What is Kali Linux, and should a beginner use it?
Short answer: Kali Linux is a Debian-based distribution that ships around 600 preinstalled security tools. It is legal to download and use, it is excellent as a disposable testing machine, and it is a poor choice as your everyday operating system. Learn Linux on Ubuntu or Debian; run Kali in a virtual machine for the work.
Kali is the most recognised name in offensive security and the most misunderstood. It is not a hacking device, it does not make anyone a hacker, and installing it as your main system is the most common self-inflicted wound of the first six months.
What Kali actually is
A Debian derivative maintained by Offensive Security, with three things bundled in: a curated set of roughly 600 security tools, kernel and driver patches useful for wireless work, and sensible defaults for testing rather than for daily computing.
That is the whole proposition. Everything Kali does can be done on any Linux distribution by installing the same tools — Kali simply saves you the packaging work and guarantees the versions play together. That is worth a lot, and it is not magic.
Is Kali Linux legal?
Yes. Downloading, installing and using Kali is legal everywhere that Linux is legal. It is an operating system with software on it.
What is illegal is what you point it at. Scanning, testing or accessing a system without documented authorisation from its owner is a criminal offence in most jurisdictions, whether or not you caused damage and whether or not you intended harm. The tool is neutral; the target is not. The whole profession rests on a signed authorisation document, which is why how to practise hacking legally is worth reading before your first scan.
Should a beginner use Kali?
Use it, yes. Live in it, no. Three reasons, all practical.
It teaches you the wrong things about Linux. Kali historically ran as root and remains configured for testing rather than for ordinary use. If your Linux experience is Kali, you will not have learned permissions, services and user management the way a normal system enforces them — and those are the exact skills you need on an engagement, because the machines you compromise are not Kali.
It is fragile as a daily driver. A rolling release full of security tooling is not built for stability, driver comfort, or your bank's website. Every hour spent fixing your own distribution is an hour not spent learning.
It hides the tools. When everything is preinstalled, you never learn what a tool depends on, how it is configured, or what it actually does. Installing Nmap, Burp and Metasploit yourself once, on a plain Debian, teaches more than a year of clicking through the Kali menu.
The setup most working testers actually run: a stable host system, Kali in a virtual machine with snapshots, and a separate vulnerable lab network. The snapshot is the point — you break the machine deliberately, roll back, and repeat.
Kali vs Parrot vs BlackArch vs plain Debian
| Kali | Parrot Security | BlackArch | Debian or Ubuntu | |
|---|---|---|---|---|
| Base | Debian | Debian | Arch | — |
| Tools | Around 600, curated | Similar, plus privacy tooling | Over 2,800, unfiltered | What you install |
| Weight | Moderate | Lighter, better on old hardware | Heavy | Light |
| Best for | The default, best documented | Low-resource machines, privacy work | Experienced Arch users | Learning Linux properly |
| Worst for | Being your only system | Nothing in particular | Beginners | Convenience |
If you cannot decide: Kali in a virtual machine, because every tutorial, course and exam assumes it. The differences between these distributions matter far less than what you do with them.
The tools that actually matter
Kali ships 600 tools. You will use perhaps fifteen regularly, and four of them carry most engagements:
- Nmap — discovery and enumeration. Depth here changes results more than any exploit. Our Nmap course is free with an account.
- Wireshark — reading what is actually on the wire. The moment protocols stop being abstract. Also free with an account.
- Burp Suite — the whole web testing workflow. The community edition is enough to learn on; Burp Suite Pro covers the professional workflows.
- Metasploit — exploitation and post-exploitation framework, and a good teacher of what a payload actually is. Metasploit Pro goes past
msfconsole.
Add netcat, ffuf, hashcat, impacket, BloodHound and responder and you have covered most of what appears in real internal reports.
A setup that will not waste your time
- Keep your normal operating system as the host. Whatever you already use.
- Install VirtualBox or VMware, then Kali as a guest. Two virtual CPUs and 4 GB of memory is enough to start.
- Snapshot immediately after the first update. Then snapshot before every experiment.
- Build a target network, not a target on the internet. Deliberately vulnerable virtual machines, a Windows domain controller if you can spare the memory, and an internal-only network so nothing leaks outward.
- Learn Linux separately, on a normal Debian or Ubuntu machine. That is where permissions, systemd and networking make sense.
That fifth point is the one people skip, and it is the one that shows in interviews. Linux Exploitation assumes you already know how a healthy Linux system behaves — which is precisely why it is worth building that baseline first.
Frequently asked questions
- What is Kali Linux used for?
- Penetration testing, security auditing, digital forensics and reverse engineering. It is a Debian-based distribution that bundles around 600 security tools with sensible defaults, so testers do not have to assemble and reconcile that toolchain themselves.
- Is Kali Linux legal to use?
- Yes. Downloading and running Kali is legal anywhere Linux is legal. What is illegal is testing a system you do not have written authorisation to test — that is a criminal offence in most countries regardless of intent or damage caused. Where to practise legally.
- Is Kali Linux good for beginners?
- As a virtual machine for practice, yes. As your only operating system, no. Kali is configured for testing rather than daily use, and learning Linux on it leaves gaps in permissions, services and user management — exactly the knowledge you need on the machines you will be attacking.
- Kali or Parrot OS?
- Kali, unless you are short on hardware. Their toolsets overlap almost entirely; Kali has better documentation and is what every course and exam assumes. Parrot is lighter and adds privacy tooling, which makes it the better fit on an older laptop.
- Do professional hackers use Kali Linux?
- Many do, in virtual machines or as one system among several. Others run a plain Debian with their own tooling, or a purpose-built operator machine for red team work. The distribution is a convenience, not a capability — nothing in Kali is unavailable elsewhere.
- How much RAM does Kali need?
- Four gigabytes and two virtual CPUs are enough for scanning, web testing and most course labs. Eight gigabytes becomes worthwhile when you run a Windows target alongside it, and a full Active Directory lab realistically wants sixteen on the host.
Where to go next
Install Kali in a virtual machine, then spend the first weeks on the two tools everything else depends on: Nmap and Wireshark, both free with an account. The free penetration testing course puts them inside a real methodology instead of leaving them as isolated commands.