Kali Linux Tools Explained: What It Is, What the Tools Do and the Rules for Using Them

Kali Linux is a free, Debian-based Linux distribution built for penetration testing and security auditing. It collects several hundred security tools in one system, which is why you see it in tutorials, CTFs and job descriptions. This guide explains what Kali is, what its main tool groups are for, who should use it and the legal line you must not cross. It is written for defenders and learners and contains no attack walkthroughs.

TL;DR

The short version

5 points

Kali Linux is a Debian-based Linux distribution for penetration testing and security auditing. It was formerly known as BackTrack Linux and is free of charge.
It ships several hundred tools, grouped by purpose: information gathering, vulnerability assessment, web, passwords, wireless, exploitation, sniffing and spoofing, post-exploitation, forensics, reporting and more.
Kali's own docs say it is not recommended if you are unfamiliar with Linux and is not a general-purpose desktop. Use it in a virtual machine first.
Using these tools on systems you do not own or have written permission to test can cause serious harm and legal consequences. Kali's docs say "not understanding what you were doing" is not an excuse.
Download only from the official Kali site and verify the checksum, ideally the GPG signature. This guide explains what the tools are for, not how to attack anything.

What Kali Linux is

According to the Kali documentation, Kali Linux (formerly BackTrack Linux) is an open source, Debian-based distribution for advanced penetration testing and security auditing. It includes several hundred tools, configurations and scripts. The Kali team, described as a small group of individuals, is the only group trusted to commit packages and interact with the repositories, and the project is part of OffSec's community projects. Packages are GPG-signed, and the system follows the Filesystem Hierarchy Standard.

Who should and should not use it

A good fit

Professional penetration testers and security specialists, and people studying penetration testing to become certified professionals, with basic Linux and command-line competence.

Probably not

People unfamiliar with Linux, people wanting a general-purpose desktop for development, web design or gaming, and people who want Linux mainly to learn it. The docs say installing software outside the official repositories is unsupported.

Summarised from Kali's “Should I use Kali Linux?” page.

The main tool groups

Kali's documentation lists metapackages (kali-tools-<group>) that install a group of related tools. The descriptions below are the docs' own; the example tools each have a page on kali.org/tools (check there for the categories a tool is listed under); the last column is our note on how a defender uses the group. The Kali tools page itself organises tools by stage of an attack lifecycle (at review it showed 16 top-level categories, from Reconnaissance to Impact, plus Forensics and Services), and a tool can appear under several categories.

Kali tool groups, what they contain and how defenders use them
Group	What the docs say	Example tools	Defender use
Information gatheringkali-tools-information-gathering	OSINT and information-gathering tools.	Maltego	See what an outsider can learn about your hosts and organisation before they do.
Vulnerability assessmentkali-tools-vulnerability	Vulnerability assessment tools.	-	Find known weaknesses in systems you are responsible for and track their fixes.
Web applicationskali-tools-web	Web application attack tools.	Burp Suite, sqlmap	Test your own applications for flaws such as SQL injection before release.
Passwordskali-tools-passwords	Online and offline password cracking tools.	hashcat, John the Ripper	Audit whether the passwords you protect would survive guessing, with permission.
Wirelesskali-tools-wireless	Tools for wireless protocols (802.11, Bluetooth, RFID, SDR).	aircrack-ng	Check that your own Wi-Fi uses strong settings.
Exploitationkali-tools-exploitation	Commonly used exploitation tools.	Metasploit Framework	Confirm in a scoped test that a patch or control actually stops an attack.
Sniffing and spoofingkali-tools-sniffing-spoofing	Packet sniffing and spoofing tools.	Wireshark	Understand network traffic and spot suspicious flows.
Post-exploitationkali-tools-post-exploitation	Tools for the post-exploitation stage.	-	Learn what an attacker could reach after getting in, so you can detect and contain it.
Forensicskali-tools-forensics	Live and offline forensic tools.	Autopsy	Investigate an incident and preserve evidence.
Reportingkali-tools-reporting	Reporting tools.	-	Write up findings so they can be fixed.
Other groupskali-tools-social-engineering, -reverse-engineering, -crypto-stego, -fuzzing, -database, -voip, -hardware, -windows-resources, -gpu	Specialised groups, e.g. social engineering techniques, reverse engineering binaries, cryptography and steganography, fuzzing protocols.	-	Mostly used by specialists; read the group page before installing.

Two of the best-known tools have their own explainers here: learn to read network scans with the Nmap Command Builder, and to cut down packet captures with the Wireshark Display Filter Builder. Both teach in the browser and neither scans or captures anything.

