Packets&Profits
← Back to blog

How to Install Kali Linux on Windows: The Ultimate Beginner's Virtualization Guide

7 min readBy Shawn R.
kali-linuxwindowsvirtualboxvmwarelab-setupbeginners-guidectfbug-bounty
How to Install Kali Linux on Windows: The Ultimate Beginner's Virtualization Guide

If you are breaking into penetration testing, bug bounty hunting, or Capture The Flag (CTF) competitions, Kali Linux is your primary operating system. Packed with over 600 pre-installed offensive security tools—from Nmap and Wireshark to Burp Suite and John the Ripper—it is the industry standard distribution for offensive security practitioners.

However, the single biggest mistake beginners make is attempting to dual-boot Kali directly on their bare-metal Windows laptop. Dual-booting frequently corrupts Windows UEFI bootloaders, breaks proprietary Wi-Fi drivers, and risks accidental hard drive formatting.

The safest, fastest, and most flexible way to run Kali Linux on Windows is inside a Virtual Machine (VM).

Here is the complete, step-by-step walkthrough to download, install, and optimize Kali Linux on Windows from scratch.

1. Choosing Your Hypervisor: VirtualBox vs. VMware

A Type-2 Hypervisor is software that runs on top of Windows and creates isolated virtual hardware where Kali Linux can operate safely.

Hypervisor License Pros Best For
Oracle VirtualBox 100% Free / Open-Source Cross-platform, snapshot support, extensive community documentation. Beginners and general CTF players.
VMware Workstation Pro Free for Personal Use Superior 3D graphics rendering, ultra-low input lag, seamless drag-and-drop. Long-term offensive lab workstations.

💡 Pro-Tip for Beginners: Do not download the standard .iso installer unless you specifically want to manually partition virtual drives. Instead, download the Pre-built Kali Virtual Machine image (.ova for VirtualBox or .7z for VMware) directly from kali.org/get-kali/. These pre-built images come fully installed and pre-configured out of the box.

2. Pre-Flight Checklist: Enabling Windows Virtualization

Before your hypervisor can run a 64-bit Linux virtual machine, hardware virtualization must be enabled in your computer’s BIOS/UEFI.

Verify CPU Virtualization in Windows:

  1. Press Ctrl + Shift + Esc to open Task Manager.
  2. Click the Performance tab and select CPU.
  3. Look at the bottom-right metrics: Virtualization: Enabled.
┌─────────────────────────────────────────────────────────┐
│ Task Manager -> Performance -> CPU                     │
│                                                         │
│ Base speed: 3.20 GHz        Virtualization: Enabled  ✓  │
│ Sockets: 1                  Cores: 8                    │
└─────────────────────────────────────────────────────────┘

If it says Disabled, restart your PC, enter BIOS (usually by pressing F2, F12, or Del at boot), locate Intel VT-x or AMD-V, set it to Enabled, and save.

3. Step-by-Step Installation (VirtualBox Walkthrough)

Step 1: Download & Install VirtualBox

  1. Download VirtualBox 7.x for Windows from virtualbox.org.
  2. Run the installer and also download the VirtualBox Extension Pack (required for USB 3.0 passthrough and shared folders).

Step 2: Import the Pre-Built Kali Appliance

  1. Download the Kali Linux VirtualBox (.ova) package from kali.org.
  2. Open VirtualBox, click File -> Import Appliance…
  3. Select your downloaded .ova file.
  4. Review the VM hardware settings:
    • RAM (Base Memory): Allocate at least 4096 MB (8192 MB recommended if your PC has 16GB+).
    • Processors (vCPUs): Allocate 2 to 4 CPU cores.
  5. Click Finish / Import and accept the license terms.
+-------------------------------------------------------------+
| VirtualBox VM Sizing Guide                                  |
+----------------------+------------------+-------------------+
| Total Host System RAM| Recommended VM RAM| Recommended vCPUs|
+----------------------+------------------+-------------------+
| 8 GB                 | 3072 MB - 4096 MB| 2 Cores           |
| 16 GB                | 6144 MB - 8192 MB| 4 Cores           |
| 32 GB+               | 12288 MB+        | 4 - 6 Cores       |
+----------------------+------------------+-------------------+

4. First Boot & Day-One Kali Linux Setup

Start your VM by clicking Start in VirtualBox.

