③ are the forbidden targets in item 6 specific? Those three make it complete.

Exercise Answers

Answer 1. First, the distro’s makers have pre-resolved dependencies and version conflicts, guaranteeing a "ready out of the box" state. Second, it’s the de facto standard environment for certification exams, corporate red teams, and CTFs, so on Kali the screens and paths in all kinds of documents and tutorials match exactly.

Answer 2. An installer ISO has you run the installation program yourself, choosing partitions, language, and packages; a pre-built image is a whole virtual disk with installation finished, requiring only registration. For beginners, pre-built is suitable — it skips the variables that can arise during installation and takes you straight to today’s goal of "using Kali."

Answer 3. The default credentials are public values everyone knows. Under NAT, direct connections from outside are blocked, but the moment a target VM is added inside the lab, another VM on the same virtual network (or someone observing the lab) could get in with the default password. Above all, the habit of "not changing defaults" is itself the number-one cause of security incidents. The first action on any new equipment is always changing the default credentials.

Answer 4. Because the menu classification is itself the standard procedure of a penetration test (recon → vulnerability analysis → exploitation → privilege escalation/post). It’s designed so that the act of choosing a tool becomes training in realizing "which phase of the process am I in right now," and a beginner can learn the professional flow just by following the menu.

Completion Criteria Checklist

[ ] I confirmed virtualization is enabled with systeminfo (or wsl -l -v)
[ ] I downloaded the pre-built image for VirtualBox from kali.org
[ ] I verified the checksum (SHA256)
[ ] The Kali VM boots and I can log in
[ ] I changed the default password with passwd
[ ] I confirmed major tools run, like nmap -V
[ ] I took the "Kali clean state" snapshot
[ ] Mission: I wrote the Kali adoption report

6. Common Pitfalls & Fixes

Wall 1. I accidentally downloaded the VMware image

Symptom: VirtualBox can’t open the downloaded file.
Cause: pre-built images are built separately per virtualization software. If the filename contains vmware, it’s VMware-only.
Fix: recheck the VirtualBox tab/item on the download page and download again. Whether virtualbox is in the filename is the verification point.

Wall 2. The VM won’t create as 64-bit, or throws a start error

Symptom: errors like "VT-x is not available" or "AMD-V is disabled" (same as Step 16’s Wall 3).
Cause: CPU virtualization is disabled in BIOS/UEFI.
Fix: check first with 3-1’s systeminfo. If disabled, reboot and enter BIOS with Del/F2, then set Intel VT-x / AMD-V to Enabled. Its location varies by manufacturer, so search "your laptop maker + enable virtualization."

Wall 3. The archive won’t extract (.7z file)

Symptom: Windows’ built-in extraction doesn’t recognize .7z.
Cause: the Kali image is compressed in 7-Zip format.
Fix: install the free program 7-Zip (official site 7-zip.org), then right-click → 7-Zip → Extract here. It’s large, so a few minutes is normal.

Wall 4. Kali is heavy and laggy

Symptom: it booted, but screen response is slow.
Cause: memory/CPU allocation is small, or the host lacks headroom.
Fix: within Step 16’s "half of the host or less" rule, raise memory to 4096MB and assign 2 CPUs. If it’s still too heavy, reduce graphical effects after boot, or opt for a lighter usage style (terminal-centric). For reference, Kali’s default desktop is already the fairly light Xfce.

Wall 5. I want to log in as root

Symptom: older materials tell you to log in as root/toor.
Cause: old Kali (before 2020) defaulted to root, but current Kali switched to a regular user kali + sudo model.
Fix: don’t follow old materials. Log in as kali and prepend sudo for admin work. The habit of living daily life as root creates an environment where one mistake strikes the whole system — the same principle you learned with Ubuntu (Step 24).

7. Summary

Today’s Concepts

Concept	One-line explanation
Kali Linux	A security-specialized distro with hundreds of pentest tools pre-installed
Pre-built image	A whole virtual-disk file with installation done — boots with just registration
Checksum (SHA256)	A fingerprint verifying a downloaded file is untampered and uncorrupted
Tool classification system	Recon → analysis → exploitation → post, a menu in attack-phase order
NAT / Host-only	Can go out but can’t be entered / an isolated LAN communicating only inside my PC

Today’s Commands

Command	What it does
`systeminfo` (Windows)	Check whether virtualization is enabled via the Hyper-V item
`Get-FileHash -Algorithm SHA256` (PowerShell)	Verify a downloaded file’s checksum
`passwd` (Kali)	Change the default password — the first action after install
`nmap -V`, `msfconsole -v`	Confirm major tools exist and their versions
`sudo poweroff`	Clean shutdown (before snapshot)

An Instinct More Important Than Commands

Today you’ve taken the attacker’s workbench into your hands. The "flood of tools" you feel when first opening Kali’s menu is the map of this book’s second half — don’t be overwhelmed. You just learn them one by one, and we already know how to use some of them (nmap, ssh, nc).

Simultaneously, remember this — this workbench can be pointed anywhere, but where it may be pointed is fixed. My lab and legal platforms. That boundary is drawn not by the tool but by you, and you’ve already drawn it with item 6 of the mission. Now that the workbench exists, what remains is a safe target — and an isolated firing range connecting the two.

Once every box is checked, Step 111 is complete. Click the checkbox in the sidebar to save your progress.