Kali Linux brings an operating system and a broad collection of security software into one environment. Its purpose is to give security professionals a practical workspace for investigating systems, assessing weaknesses and examining digital evidence. Understanding that purpose helps explain both its popularity and the size of its toolkit.
The project describes Kali as a free, open-source Linux distribution based on Debian, designed for penetration testing and security auditing. It is developed by the Kali team as an OffSec community project. Alongside the familiar desktop, it provides packages, configurations and documentation organised around security work.
When was Kali Linux created?
Kali Linux first launched on March 13, 2013. Offensive Security, now known as OffSec, announced it at Black Hat Europe in Amsterdam. The original announcement described a security auditing operating system combining Linux with more than 300 penetration testing and auditing programs.
Kali succeeded BackTrack, a security-focused distribution with roots in earlier projects including WHAX and Auditor. According to the official project history, BackTrack initially used Slackware and later Ubuntu. Kali began with Debian 7, giving the new project a different foundation for its packages and development.
| Year | Milestone |
|---|---|
| 2006 | BackTrack’s first release, an important predecessor to Kali. |
| 2013 | Kali Linux 1.0, code-named Moto, launches on March 13. |
| 2015 | Kali Linux 2.0, code-named Sana, follows. |
| 2016 | Kali moves to its rolling-release model, using Debian Testing as its base. |
That rolling model means the operating system receives continuing package updates. A release image is a starting point for an installation, while the installed system can continue to evolve through updates.
What is Kali Linux used for?
Kali’s documented uses include penetration testing, vulnerability detection, computer forensics and reverse engineering. These cover different questions: whether a system exposes a weakness, how an application behaves, what a program does, or what evidence remains after an event.
In a penetration test, an authorised tester examines agreed systems and evaluates how weaknesses could affect them. Security auditing also involves checking configurations and controls. Forensics focuses on evidence, while reverse engineering investigates software behaviour and structure. Kali supplies software for these activities; the person doing the work still has to choose the method and interpret the results.
It also serves as a workspace for practical security education. A learner can use a controlled lab to study networking, web applications and operating-system behaviour, then connect those fundamentals to the tools used in an assessment.
How many tools does Kali Linux have?
The official introduction describes several hundred tools, configurations and scripts. For a more specific snapshot, DaySec counted 779 distinct top-level entries in the All Kali Tools catalogue on November 4, 2026. That count excludes the catalogue’s link to itself and does not count the nested package and command listings separately.
This is a count of catalogue entries, which include security projects, general utilities and supporting software. It is not a claim that Kali installs 779 separate security applications by default. The catalogue changes as software is added, updated or removed.
What is actually installed depends on the chosen image and package selection. Kali uses metapackages to group software for different needs, including web testing, wireless assessments, password auditing and forensics. A compact installation and a larger tool collection therefore need not contain the same programs. One package can also provide several commands.
What kinds of tools are available?
The collection spans information gathering, network discovery, web application testing, password auditing, wireless security, traffic analysis, exploitation research and digital forensics. These categories help users navigate a large software collection without treating every program as interchangeable.
For example, Nmap examines network services, Burp Suite supports web application security testing, and Wireshark captures and analyses network packets. Each answers a different kind of question. Having access to all three does not remove the need to understand networks, HTTP and the evidence being collected.
How can people run Kali?
Kali is available in several forms. Its official platform overview lists direct hardware installations, virtual machines, live USB environments, containers, cloud deployments, Windows Subsystem for Linux and ARM devices. Kali NetHunter extends the project to supported Android environments.
Those choices let people match the environment to their work. A virtual machine is convenient for a lab, while live media or a dedicated installation may suit other requirements. Hardware access and supported features differ between platforms, so the choice of environment affects what a tool can do.
Who is Kali Linux for?
The Kali team positions it primarily for penetration testers and security specialists. Its guidance for new users assumes Linux familiarity and recommends beginning in a virtual machine when trying Kali for the first time. People studying penetration testing can use it as part of that learning, with Linux and networking knowledge providing the foundation.
Kali is free to download, but installing it does not give someone permission to test another organisation’s systems. Its tools belong in work that has a defined purpose and authorised scope. Their value comes from the questions they help answer and the evidence a user can explain.
Source check: November 4, 2026. The catalogue figure is a dated count of top-level entries, not a fixed product specification. The accompanying desktop image illustrates Kali; appearance and menus can differ between releases.
