Getting Started with Kali Linux: Setup, Tools, and Your First Scan

Every pen tester starts somewhere. Usually it's a laptop, a cup of coffee, and a fresh Kali Linux install that immediately breaks something because nobody read the docs first. This is where you start — the right way, with a legal home lab, a real toolchain, and a first scan you can actually understand instead of just copy-pasting commands you found in a forum.

What Is Kali Linux?

Kali Linux is a Debian-based distribution built specifically for penetration testing and security auditing. It ships with over 600 preinstalled tools covering everything from network reconnaissance to password cracking to wireless attacks, and it's maintained by Offensive Security, the same organization behind the OSCP certification.

Kali is not a toy, and it's not a magic hacking button. It's a toolbox. And like any toolbox, it's completely legal to own and use — what determines legality is what you point it at. Running these tools against systems you own, or systems you have explicit written authorization to test, is legitimate security work. Running them against anything else is a crime. This guide is about the former, exclusively.

Kali replaced BackTrack Linux back in 2013, and it's been rebuilt from the ground up with a rolling release model — meaning it's continuously updated rather than shipped in large, infrequent version jumps. That matters for security work specifically, because exploit code and tool signatures go stale fast, and a distribution that lags behind gets you tools that no longer match the vulnerabilities they were built to test.

3 Ways to Install Kali

Bare metal. Installing Kali directly onto a dedicated machine gives you the fastest performance and full access to hardware — critical for things like WiFi adapter attacks that need direct hardware control a virtual machine can't always provide. The tradeoff is that it takes over the whole machine and it's less forgiving if you misconfigure something.

VirtualBox or VMware virtual machine. This is the safest path for beginners. Kali runs isolated inside a VM on your existing operating system, so mistakes stay contained, you can snapshot your state before trying something risky, and you can tear it down and rebuild in minutes if you break it. Offensive Security even publishes ready-made VM images specifically for this.

WSL2 on Windows. The Windows Subsystem for Linux lets you run Kali directly inside Windows without a full VM. It's the fastest way to get a terminal running, but hardware access (like WiFi adapters for wireless attacks) is limited compared to a full VM or bare metal install.

For beginners, VirtualBox is the recommended starting point. It's free, it's isolated, it supports snapshots, and it's what most training material assumes you're using.

Whichever install path you choose, download Kali only from the official Offensive Security site. Third-party mirrors and "prebuilt" images floating around forums are a common vector for backdoored installs — you'd be handing an attacker root access to your own lab before you've run a single tool.

First Configuration Steps

Change the default credentials immediately. Older Kali images shipped with the username and password both set to kali — newer installers make you set a password during setup, but if you're using an older image or a pre-built VM, change it before doing anything else.

Update and upgrade right away. Kali's repositories move fast, and a fresh ISO can be weeks or months out of date by the time you install it.

Install VM guest tools. If you're running Kali in VirtualBox, install the Guest Additions; in VMware, install VMware Tools. This enables shared clipboard, better display scaling, and shared folders between host and guest — small things that save enormous friction.

Take a snapshot before you break anything. This is the single most valuable habit you can build. Snapshot your clean, updated install right now, before you install anything else or run a single tool. When — not if — you misconfigure something or a tool corrupts a config file, you roll back in seconds instead of reinstalling from scratch.

It's also worth setting up a non-root user for daily driving, even though modern Kali defaults to a standard user model rather than the old always-root setup. Running everything as root out of habit is how a single misconfigured script does real damage to your own system. Use sudo deliberately, for the commands that actually need elevated privileges.

Essential Tools Pre-Installed

Kali's toolbox is enormous, but a handful of tools cover the vast majority of real engagement work:

• Nmap — the standard network scanner, used to discover live hosts, open ports, running services, and versions.
• Burp Suite — the industry standard for web application testing, letting you intercept, inspect, and modify HTTP traffic between browser and server.
• Metasploit — an exploitation framework with a massive library of known exploits, payloads, and post-exploitation modules.
• Wireshark — a packet analysis tool for inspecting raw network traffic down to the byte level.
• Aircrack-ng — a suite for assessing WiFi network security, including handshake capture and password auditing.
• theHarvester — an OSINT tool that gathers emails, subdomains, hosts, and employee names from public sources.
• Nikto — a web server scanner that checks for outdated software, dangerous files, and common misconfigurations.

You don't need to master all 600+ tools before you're useful. Most real engagements lean heavily on a small, repeatable core — Nmap for discovery, Burp for anything web-facing, and Metasploit or manual exploitation for the systems that turn out to be vulnerable. Everything else gets pulled in as the specific engagement demands it.

Your First Legal Scan — Home Lab Setup

Never point these tools at a system you don't own or don't have written authorization to test. The correct way to practice is to build a deliberately vulnerable target inside your own isolated lab.

Set up a second VM running Metasploitable2 or DVWA (Damn Vulnerable Web Application) — both are intentionally vulnerable systems built for exactly this purpose. Put it on the same isolated virtual network as your Kali VM (a "host-only" or "internal" network in VirtualBox, not bridged to your real network), and now you have a legal, self-contained target to practice against.

Start with a basic Nmap scan to see what's running:

This tells you which ports are open, what services are listening, and often the exact version numbers — which is what you'd cross-reference against known vulnerabilities. Once you've identified a service, you can move into Metasploit to see whether a known exploit module exists for it:

This is the entire loop of penetration testing in miniature: scan, identify, research, exploit, document. Everything else you learn is a refinement of this same cycle.

After you gain access — even in a lab — get in the habit of documenting exactly what you did and why, the same way you would on a real client engagement. Note the command you ran, the output you got, and the conclusion you drew from it. This habit is what separates someone who can follow a walkthrough from someone who can actually produce a professional pentest report, which is the actual deliverable clients pay for. The exploitation is the easy part; clear, reproducible documentation is what gets you hired again.

Once Nmap and Metasploit feel familiar, add Wireshark into the loop. Run a capture while you scan or exploit your lab target, and actually look at what's crossing the wire — the handshake, the request headers, the payload delivery. Reading raw traffic builds an intuition that copy-pasting commands never will, and it's the skill that lets you troubleshoot when a tool doesn't behave the way a tutorial says it should.

What to Learn Next

TryHackMe is the best starting point for structured, guided practice — begin with the "Pre-Security" learning path before jumping into anything advanced. HackTheBox's "Starting Point" track picks up where TryHackMe leaves off, with slightly less hand-holding. And if you want a formal credential to back up the hands-on skills, the CompTIA PenTest+ roadmap gives you a structured curriculum that maps closely to real engagement methodology.

None of this replaces hours in the terminal. Install the VM tonight, take the snapshot, and run your first scan before you close the laptop.