How to Install Kali Linux in VirtualBox or VMware and Verify It First

To install Kali Linux safely in a virtual machine, download the prebuilt VirtualBox or VMware image from kali.org/get-kali, verify it against Kali's GPG-signed SHA256SUMS file, extract it with 7-Zip and open it in your hypervisor. Log in with kali/kali, change that password at once, keep the VM on NAT, take a snapshot and run a full upgrade.

That route suits most people learning penetration testing or building a home lab. This guide covers each step in detail, plus UTM, Hyper-V and WSL, first-boot hardening, the legal ground rules, updates, removal and common errors. Every command comes from Kali's documentation or the hypervisor maker's, linked in the sources.

Key takeaways

• Download only from kali.org/get-kali. Kali's own docs warn that a modified copy could carry malware and be hosted unofficially.
• Verify the signature, not just the hash. Import Kali's key, confirm the fingerprint 827C 8569 F251 8CC6 77FE CA1A ED65 462E C8D5 E4C5, check SHA256SUMS.gpg, then check your file against SHA256SUMS.
• For a VM, the prebuilt images are the easy path. They ship with guest tools installed and the default login kali/kali, which you must change.
• Apple silicon Macs need the ARM64 installer ISO. The prebuilt VirtualBox, VMware and Hyper-V images on Get Kali are amd64 only.
• Keep Kali on NAT and put vulnerable practice targets on host-only or internal networks.
• Snapshot before every change, then update with sudo apt update and sudo apt full-upgrade -y.
• Only test what you own or have written permission to test. Kali itself warns that misuse "may cause irreparable damage" with personal and legal consequences.

Which Kali image should you use?

Kali publishes several kinds of images on its Get Kali page. For a virtual machine you have two sensible choices, plus WSL if you only need the command line on Windows.

Kali's guide to which image to download says "If in doubt, use the Installer image," advice aimed at full installs. For a lab VM, the prebuilt images are built with the same recipe as Kali's guest VM guides, so you skip the installer.

Get Kali describes the virtual machine route as an isolated environment with snapshots, at the cost of limited hardware access and higher system requirements. Kali's Should I Use Kali Linux? page recommends that first-time users start in a virtual machine and move to real hardware later.

Why bare metal is rarely needed for learning

Bare metal gives Kali full access to the Wi-Fi card and GPU, which matters for wireless and GPU-assisted work. For web testing, network labs, CTF challenges and most course material, a VM is enough: you can roll back with a snapshot, keep practice targets on a private virtual network, and leave your everyday operating system untouched.

What does your host machine need?

Check the host before you download several gigabytes.

The host has to keep running too. If you plan to run vulnerable target VMs alongside Kali, 16 GB of host RAM makes life easier.

Windows hosts

On Windows 10 or 11 you can use VirtualBox, VMware Workstation or Hyper-V. First check whether Hyper-V or a feature built on it (Memory Integrity, Credential Guard, WSL 2) is on, because that changes how other hypervisors behave; the errors section explains what each vendor says.

macOS hosts

On an Intel Mac, the amd64 prebuilt images work in VirtualBox or VMware Fusion. On an Apple silicon Mac you need an ARM64 guest: Get Kali has an "Apple Silicon (ARM64)" tab with an installer ISO, and Kali's UTM guide walks through it. VirtualBox also ships an Apple silicon host package, and its manual says it runs a selection of Arm64 Linux guests on Arm hosts.

Linux hosts

VirtualBox and VMware Workstation both support Linux hosts, and Get Kali also offers a prebuilt QEMU image.

Where do you download Kali Linux safely?

Only from Kali. The download buttons on kali.org/get-kali point at Kali's own image servers (cdimage.kali.org, which redirects to kali.download), and the signing key lives at archive.kali.org. Kali's download documentation states the rule in capitals: never download Kali images from anywhere other than the official sources.

On 23 October 2026, Get Kali listed Kali Linux 2026.2 as the current point release, with amd64 prebuilt VMware, VirtualBox, Hyper-V and QEMU images of about 3.6 GB each. The server's current directory, though, already held a SHA256SUMS for 2026.3, signed on 20 October 2026, ahead of any announcement. Point releases arrive roughly quarterly, so file names change: take the version Get Kali shows, and use the SHA256SUMS from the same directory as your file.

For the history of those quarterly releases, see our post on Kali Linux quarterly releases from 2020 to 2026.