The legal line: authorisation

Kali's own warning. Misusing security tools, especially without authorization, can cause serious harm and legal consequences, and the docs state that not understanding what you were doing is not an acceptable excuse.
US law. 18 U.S.C. 1030 (“Fraud and related activity in connection with computers”) covers intentionally accessing a computer without authorization or exceeding authorized access. Other countries have their own laws.
What to get. Written permission from someone with authority over the systems, naming the targets, dates, and what is and is not allowed. The Penetration Test Scoping tool shows what a scope should cover.
Where to practise legally. Machines you own, virtual labs, and platforms built for it. See the Beginner CTF Challenges for browser-only practice.

Getting it safely

Download only from the official page, kali.org/get-kali. Unofficial copies could be modified with malware.
Verify the image. The docs describe comparing the SHA256 checksum, and say the strongest method is verifying the GPG signature of the SHA256SUMS file. If verification fails, do not use the image.
For a first install, use a virtual machine rather than your main computer; the docs recommend this. Prebuilt VMware and VirtualBox images exist.
Stay with the official repositories. The docs say adding untested third-party repositories can break the system.

What defenders should take from this

Everything on Kali can be pointed at your own estate by someone else, so each group maps to something worth monitoring: scanning shows in firewall and IDS logs (practise rules in the Firewall Rule Lab), password guessing shows as failed logins (see Log Triage), and web testing shows in application logs. Knowing the categories helps you ask what each would look like on your network.

Sources

Kali Linux Documentation, What is Kali Linux?, accessed 3 November 2026.
Kali Linux Documentation, Should I use Kali Linux?, accessed 3 November 2026.
Kali Linux Documentation, Downloading Kali Linux, accessed 3 November 2026.
Kali Linux Documentation, Kali Linux Metapackages, accessed 3 November 2026.
Kali Linux, Kali Tools, and tool pages for hashcat, john, burpsuite, sqlmap, aircrack-ng, autopsy, metasploit-framework, maltego, wireshark, nmap.
18 U.S.C. 1030, Fraud and related activity in connection with computers.

Frequently asked questions

What is Kali Linux used for?

The Kali docs describe it as a Debian-based Linux distribution that lets users perform advanced penetration testing and security auditing. It bundles several hundred tools, configurations and scripts, with uses that include computer forensics, reverse engineering and vulnerability detection.

Is Kali Linux free?

Yes. The Kali docs say it is free of charge and will remain so, and that its source is available in a public Git tree.

Is Kali Linux good for beginners?

Kali's own page "Should I use Kali Linux?" says it is not a recommended distribution if you are unfamiliar with Linux, and that it is probably not what you are looking for if you want Linux mainly for learning or as a general-purpose desktop. It adds that it can be used by newcomers with caveats, and recommends trying it in a virtual machine first. Our beginner CTF challenges need only a browser.

Is Kali Linux legal?

Downloading and running Kali is not the issue; what you do with the tools is. Kali's docs warn that misusing security tools, especially without authorization, can cause serious harm and legal consequences. In the US, 18 U.S.C. 1030 covers intentionally accessing a computer without authorization or exceeding authorized access. Get written permission that names what is in scope. This is general information, not legal advice.

Is Kali Linux an operating system I should use every day?

No. The docs call it purpose-built for penetration testing and security auditing, say installing software outside the official repositories is unsupported, and note that network services are disabled by default and Bluetooth is blocklisted by default. Most people are better served by a normal desktop system plus Kali in a virtual machine.

How do I download Kali safely?

Use only the official download page at kali.org/get-kali/. Kali's docs recommend checking the image's SHA256 checksum, and the strongest method is verifying the GPG signature of the SHA256SUMS file. If the signature or checksum does not verify, do not use the image.

What is the difference between Kali and Wireshark or Nmap?

Kali is an operating system that packages tools. Nmap and Wireshark are individual tools that also run on other systems and are included in Kali. Our builders for nmap commands and Wireshark display filters teach those two tools in the browser, with no scanning or capturing.

What are Kali metapackages?

They are packages named kali-tools-<group> that install a whole group of related tools at once, such as kali-tools-web or kali-tools-forensics. The docs list groups including information gathering, vulnerability, web, passwords, wireless, exploitation, sniffing and spoofing, post-exploitation, forensics and reporting.

Last reviewed 3 November 2026. This is general information for the US, not legal advice. Kali Linux is a third-party project of OffSec; PlayCISO is not affiliated with it. The tool examples show what each group contains, not an endorsement of using them without permission.