Study guide
3.1 Downloading and Verifying a Kali ISO
Kali Linux Certified Professional KLCP
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current Exam Facts 1.2 How to Use This Guide & Study Strategy 1.3 PEN-103 Syllabus & Study Path
2 About Kali Linux
2.1 A Bit of History: From BackTrack to Kali 2.2 Kali's Relationship with Debian 2.3 Purpose and Use Cases 2.4 Main Features and Design Policies
3 Getting Started with Kali Linux
3.1 Downloading and Verifying a Kali ISO 3.2 Booting Kali in Live Mode 3.3 Installation Options Overview 3.4 Troubleshooting Installations
4 Linux Fundamentals
4.1 What Linux Is and What It Does 4.2 The Command Line 4.3 The Filesystem Hierarchy Standard 4.4 Useful Commands: Files, Search, Environment
5 Permissions and Process Management
5.1 File Permissions and Ownership 5.2 Managing Processes 5.3 Shells, Variables, and the Environment
6 Installing Kali Linux
6.1 Minimal Installation Requirements 6.2 Step-by-Step Installation on a Hard Drive 6.3 Unattended Installations with Preseeding 6.4 ARM Installations
7 Configuring the Network, Users, and SSH
7.1 Configuring the Network 7.2 Managing Unix Users and Groups 7.3 Configuring SSH
8 Configuring Services
8.1 Apache Web Server 8.2 PostgreSQL Database 8.3 Managing Services with systemd
9 Helping Yourself and Getting Help
9.1 Documentation Sources 9.2 Kali Linux Communities 9.3 Filing Good Bug Reports
10 Security Policy and Network Services
10.1 Defining a Security Policy 10.2 Possible Security Measures 10.3 Securing Network Services
11 Firewalling and Monitoring
11.1 Netfilter and iptables Behavior 11.2 Writing iptables Rules and NAT 11.3 Monitoring and Logging
12 Debian Package Management: APT
12.1 Introduction to APT 12.2 The sources.list File 12.3 Kali Repositories 12.4 Basic Package Interaction with apt
13 dpkg and Advanced Package Management
13.1 dpkg Fundamentals 13.2 Inspecting .deb Files and Package State 13.3 Maintainer Scripts and Conffiles 13.4 APT Pinning and Package Authenticity
14 Advanced Usage
14.1 Modifying and Rebuilding Kali Packages 14.2 Recompiling the Kernel 14.3 Building Custom Kali Live ISO Images 14.4 USB Persistence with LUKS Encryption
15 Kali Linux in the Enterprise
15.1 Network Installation with PXE Boot 15.2 Configuration Management with SaltStack 15.3 Metapackages and Custom Repositories 15.4 Configuration Packages and Forking
16 Introduction to Security Assessments
16.1 Kali Linux in an Assessment 16.2 Types of Assessments 16.3 Types of Attacks 16.4 Formalization and the Road Ahead
3.1 Downloading and Verifying a Kali ISO
Key Takeaways Explain This Topic AI
The only official download source is kali.org/get-kali — third-party mirrors and repackaged ISOs are a supply-chain risk
Installer images carry the full toolset offline; netinstaller images are small but download packages during setup; live images boot a runnable desktop carrying the same kali-linux-default toolset, but without the installer's selectable desktop and metapackage choices
On modern hardware you want the amd64 (64-bit) image — the amd64 label covers both Intel and AMD 64-bit CPUs
Verify the ISO's SHA256 hash with sha256sum (Linux), shasum -a 256 (macOS), or certutil -hashfile <file> SHA256 (Windows) before writing it to media
BitTorrent downloads include per-piece hash checking, but you must still verify the final SHA256 checksum against the official value
Last updated: July 2026
Downloading and Verifying a Kali ISO
Everything starts at kali.org/get-kali , the only source you should trust for Kali images. OffSec (Offensive Security) publishes every official image there along with its checksums. A favorite exam trap is the idea that any mirror or repackaged ISO is fine — it is not. Because Kali is a security toolkit run with elevated privileges, installing from a tampered image hands an attacker a beachhead on day one.