Why fake and modified Kali images exist

Kali is a trusted toolkit. People run it with administrator rights, point it at networks they care about and type credentials into it, which makes a tampered copy an attractive foothold. Kali's documentation says it "would be easy for a malicious entity" to modify an installation and host it unofficially, and that a bogus version deployed unknowingly could do a great deal of damage.

The risk arrives through ordinary channels: a search ad pointing at a lookalike domain, a video tutorial linking to a file-sharing site, a "preconfigured" VM bundle, or a torrent that is not one of Kali's own .torrent files. Type kali.org yourself or use a bookmark, and never trust a checksum printed on any other site, because whoever swaps the file can swap the hash. Our explainer on checksums versus signatures covers why the signature check below is the one that counts.

How do you verify a Kali Linux download?

Kali's documentation describes three levels of assurance. Comparing the SHA256 hash you compute with the one shown on Get Kali is quick, but Kali notes it assumes the site you see really is Kali's. Checking against the .txt.sha256sum file that comes with a torrent is just as easy, but that file is unsigned. The strongest method checks a GPG signature over SHA256SUMS, which relies only on Kali's key, not on the web page you downloaded from. Use the strongest one. It takes about two minutes.

Step 1: Install GPG

On Linux, GPG is usually already installed. On Windows, Kali's docs point to Gpg4win. On macOS they point to GPG Tools, or, if you already use Homebrew:

brew install gnupg

Step 2: Import Kali's signing key and check the fingerprint

From Kali's secure download page:

wget -q -O - https://archive.kali.org/archive-key.asc | gpg --import
# or fetch it from a keyserver:
gpg --keyserver hkps://keyserver.ubuntu.com --recv-key 827C8569F2518CC677FECA1AED65462EC8D5E4C5

Then display the fingerprint and compare it, character by character, with the one Kali publishes:

gpg --fingerprint 827C8569F2518CC677FECA1AED65462EC8D5E4C5

Expected output:

pub   rsa4096 2025-04-17 [SC] [expires: 2028-04-17]
      827C 8569 F251 8CC6 77FE  CA1A ED65 462E C8D5 E4C5
uid           [ unknown] Kali Linux Archive Automatic Signing Key (2025)

Kali's main download page uses keys.openpgp.org as the keyserver while the secure download page uses keyserver.ubuntu.com. Either works, because what you are checking is the fingerprint, not where the key came from.

Step 3: Download SHA256SUMS and its signature, then verify

Download SHA256SUMS and SHA256SUMS.gpg from the same directory as your image. Kali's docs show this one-liner for the current release:

wget -q https://cdimage.kali.org/current/SHA256SUMS{.gpg,}
gpg --verify SHA256SUMS.gpg SHA256SUMS

You want to see:

gpg:                using RSA key 827C8569F2518CC677FECA1AED65462EC8D5E4C5
gpg: Good signature from "Kali Linux Archive Automatic Signing Key (2025) <devel@kali.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!

The warning is normal, and Kali's own sample output includes it. It means you have not personally signed Kali's key in your keyring. The parts that matter are "Good signature" and the matching key ID. We ran exactly these commands on 23 October 2026 and got a good signature from that key on a file signed 20 October 2026.

If you do not get "Good signature", or the key ID differs, stop: Kali's docs treat that as a sign the file may have been tampered with.

Step 4: Check your image against SHA256SUMS

On Linux or macOS, from the folder holding both files (swap in your actual file name):

grep kali-linux-2026.2-virtualbox-amd64.7z SHA256SUMS | shasum -a 256 -c

Kali's example uses the live ISO, but SHA256SUMS also lists the .7z VM archives, so the same pattern works. A good result ends in OK:

kali-linux-2026.2-virtualbox-amd64.7z: OK

On Windows, Kali's docs use certutil:

certutil -hashfile kali-linux-2026.2-virtualbox-amd64.7z sha256

Compare it with that file's line in the signature-checked SHA256SUMS, ignoring letter case, since Kali notes PowerShell may print uppercase. Our guide to verifying a SHA-256 checksum before installing has more Windows detail. If the hash does not match, delete the file and download again; skipping this is the weakness catalogued as CWE-494.

How do you install Kali Linux in VirtualBox?

