Kali Linux — The Pentest Distribution: Its Tools and How to Use Them

"nmap, Metasploit, Burp are all apt-get-installable on Ubuntu" — so why bother with Kali? The question is legitimate. What Kali is actually solving is not "having the tools"; it's everything around them.

• Coherent dependency stack — packaging that lets 600 tools coexist without conflict (Aircrack-ng / Metasploit / OpenVAS / Burp all running on the same Python / Ruby / Java)
• Wireless drivers and kernel — wireless NIC drivers with monitor mode / packet injection support are pre-patched into the kernel. On plain Ubuntu, you'd have to build them separately
• Tested version combinations — not the latest of each tool individually, but versions tested as a set (it's a rolling release, but there is a quality gate)
• Live boot + persistence — fully functional booted from USB, with encrypted USB persistence to carry evidence and working state
• Role-based metapackages — kali-tools-web / kali-tools-wireless / kali-tools-forensics give you bundles by use case
• Offline updates — even offline you can keep a local mirror of the repository

In short, Kali is an operational package that ships "what you need on a security engagement, ready to run." Building your own with the tools you want on the distro you like is a perfectly valid alternative, and experienced pentesters often deliberately roll their own setup on Arch / Ubuntu / NixOS.

Kali didn't appear out of nowhere; it's the modern continuation of an "offensive Linux live CD" lineage stretching back to the early 2000s.

"Kali has 600 tools" doesn't tell you when to use which. The mental model that works is: split a pentest into 6 phases and assign representative tools to each phase.

In practice phases rarely run linearly; you bounce back and forth all the time. After post-exploit you Recon internal hosts you just found; an Exploit failure sends you back to Vuln Analysis for more digging. Kali is built to minimise the friction of those round trips.

Kali's application menu is organised into 13 categories. From the perspective of "one tool a beginner should actually start with," the representatives are:

Bulk install via metapackages: kali-tools-web / kali-tools-wireless / kali-tools-forensics bring in everything you need per use case.

There are several reasons you shouldn't make Kali your daily-driver OS. The design is tuned for attackers and doesn't suit desktop or server use.

Kali's strength is that it runs anywhere. Pick the form that matches the engagement, the budget, and the legal boundary.

Kali is just a tool; what you point it at decides legal from illegal. In Japan the relevant law is the Unauthorized Computer Access Act, in the US the Computer Fraud and Abuse Act (CFAA), and in the EU the Cybercrime Convention — all of which criminalise attacking systems you do not have permission to attack.

Three settings in which Kali can be used legally:

1. Systems you own or administer — your home lab, your VPS, VMs in your own cloud account
2. Engagements with explicit written authorisation — Penetration Test contracts (with documented RoE), Bug Bounty (within HackerOne / Bugcrowd scope), or an internal audit done as part of your employment
3. Practice platforms intentionally built to be attacked — HackTheBox / TryHackMe / VulnHub / PortSwigger Web Security Academy / OverTheWire

OSCP (Offensive Security Certified Professional) is a 24-hour, 5-machine practical exam done on Kali, and the most-recognised pentest certification in the industry. The PEN-200 lab — its practice environment — is also Kali-based. OffSec's next-tier certifications, OSWE (Web Expert), OSEP (Evasion Expert), OSED (Exploit Developer), and OSWP (Wireless), are built around the same toolchain.

Kali isn't the only "offensive Linux." There is a mosaic of options, divided by goals and philosophy.

Kali Linux arrived in 2013 as the operational package "a Debian derivative that ships everything a pentest needs in a ready-to-run form," and OSCP-coupling plus OffSec's maintenance cemented it as the industry standard. What matters is not the fact that 600 tools are included, but the design philosophy underneath: "the tools you need across the 6 phases of security work coexist and work," "you can deploy it across wireless, live boot, mobile, container, and cloud," "you can run it as a resettable ephemeral environment."

What a beginner should first do is put Kali in a VM and solve 10 easy HackTheBox / TryHackMe machines. In doing that you will naturally pick up the 7-tool flow of nmap → gobuster → Burp → Metasploit → linpeas → john / hashcat. All-included does not mean use-everything — using 5–10 tools that fit your workflow deeply is far stronger than knowing 600 tools superficially.