Image types on kali.org/get-kali
The download page groups images by how you intend to run Kali:
Image type What it is When to use it
Installer Full offline installer ISO (roughly 4 GB) with the complete default toolset Standard bare-metal or VM installs; no network needed during setup
NetInstaller Small ISO that pulls packages from the kali-rolling repository during setup Limited bandwidth up front, or when you want the newest packages at install time
Live Bootable image that runs Kali from the medium's read-only squashfs with a copy-on-write overlay in RAM, carrying the same kali-linux-default toolset; can also launch an installer Try-before-install, forensics, portable USB setups
Virtual Machines Prebuilt VMware, VirtualBox, and Hyper-V images Fastest path to a working VM — import, log in, done
ARM Images for devices like the Raspberry Pi and other ARM boards Embedded and mobile form-factor work
Cloud Amazon Web Services (AWS) and Microsoft Azure marketplace images Internet-facing labs and remote infrastructure
- Containers Docker images such as kalilinux/kali-rolling Scripted tooling on a shared host kernel
- WSL Windows Subsystem for Linux package Running Kali command-line tools directly on Windows
Note the trade-off between the two installer flavors. The full installer ISO is larger but installs entirely offline with the package set baked in. The netinstaller image (named like kali-linux-2025.x-installer-netinst-amd64.iso) is a fraction of the size but requires a working network connection throughout setup, because nearly every package is fetched from the repositories during installation. If your target machine has no reliable network during install, the netinstaller is the wrong choice.
Choosing the architecture
For almost every modern laptop, desktop, or VM, choose the amd64 (64-bit) image. Do not let the name confuse you: amd64 is the generic label for the x86-64 architecture and runs on both Intel and AMD 64-bit processors. Kali also publishes arm64 images for ARM hardware. Kali stopped shipping an i386 kernel and 32-bit i386 images in October 2024 (2024.3 was the last i386 release), so on any current release amd64 or arm64 is the only choice — i386 survives only as packages and containers.
Verifying the SHA256 checksum
Every official image is published with a SHA256 checksum. After downloading, compute the hash of your local file and compare it character-for-character with the value on kali.org:
- Linux: sha256sum kali-linux-2025.3-installer-amd64.iso
- macOS: shasum -a 256 kali-linux-2025.3-installer-amd64.iso
- Windows (Command Prompt or PowerShell): certutil -hashfile kali-linux-2025.3-installer-amd64.iso SHA256
If even one hexadecimal digit differs, discard the file and download it again — do not attempt to boot or repair it. For stronger assurance, OffSec also publishes a SHA256SUMS file signed with the Kali official signing key; verifying SHA256SUMS.gpg with gpg --verify confirms the checksum list itself came from OffSec, protecting you against a scenario where both the image and the plain checksum on a mirror were replaced together.
Why verification matters: supply-chain attacks
Checksum verification defends against two distinct problems. The mundane one is a corrupted download — a truncated or bit-flipped ISO that produces cryptic installer failures or a system that breaks weeks later. The serious one is a supply-chain attack : an attacker who compromises a mirror or poisons a search result can serve a backdoored ISO that installs perfectly and looks identical in daily use. This is not theoretical — the Linux Mint project had its website breached in 2016 and its download links pointed at backdoored ISOs, and users who skipped checksum verification installed a compromised operating system. As a security professional you will run packet sniffers, credential tools, and exploit frameworks from this machine; verifying the image hash is the cheapest control you will ever apply.
Torrent versus HTTPS
kali.org offers each image over direct HTTPS download and as a BitTorrent magnet/torrent. The torrent option has two practical advantages: BitTorrent verifies a hash of every piece as it downloads, so corruption is caught and re-fetched automatically, and transfers resume cleanly after interruptions — useful for a 4 GB file on a flaky connection. HTTPS is simpler behind restrictive firewalls and requires no extra client. Either way, the transport does not replace verification: piece hashing proves the pieces match the torrent, not that the torrent itself is authentic. Always finish by comparing the final SHA256 against the official value on kali.org. OffSec also publishes weekly images built from the current kali-rolling repository between point releases; kali.org labels them untested and recommends the latest point release for most users (weeklies mainly when you need a specific bug fix), and the same verification rules apply.
Practical verification workflow
Each release ships a single SHA256SUMS file listing every image in that release alongside its hash, plus a detached signature in SHA256SUMS.gpg . The full-strength workflow is: download the ISO and both files, import Kali's signing key with wget -q -O - https://archive.kali.org/archive-key.asc | gpg --import and confirm its fingerprint reads 827C 8569 F251 8CC6 77FE CA1A ED65 462E C8D5 E4C5 (older printings of the book still show the retired 44C6 513A ... 7D8D 0BF6 key), verify the signature on SHA256SUMS with gpg --verify SHA256SUMS.gpg SHA256SUMS and look for "Good signature", then run sha256sum -c SHA256SUMS filtered to your image (for example grep installer-amd64 SHA256SUMS | sha256sum -c - ) and look for the OK result. Even if you skip the GPG step and just eyeball the hash from the HTTPS download page, you are still protected against the most common failure — a corrupted transfer — and against mirrors that have not synced a poisoned page. Remember what you are protecting: the default install carries 600+ preinstalled security tools , most of which you will run as root, so the provenance of that ISO underpins everything you do with it afterward.