Get VirtualBox from virtualbox.org/wiki/Downloads. When we checked, the current release was VirtualBox 7.2.22, with packages for Windows, macOS on Intel, macOS on Apple silicon and Linux, and a SHA256 checksum file on the same page. The base package is GPL version 3. The optional Extension Pack is under a separate Personal Use and Educational License; read it before installing the pack on a work machine.

Route A: Import the prebuilt Kali VirtualBox image

This follows Kali's VirtualBox import guide.

1. Download the VirtualBox image from Get Kali and verify it as above.

2. Extract it. On Linux or macOS with 7-Zip installed:

   7z x kali-linux-2026.2-virtualbox-amd64.7z
   

   On Windows, Kali suggests the official 7-Zip app.

3. Open VirtualBox and choose Add, then browse to the extracted folder and select the .vbox file.

4. Review the settings before first boot. This is the moment to apply the hardening in the next section: check the network adapter, shared clipboard and drag and drop, and shared folders.

5. Start the VM and log in with user kali, password kali.

6. Change the password and update (see below), then take a snapshot.

Route B: Install from the installer ISO in VirtualBox

Kali's VirtualBox guest guide is the recipe Kali uses to build its own images. It notes you may need to enable Intel VT-x or AMD-V in BIOS or UEFI first.

1. Choose Machine, New, name the VM, and set Type Linux, Version Debian (64-bit).
2. Give it at least 2048 MB RAM and a new VDI disk, dynamically allocated, 80 GB in Kali's build.
3. In Settings, System: boot from Hard Disk then Optical, 2 Processors, PAE/NX on.
4. In Display: 128 MB video memory, Accelerated 3D graphics off, since Kali says it has caused problems.
5. Click Start, choose the verified ISO in the Optical Disk Selector, and run the installer, creating your own user and keeping the default desktop and tools.

Kali's installer detects that it is running in VirtualBox and installs the guest package (virtualbox-guest-x11) automatically. If that ever breaks, Kali's Guest Additions guide reinstalls it after a full update:

sudo apt update
sudo apt install -y --reinstall virtualbox-guest-x11
sudo reboot -f

One difference worth knowing: Kali's build guide sets Shared Clipboard and Drag'n'Drop to bidirectional, for convenience. VirtualBox's own manual says the shared clipboard is "disabled by default" for security reasons, and drag and drop is also off by default. For a lab that touches untrusted targets or files, we suggest setting both back to Disabled in General, Advanced, or switching them on only when you need them.

How do you install Kali Linux in VMware?

Broadcom announced that from 11 November 2024, VMware Workstation and Fusion are free for commercial, educational and personal users. Download them from Broadcom's own site, not a mirror.

Route A: Import the prebuilt Kali VMware image

From Kali's VMware import guide:

1. Download the VMware image from Get Kali and verify it.

2. Extract it:

   7z x kali-linux-2026.2-vmware-amd64.7z
   

   On Windows 11, Kali notes that the 7-Zip entry may be hidden behind Show more options in the right-click menu.

3. In VMware, choose Open a Virtual Machine and select the .vmx file.

4. Review the settings, then power on and log in as kali / kali.

5. Change the password, update and snapshot.

Route B: Install from the installer ISO in VMware Workstation

Kali's VMware guest guide is again the recipe for its own images, built with VMware Workstation. It says you will need VT-x or AMD-V enabled in BIOS or UEFI.

1. Choose Create a New Virtual Machine, then Custom (advanced). Kali picks Workstation 8.x compatibility so the VM opens on more versions.
2. Browse to the verified ISO; guest OS Linux, latest Debian 64-bit.
3. Kali uses 2 processors with 2 cores each and 2 GB RAM minimum.
4. Network: Kali defaults to NAT, which reaches the internet without taking an extra IP address on your LAN.
5. Accept LSI Logic and SCSI defaults; create an 80 GB disk split into multiple files, not preallocated.
6. Finish, then Edit virtual machine settings: remove the Printer, stop new USB devices connecting automatically, keep Accelerated 3D graphics off. Kali sets Shared folders to always enabled with no paths shared; disable it if you do not need it.
7. Power on and run the installer, creating your own user.

The installer adds open-vm-tools automatically. To repair it, Kali's VMware tools guide uses:

sudo apt update
sudo apt install -y --reinstall open-vm-tools-desktop fuse
sudo reboot -f

Shared folders need extra scripts, which Kali installs through kali-tweaks (Virtualization, then the VMware option). After that, sudo mount-shared-folders mounts them under /mnt/hgfs/, and sudo restart-vm-tools helps when copy and paste stops working.