Default Login Credentials

  • Username: kali
  • Password: kali

Step 1: Update System Repositories

Open the terminal icon in the top panel and run a full system package upgrade:

# Update repository index and upgrade installed packages
sudo apt update && sudo apt dist-upgrade -y

# Clean up obsolete cached packages
sudo apt autoremove -y && sudo apt clean

Step 2: Enable Bidirectional Clipboard & Drag-and-Drop

To easily copy recon targets, hashes, and notes between Windows and Kali:

  1. In the VirtualBox VM top menu bar, click Devices -> Shared Clipboard -> Bidirectional.
  2. Click Devices -> Drag and Drop -> Bidirectional.
  3. If resizing the VM window does not automatically scale the Linux desktop resolution, reinstall the guest modules:
sudo apt update && sudo apt install -y virtualbox-guest-x11
sudo reboot

Step 3: Configure a Shared Workspace Folder

Never save critical CTF write-ups or bug bounty notes exclusively inside a VM without backups. Create a folder on your Windows drive (e.g. C:\Hacking_Lab) and mount it to Kali:

  1. In VirtualBox menu: Devices -> Shared Folders -> Shared Folder Settings…
  2. Click Add Folder (+):
    • Folder Path: C:\Hacking_Lab
    • Folder Name: Hacking_Lab
    • Check Auto-mount and Make Permanent.
  3. Inside Kali terminal, grant your user permission to read the mount:
# Add the kali user to the vboxsf group
sudo usermod -aG vboxsf $USER

# The Windows folder is now mounted at /media/sf_Hacking_Lab/
ls -la /media/sf_Hacking_Lab/

5. Arming Your Arsenal: Essential Post-Install Checklist

Kali ships with baseline tools, but bug bounty hunting and modern CTFs require additional wordlists and utilities.

1. Decompress the RockYou Wordlist

The standard password brute-forcing dictionary comes compressed by default:

# Unzip rockyou.txt in /usr/share/wordlists
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
head -n 5 /usr/share/wordlists/rockyou.txt

2. Install SecLists

SecLists is the undisputed collection of security wordlists for fuzzing, discovery, and credential attacks:

# Install full SecLists collection
sudo apt install -y seclists
ls /usr/share/seclists/Discovery/Web-Content/

3. Install Modern Go Reconnaissance Tools

Modern web recon relies heavily on high-speed Go utilities:

# Set up Go environment
sudo apt install -y golang
echo 'export PATH=$PATH:$HOME/go/bin' >> ~/.zshrc
source ~/.zshrc

# Install essential ProjectDiscovery & Fuzzing suite
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
go install -v github.com/projectdiscovery/katana/cmd/katana@latest
go install -v github.com/ffuf/ffuf/v2@latest

4. Configure Burp Suite CA Certificate

To intercept HTTPS traffic in the Kali Firefox browser:

  1. Open terminal and start Burp Suite: burpsuite &
  2. Open Firefox and navigate to http://burp
  3. Click the CA Certificate button in the top-right to download cacert.der.
  4. In Firefox, open Settings -> search Certificates -> click View Certificates…
  5. Under Authorities, click Import…, select cacert.der, check Trust this CA to identify websites, and click OK.

6. The Golden Rule: Create a “Clean Baseline” Snapshot

Virtual machines allow you to save the exact state of your operating system. If you break your Python environment, install a broken driver, or accidentally delete system files, you can roll back the clock in 3 seconds.

[ VirtualBox Manager ]
  └── Kali Linux
        └── Snapshots
              └── [ 📸 Take Snapshot ] -> "Clean-Baseline-Post-Install"
  1. Shut down your Kali VM cleanly: sudo poweroff
  2. In VirtualBox Manager, click the menu button next to your VM and select Snapshots.
  3. Click Take Snapshot, name it Clean-Baseline-2026, and save.
  4. Whenever you finish a CTF or test dangerous payloads, you can right-click the snapshot and click Restore.

7. Productivity Boosters: Custom Terminal Aliases

Add these quality-of-life shortcuts to your ~/.zshrc file to save keystrokes during time-sensitive labs:

# Append to ~/.zshrc
alias ll='ls -lah --color=auto'
alias update='sudo apt update && sudo apt dist-upgrade -y'
alias myip="ip -br -c a"
alias ports="netstat -tulpn | grep LISTEN"
alias webserver="python3 -m http.server 8000"

# Reload shell config
source ~/.zshrc

Next Steps: Put Your Lab to Work

Your Kali Linux virtual machine is now fully provisioned, isolated, and armed with the industry standard toolsets.

To start putting your skills into practice without legal risk, connect your new VM to legal training environments:

  • HackerDNA: Browser-integrated CTF labs with real-time AI guidance.
  • PortSwigger Web Security Academy: Free, world-class labs for practicing SQLi, XSS, and authentication vulnerabilities with Burp Suite.
  • TryHackMe & Hack The Box: Network-based vulnerable machines across easy to insane difficulty.

Happy hunting!

Start typing to search the whole site.