2.1 A Bit of History: From BackTrack to Kali

2.1 A Bit of History: From BackTrack to Kali

Kali Linux did not appear from nowhere. It is the third generation of a penetration-testing distribution lineage that the KLCP exam expects you to know in detail, because the history explains almost every design decision that follows.

The Ancestors: WHAX and Auditor

In the mid-2000s, two independent live Linux distributions dominated the security-auditing scene:

• WHAX (sometimes written Whax), maintained by Mati Aharoni, was built on Slax, a modular live distribution derived from Slackware. WHAX focused on packing wireless and network auditing tools into a bootable live CD.
• The Auditor Security Collection, maintained by Max Moser, was based on Knoppix (itself a Debian derivative) and offered a similar goal: a bootable toolkit for security professionals.

Rather than compete, the two projects merged to form BackTrack. The exam loves this detail: BackTrack is the merge of WHAX and the Auditor Security Collection, and the two parents had different bases — WHAX was Slax/Slackware-based while Auditor was Knoppix-based — and the merged BackTrack v1–v3 was built on Slackware/Slax, not Ubuntu.

The BackTrack Era

BackTrack went through five major releases, and its base changed partway through — a classic exam trap:

BackTrack became the de facto standard for penetration testing, but by 2012 its maintainers at Offensive Security (the company now branded OffSec) were hitting structural limits. BackTrack was effectively a pile of modifications bolted onto someone else's distribution. There was no clean, reproducible build process, no compliant filesystem layout, no signed package infrastructure of its own, and upgrades between releases were painful enough that most users simply reinstalled.

Why Rebuild on Debian?

OffSec's answer was not BackTrack 6 but a complete rebuild from the ground up on Debian. The motivations the exam expects you to recall:

• Full control of the build pipeline — Kali is constructed with Debian's own tooling (live-build), so every image is reproducible rather than hand-assembled.
• FHS compliance — the rebuild let Kali follow the Filesystem Hierarchy Standard properly instead of BackTrack's ad hoc layouts.
• Signed repositories — Kali gained its own GPG-signed package repositories, so apt could verify package integrity cryptographically.
• Debian's scale — building on Debian gives Kali a mature package format (.deb), dependency resolver (apt), and a huge upstream software base to draw from.
• Cleaner maintenance — building on Debian meant inheriting Debian's packaging infrastructure and continuous upstream fixes instead of maintaining a fork of an aging Ubuntu release. (Kali 1.0 itself was built on Debian 7 "Wheezy", which the book calls Debian stable; the rebase onto Debian Testing came later, with the rolling model.)

The result, Kali Linux 1.0, was released in March 2013. Note the framing: Kali 1.0 was a new distribution, not an upgrade path — there was no supported in-place upgrade from BackTrack 5 to Kali.

The Rolling-Release Shift

Kali 1.0 still followed a point-release model and was built on Debian 7 "Wheezy" — the branch the book calls Debian's stable one at the time (Wheezy was in fact still frozen testing in March 2013 and released as stable that May). Kali 2.0 (August 2015), based on Debian 8 "Jessie", announced the move to a rolling distribution, but Kali Linux Revealed is precise about the date that matters: Kali 2016.1 was the first release to officially embrace the rolling nature of that distribution, rebasing Kali onto Debian Testing. Under the rolling model, instead of freezing the system at each release, Kali continuously pulls packages from Debian Testing into the kali-rolling repository, so an installed system updates indefinitely without reinstallation. The named releases you see today (such as 2025.4 or 2026.2, using a year.quarter numbering scheme) are essentially refreshed installer images and snapshots of the rolling archive, not forks of it.

Landmark Changes in Kali 2020.x

Two changes from 2020 are among the most frequently tested facts on the entire exam:

1. Kali 2020.1 — the end of the default root user. Historically, Kali (and BackTrack before it) ran everything as root, on the argument that many security tools need raw socket access. By 2020 this was an outdated and dangerous default, so Kali switched to a traditional non-root user model: live images boot into a standard user named kali with the default password kali. Privileged actions go through sudo. The KLCP exam tests this constantly — the default credentials are kali/kali, and the era of "log in as root with password toor" is over.
2. Kali 2020.4 — zsh becomes the default interactive shell. New installs and fresh live sessions use Zsh (with Kali's themed prompt and plugins) instead of Bash for interactive terminals. Critically, this does not change the scripting shell: /bin/sh remains dash, the POSIX-compliant Debian default, so scripts with a #!/bin/sh shebang behave exactly as they always have. The trap answer on the exam is claiming Bash is the default interactive shell, or that dash is the interactive shell — the correct pairing is zsh interactive, dash for POSIX scripts.

Other 2020-era milestones worth recognizing include the move to a single installer image (instead of separate images per desktop), expanded ARM and cloud images, and the introduction of Kali NetHunter enhancements for mobile — but the non-root user and zsh default are the two you must be able to state cold.

Exam Trap Checklist

• BackTrack's parents were WHAX (Slax/Slackware-based) and Auditor (Knoppix-based); BackTrack v1–v3 itself was Slackware/Slax-based.
• BackTrack 4/5 were Ubuntu-based; Kali has never been Ubuntu-based — it was rebuilt on Debian.
• Kali 1.0 shipped in March 2013 on Debian 7 "Wheezy" — the branch Kali Linux Revealed calls "Debian's stable distribution at the time", though Wheezy did not actually become stable until 4 May 2013, seven weeks after Kali 1.0; the rolling model was announced with Kali 2.0 (2015) and first officially released with Kali 2016.1, when Kali rebased onto Debian Testing.
• Default credentials on live images are kali/kali since 2020.1, not root/toor.
• zsh is the default interactive shell since 2020.4; dash still serves /bin/sh.