How do you install Kali on an Apple silicon Mac with UTM?

UTM is free and open source, from the Mac App Store or UTM's GitHub releases, which its documentation says are identical. Kali's UTM guide, updated 8 October 2026, goes like this:

1. Download and verify the ARM64 installer ISO from Get Kali.
2. In UTM, click Create VM, choose Virtualize, then Other.
3. Set Boot ISO Image to the Kali ISO and keep the defaults; leave the shared directory empty.
4. Save the VM and, in its settings, add a Serial device; Kali says a current UTM bug means installing in console mode.
5. Start the VM and choose Install. If you see a blank screen, set the display to the Serial device.
6. After installing, clear the ISO from the virtual CD drive, remove the Serial device, set the display card to virtio-gpu-pci, and remove the installer image from the shared directory.

How do you install Kali in Hyper-V?

Hyper-V needs Windows 10 or 11 Pro or Enterprise; Microsoft states it "can't be installed" on Home editions. Microsoft's install guide enables it from an elevated PowerShell with:

Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All

Kali's Hyper-V guide then uses Quick Create: choose Local installation source, pick the verified ISO, untick This machine will run Windows, and create the VM. Kali's example cuts virtual processors from 6 to 2 under Edit Settings. A prebuilt Hyper-V image also exists.

One catch: Kali's installation docs say "the Kali Linux kernel is not signed" and Secure Boot must be off. Microsoft notes that Secure Boot is on by default for generation 2 VMs and can be turned off after the VM is created. If the VM refuses to boot the installer, disable Secure Boot in that VM's settings. This only affects the VM, not your Windows host.

Should you use Kali on WSL instead?

If you only want Kali's command line tools on a Windows 11 PC, WSL is lighter than a full VM. Kali's WSL guide gives the modern one-liner:

wsl --install kali-linux

You create a new Linux username and password on first launch. The WSL image is minimal, so add tools afterwards with a metapackage, for example:

sudo apt update
sudo apt full-upgrade -y
sudo apt install -y kali-linux-default

Understand the trade-offs. Get Kali lists WSL as "userland actions only", with Microsoft's kernel rather than Kali's and no direct hardware access. WSL 2 also shares more with Windows than a separate VM does. Our post on what WSL 2 isolates and what it shares explains the boundaries. For handling untrusted targets or samples, a full VM with its own snapshots is the safer lab.

How do you harden Kali on first boot?

Do these before you browse, install extra tools or connect to any practice target.

1. Change the default credentials

Kali's default credentials page confirms that prebuilt VMs, ARM images and live boots use user kali and password kali. Anyone who can reach the VM over the network and knows that will try it. Change it with the standard passwd command, which the Debian manual says lets a normal user change the password for their own account:

passwd

The same page lists tools that ship with their own default credentials, including some web interfaces and database services. Change those too when you first enable a tool. Kali has used a non-root default user since 2020.1, so day to day you work as a normal user and use sudo for administration.

2. Pick the right network mode

VirtualBox calls NAT the simplest option and its default, and Kali's VMware guide defaults to it too, noting the VM cannot receive inbound connections without port forwarding. That is what you want for a learning VM. Bridged mode puts Kali on the same network as family laptops or your employer's devices.

Kali also limits exposure by design. Its network service policy says Kali does not enable externally listening services by default and stops network services from persisting across reboots unless you enable them. Leave that as it is unless a lab exercise needs a service.

3. Take a clean snapshot

Both hypervisors make this simple. VirtualBox's manual describes taking, restoring and deleting snapshots from the machine's snapshot view; Broadcom says a Workstation snapshot "captures the entire state" of the VM so you can return to it repeatedly. Take one right after hardening and name it something like "clean, updated, 23 Oct 2026". Before every major update or tool install, take another.

4. Keep host integration off unless you need it

Shared clipboard, drag and drop and shared folders all open a path between guest and host. If the VM will handle untrusted files or vulnerable targets, switch them off, and share one dedicated folder rather than your home directory when you need file transfer.

5. Do not add random repositories

Kali's documentation warns that adding outside repositories such as PPAs can seriously break an install, and that apt-add-repository is not supported. Keep kali.sources pointing at Kali's archive, as shown in the update section.

What tools come with Kali, and what are you allowed to do with them?

