3.3 Installation Options Overview

Installation Options Overview

Kali runs almost anywhere, and the exam wants you to match each deployment method to its use case and its limitations. The main options:

Bare metal

Installing Kali directly onto a machine's disk — solo or dual-booted — gives you full performance and unrestricted hardware access. This matters most for wireless work: packet injection and monitor mode require direct control of a Wi-Fi card, and Kali's kernel is custom-patched for wireless injection. Bare metal and a live USB boot are the two options where the laptop's internal card is directly usable for that, because both run Kali's own kernel on the real hardware; a VM never does. The trade-offs are commitment (repartitioning disks, managing dual boot) and the lack of a hypervisor's safety net between your attack tools and your everyday data.

Virtual machines

The most common lab setup. You can install from the standard ISO into VMware Workstation/Fusion, VirtualBox, or Hyper-V, but the faster path is importing the prebuilt VM images published on kali.org — download, import, log in as kali/kali. VMs give you snapshots (roll back a broken tool install or a rootkitted guest in seconds), isolation from your host, and easy networking choices: NAT for simple outbound access, bridged when the guest must be a first-class citizen on the LAN, host-only for closed attack-lab networks.

The critical limitation is the virtualized NIC. The guest sees a virtual Ethernet adapter created by the hypervisor, not your physical wireless card, so 802.11 monitor mode and injection are impossible through it. The standard workaround — heavily emphasized in the Kali Linux Revealed material — is a USB Wi-Fi adapter passed through to the guest: the hypervisor hands the whole USB device to the VM, and Kali drives it directly. If an exam question describes injection failing inside a VM, this is almost always the answer.

USB: with and without persistence

Covered in detail in Section 3.2: a plain live USB is disposable and forgets everything at shutdown, while a persistence partition (optionally LUKS-encrypted) preserves your files, settings, and installed packages. Both boot the full desktop with real hardware access; neither requires touching the host's disks.

ARM devices

OffSec maintains images for ARM boards such as the Raspberry Pi. An ARM Kali box is small, silent, and cheap — ideal as a physical drop box on a penetration test or as a dedicated wireless-attacking appliance. You flash the image to an SD card exactly as you would a USB stick.

Cloud

Kali is published in the AWS Marketplace and Azure Marketplace as official images maintained by OffSec. Launch an instance and you reach it over SSH — there is no desktop by default, and (consistent with Kali's policy of network services being disabled by default) you must explicitly start or enable any services you need. Cloud Kalis shine for internet-facing reconnaissance, scanning, and command-and-control infrastructure that must live outside your home IP. Check your cloud provider's acceptable-use policy before scanning; many providers require you to request authorization for penetration-testing traffic.

Docker

docker pull kalilinux/kali-rolling gives you a minimal Kali userland in seconds, and metapackages such as kali-linux-headless layer on tool collections. Containers are superb for scripted, reproducible tooling — a disposable nmap or recon environment in CI. But a container shares the host kernel, so anything requiring kernel-level control is off the table: no wireless injection, no custom kernel modules, no low-level network interface manipulation beyond what the host permits.

WSL

On Windows 10/11, wsl --install kali-linux (or the Microsoft Store package) installs Kali as a Windows Subsystem for Linux distribution. You get the Kali command line and apt tooling integrated with Windows — great for quickly running Linux-native scripts on a Windows work machine. The Win-KeX package adds a graphical Kali desktop experience inside a window. Hardware access is limited (no straightforward PCI/USB wireless control), so WSL is a convenience option, not an attack platform for radio work.

Choosing

Rule of thumb for the exam: need wireless injection or maximum performance? Bare metal, or a VM with a USB adapter. Need safety, snapshots, and a course companion? VM. Need portability? Live USB, with persistence if it is a daily tool. Need an internet-facing presence? Cloud. Need disposable automation? Docker. Need Linux tools on a Windows desktop? WSL.