Kali groups its hundreds of tools into metapackages, listed in Kali's metapackages documentation. The default desktop images install kali-linux-default. Other menu groups include information gathering and OSINT, vulnerability assessment, web application testing, database assessment, password auditing, wireless, reverse engineering, exploitation, social engineering, sniffing and spoofing, post exploitation, forensics and reporting. Hardware-specific sets cover GPU tools, Bluetooth, RFID, software-defined radio and VoIP. There is also kali-linux-labs, which Kali describes as "environments for learning and practising on", and kali-linux-everything for every tool at once.

Install a set like this, after a full update:

sudo apt install -y kali-linux-default

Or run kali-tweaks and pick metapackages from its menu.

Legal and lab hygiene

This guide stops at installation. How to use these tools is for your course or your employer's rules of engagement.

• Only test systems you own or have explicit, written permission to test. Kali warns that misuse without specific authorisation can cause serious damage and personal or legal consequences, and that not understanding what you were doing is no excuse.
• Get scope in writing for any work engagement: addresses, hours, techniques and an emergency contact.
• Practise against your own targets on a host-only or internal network, or on platforms whose terms grant permission.
• Do not update tools mid-engagement. Kali's update guidance says to confirm tools work beforehand, because a rolling release occasionally breaks one.
• Keep client data out of shared folders.

If you are still deciding whether Kali is the right distribution at all, our comparison of Ubuntu, Kali and Debian and who should use which is a good place to start. Kali's own docs say it is not recommended as a general-purpose desktop.

How do you keep Kali Linux updated?

Kali is a rolling distribution. Its updating guide suggests checking for updates every few days or weeks on a default install. First confirm your package source file is correct:

cat /etc/apt/sources.list.d/kali.sources

It should contain:

Types: deb
URIs: http://http.kali.org/kali/
Suites: kali-rolling
Components: main contrib non-free non-free-firmware
Signed-By: /usr/share/keyrings/kali-archive-keyring.gpg

Then upgrade:

sudo apt update
sudo apt full-upgrade -y

A few details from Kali's repository documentation:

• The file moved in 2026.2. Before Kali 2026.2, the same line lived in /etc/apt/sources.list. If you only have the old file, run sudo apt update and then sudo apt modernize-sources to convert it; it keeps a .bak copy.

• The address is plain HTTP on purpose. Packages are verified by the signature in the Signed-By keyring, not by the transport. That is why the keyring matters.

• You can choose a slower branch. kali-last-snapshot is updated only with each point release, which Kali calls the more stable option. Switch with:

  sudo sed -i 's/^Suites: .*/Suites: kali-last-snapshot/' /etc/apt/sources.list.d/kali.sources
  

  then run sudo apt update. On that branch you get no updates until the next release.

Refreshing the archive signing key

In April 2025 Kali had to roll a new repository signing key. In a post dated 28 April 2025, Kali explained that it had lost access to the old key and warned that apt update would fail for almost everyone with an error naming the missing key 827C8569F2518CC677FECA1AED65462EC8D5E4C5. The fix was to download the new keyring:

sudo wget https://archive.kali.org/archive-keyring.gpg -O /usr/share/keyrings/kali-archive-keyring.gpg

Kali also suggested checking the file against the SHA-1 value it published at the time and showed how to list the keys inside it:

sha1sum /usr/share/keyrings/kali-archive-keyring.gpg
gpg --no-default-keyring --keyring /usr/share/keyrings/kali-archive-keyring.gpg -k

Kali rebuilt its images with the new keyring (2025.1c, and weekly images from 2025-W17), so an older prebuilt VM will need this step. Kali's docs show the current key expiring 17 April 2028. If apt update suddenly reports a key problem, read the Kali blog rather than switching off signature checks.

Update the hypervisor too

The VM is only as safe as the software running it. Update VirtualBox from its downloads page, VMware from Broadcom and UTM from the App Store or its GitHub releases. Guest tools inside Kali update with full-upgrade.

How do you remove a Kali VM cleanly?

• VirtualBox: power off the VM, right-click it in the machine list and choose Remove. The VirtualBox manual says the dialog lets you either remove it from the list only or remove its files too; choose the files option to free the disk space.
• VMware Workstation: power off the VM and choose VM, Manage, Delete from Disk. Broadcom warns not to do this if the VM is the parent of a linked clone you still use.
• WSL: run wsl --unregister kali-linux from Windows. Microsoft's WSL docs warn that all data, settings and software in that distribution are lost permanently.
• UTM and Hyper-V: delete the VM from the app's VM list, then delete its virtual disk if the app leaves it behind.

Then delete the downloaded .7z or .iso, the extracted folder and any shared folder you created, after copying out notes you want to keep.

How do you fix common Kali VM errors?

Hyper-V and VirtualBox or VMware on the same PC

The vendors disagree, so know all three positions:

• Microsoft says third-party virtualization apps "can't run alongside Hyper-V", Memory Integrity or Credential Guard, and suggests disabling Hyper-V.
• VirtualBox says it runs on a Hyper-V host using Hyper-V as its engine, with possibly "significant" slowdown, if Windows Hypervisor Platform is also enabled.
• Broadcom says Workstation 15.5.5 and later runs on Hyper-V hosts in Host VBS mode on Windows 10 build 19041.264 or newer, with listed limitations.

In practice: accept the slower mode, run Kali in Hyper-V itself, or disable the Hyper-V features following Microsoft's article, knowing that turning off Memory Integrity or Credential Guard weakens your host's protections. On a work laptop, ask IT first.

Common mistakes

• Downloading from a video description, a forum post or a search ad. Use kali.org/get-kali and nothing else.
• Checking the hash but not the signature. A tampered site can show a tampered hash. Verify SHA256SUMS.gpg and the key fingerprint.
• Skipping the fingerprint check after importing the key. The import succeeding is not the same as the key being Kali's.
• Leaving kali/kali in place, especially with bridged networking.
• Bridged networking by default, which puts your Kali VM on the LAN as a full peer.
• Vulnerable target VMs on NAT or bridged networks instead of host-only or internal.
• Bidirectional clipboard and broad shared folders in a VM that handles untrusted files.
• No snapshot before updates. A snapshot turns a broken tool into a quick rollback.
• Adding PPAs or other distributions' repositories, which Kali does not support.
• Turning off apt signature checks to "fix" a key error instead of installing the current keyring.
• Testing anything you do not own or have written permission to test.

FAQ

What is the safest way to install Kali Linux?

In a virtual machine, using the prebuilt image from kali.org/get-kali after verifying it against Kali's GPG-signed SHA256SUMS. Change the kali/kali password, keep NAT, snapshot, then run a full upgrade.

How do I install Kali Linux on VirtualBox?

Verify and extract the VirtualBox .7z image, choose Add in VirtualBox and select the .vbox file, then log in as kali/kali. Or create a Debian 64-bit VM with 2 GB RAM, 2 CPUs and an 80 GB dynamic disk and run the installer ISO.

How do I install Kali Linux on VMware Workstation?

Verify and extract the VMware .7z image, then choose Open a Virtual Machine and select the .vmx file. Broadcom made Workstation and Fusion free for all users on 11 November 2024.

What is the default username and password for Kali Linux?

For prebuilt VMs, ARM images and live boots it is kali / kali. Installer images make you create your own account. Change the default with passwd immediately.

How do I verify a Kali Linux ISO?

Import Kali's key, confirm the fingerprint ends in ED65 462E C8D5 E4C5, check that SHA256SUMS.gpg gives "Good signature", then check your file against SHA256SUMS with shasum -a 256 -c (or certutil on Windows).

Can I install Kali Linux on an M1, M2 or M3 Mac?

Yes, as an ARM64 VM. Use the ARM64 installer ISO from Get Kali with UTM, following Kali's guide, or VirtualBox's Apple silicon package. The prebuilt images on Get Kali are amd64 only.

How much RAM does Kali Linux need in a VM?

At least 2 GB of RAM and 20 GB of disk for the default desktop and tools, per Kali's docs, and 8 GB or more for heavy applications.

Is it legal to install Kali Linux?

Installing and learning with Kali is a normal part of security training. What matters is use: only test systems you own or have explicit written permission to test.

Why does VirtualBox not work when Hyper-V or WSL is on?

They compete for the same CPU virtualization features. Microsoft says third-party hypervisors do not work alongside Hyper-V; VirtualBox says it can run on top of Hyper-V, but more slowly. Accept the slowdown, use Hyper-V for Kali, or disable Hyper-V features.

How do I fix "Missing key 827C8569F2518CC677FECA1AED65462EC8D5E4C5" in Kali?

Your image predates Kali's April 2025 key change. Download the current keyring from archive.kali.org as shown in the update section, then run sudo apt update again.

Fix it without waiting for upstream

A Kali lab is where many people first see how a vulnerable dependency becomes an incident. The software you build at work is where that lesson has to hold, and that is the part Safeguard covers.

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

None of these demos installs Kali, checks an ISO signature or runs any offensive tool. Kali's signed images, its apt archive and your hypervisor handle all of that. The demos show the defensive side: finding and fixing vulnerable components in the projects you build, with a person approving each step.

In this Safeguard CLI session you install the CLI, run safeguard to open the interactive terminal and ask it to fix the lodash CVE in a repository. It reads the finding and advisory, asks before each command, edits package.json to lodash 4.17.21, runs npm install and npm test with your approval, prints a summary and pushes nothing. It then shows /permissions, /model and /scan .. If a lab exercise has shown you how an outdated library gets abused, this is the matching fix workflow for your own code.

Click through it at your own pace, or open it full screen.

This demo sets up the Safeguard runner on your own machine, approves it with its device code, then scans from the terminal. Like a Kali lab VM, it keeps the work on hardware you control, so repositories and images are scanned locally.

Click through it at your own pace, or open it full screen.

This demo connects Claude to the Safeguard MCP server with OAuth and lets you choose which tools Claude can use. Once connected, you can ask in plain language which of your projects contain a given component and version, which is the first question to answer when a lab finding turns out to apply to real software you ship.

Click through it at your own pace, or open it full screen.

You can download Safeguard at safeguard.sh/download and read the CLI documentation at docs.safeguard.sh/docs/cli.

Quick check

Sources

• Kali Linux: Get Kali
• Kali Linux Documentation: Downloading Kali Linux
• Kali Linux Documentation: Download Kali Linux Images Securely
• Kali Linux Documentation: Which Image Should I Download?
• Kali Linux Documentation: Kali's Default Credentials
• Kali Linux Documentation: Should I Use Kali Linux?
• Kali Linux Documentation: Installing Kali Linux (system requirements and Secure Boot)
• Kali Linux Documentation: Kali inside VirtualBox (Guest VM)
• Kali Linux Documentation: Import Pre-Made Kali VirtualBox VM
• Kali Linux Documentation: Installing VirtualBox Guest Additions
• Kali Linux Documentation: Kali inside VMware (Guest VM)
• Kali Linux Documentation: Import Pre-Made Kali VMware VM
• Kali Linux Documentation: Installing VMware Tools
• Kali Linux Documentation: Kali inside UTM (Guest VM)
• Kali Linux Documentation: Kali inside Hyper-V (Guest VM)
• Kali Linux Documentation: Kali WSL
• Kali Linux Documentation: Updating Kali
• Kali Linux Documentation: Kali Network Repositories
• Kali Linux Documentation: Kali Linux Metapackages
• Kali Linux Documentation: Kali Linux Network Service Policy
• Kali Linux Blog: A new Kali Linux archive signing key (28 April 2025)
• Kali Linux Blog: Kali default non-root user
• Kali Linux image server: current SHA256SUMS
• Oracle VirtualBox: Downloads
• Oracle VirtualBox manual: Introduction
• Oracle VirtualBox manual: Installation
• Oracle VirtualBox manual: Basic concepts (VM settings)
• Oracle VirtualBox manual: Guest Additions
• Oracle VirtualBox manual: Virtual networking
• Oracle VirtualBox manual: Working with virtual machines
• Oracle VirtualBox manual: Advanced topics (Hyper-V)
• VMware blog: VMware Fusion and Workstation are now free for all users
• Broadcom TechDocs: Processor requirements for host systems
• Broadcom TechDocs: Running Workstation on a Hyper-V enabled host
• Broadcom TechDocs: Configuring host-only networking
• Broadcom TechDocs: Configuring bridged networking
• Broadcom TechDocs: Taking snapshots of virtual machines
• Broadcom TechDocs: Delete a virtual machine
• UTM documentation: Installing UTM on macOS
• Microsoft Learn: Install Hyper-V
• Microsoft Learn: Should I create a generation 1 or 2 virtual machine in Hyper-V?
• Microsoft Learn: Virtualization applications don't work together with Hyper-V
• Microsoft Learn: How to install Linux on Windows with WSL
• Microsoft Learn: Basic commands for WSL
• Debian manual pages: passwd(1)

Last reviewed: 23 October 2026.