Loading…
Learn how to install and configure Kali Linux on Raspberry Pi for portable penetration testing. Complete setup guide covering ARM image installation, Wi-Fi configuration, headless mode, and b
A definitive, hands-on 2026 security audit guide for GraphQL APIs: covering schema discovery, introspection analysis, authorization auditing (BOLA/BFLA), query complexity DoS prevention, and
25 min read
A comprehensive first-principles guide to assessing and securing web APIs in 2026, covering OWASP API Top 10, BOLA testing, JWT security, GraphQL audits, and FastAPI/Next.js defensive remedia
Running Kali Linux on Raspberry Pi transforms the affordable single-board computer into a powerful, portable penetration testing platform. Whether you're conducting on-site security assessments, building a drop box for remote access, or creating a covert Wi-Fi auditing device, a Raspberry Pi running Kali Linux offers unmatched portability and versatility at a fraction of the cost of traditional pentesting hardware.
In this comprehensive guide, we'll walk through everything you need to know to set up Kali Linux on Raspberry Pi, from choosing the right hardware to optimizing performance for real-world penetration testing scenarios.
Before diving into the setup process, let's explore why security professionals are increasingly turning to Raspberry Pi devices for penetration testing:
The Raspberry Pi's credit-card size makes it incredibly portable. You can easily carry it in a pocket or small bag, enabling on-site assessments without drawing attention. This discretion is invaluable for physical security testing and covert operations.
Raspberry Pi devices consume minimal power (typically 5-15W), allowing them to run for extended periods on battery power. This makes them ideal for drop boxes that need to operate undetected for hours or days.
At under $100 for a complete setup, Raspberry Pi offers tremendous value. You can build multiple devices for different scenarios without breaking your budget—a stark contrast to specialized pentesting hardware costing thousands.
With no moving parts (when using passive cooling), the Raspberry Pi operates silently, perfect for covert deployments where even the faint hum of a fan could compromise your operation.
The 40-pin GPIO header opens up hardware hacking possibilities. Connect sensors, relays, or custom circuits to expand your device's capabilities beyond software-only testing.
Kali Linux ARM images support several Raspberry Pi models, each with different capabilities:
Recommendation: For serious penetration testing work, choose a Raspberry Pi 4 (4GB+) or Raspberry Pi 5. The extra RAM and processing power make a significant difference when running multiple tools simultaneously.
Here's what you'll need for a complete mobile pentesting setup:
Kali Linux provides official ARM images specifically optimized for Raspberry Pi hardware.
Navigate to the official Kali ARM downloads:
https://www.kali.org/get-kali/#kali-arm
Choose the correct image for your device:
kali-linux-2026.X-raspberry-pi5-arm64.img.xzkali-linux-2026.X-raspberry-pi4-arm64.img.xzkali-linux-2026.X-raspberry-pi3-arm64.img.xzkali-linux-2026.X-raspberry-pi-zero-2-w-arm64.img.xzAlways verify the SHA256 checksum to ensure your download isn't corrupted or tampered with:
# On Linux/macOS
sha256sum kali-linux-*-raspberry-pi*.img.xz
# On Windows (PowerShell)
Get-FileHash kali-linux-*-raspberry-pi*.img.xz -Algorithm SHA256
Compare the output with the checksum provided on the download page.
Kali ARM images come in different flavors:
Recommendation: Start with the default image for a good balance of tools and storage requirements.
Once you've downloaded the Kali ARM image, you need to write it to your microSD card.
balenaEtcher provides a simple, cross-platform graphical interface:
Step 1: Download balenaEtcher from https://www.balena.io/etcher/
Step 2: Install and launch balenaEtcher
Step 3: Insert your microSD card into your computer
Step 4: In balenaEtcher:
.img.xz fileStep 5: balenaEtcher automatically verifies the write—wait for "Flash Complete!"
Step 6: Safely eject the SD card
For advanced users comfortable with the command line:
Step 1: Extract the image:
xz -d kali-linux-2026.X-raspberry-pi4-arm64.img.xz
Step 2: Identify your SD card device:
# Linux
lsblk
# macOS
diskutil list
Warning: Double-check the device name! Writing to the wrong device will destroy data.
Step 3: Unmount the SD card (don't eject):
# Linux
sudo umount /dev/sdX* # Replace sdX with your device
# macOS
sudo diskutil unmountDisk /dev/diskN # Replace diskN with your device
Step 4: Write the image:
# Linux
sudo dd if=kali-linux-2026.X-raspberry-pi4-arm64.img of=/dev/sdX bs=4M status=progress conv=fsync
# macOS
sudo dd if=kali-linux-2026.X-raspberry-pi4-arm64.img of=/dev/rdiskN bs=1m
Step 5: Sync and eject:
sync
sudo eject /dev/sdX # or /dev/diskN on macOS
The official Raspberry Pi Imager also supports custom images:
After flashing, it's time to boot your Raspberry Pi with Kali Linux.
Step 1: Insert the microSD card into your Raspberry Pi
Step 2: Connect peripherals:
Step 3: Connect the power supply
Step 4: Wait for first boot (30-90 seconds)
The first boot takes longer as the system expands the filesystem to use your entire SD card.
Username: kali
Password: kali
Important: Change the default password immediately after first login!
Once logged in, execute these essential commands:
Step 1: Change the default password:
passwd
Enter your new password twice (use a strong password!).
Step 2: Update the system:
sudo apt update
sudo apt full-upgrade -y
This updates all packages to the latest versions. This may take 15-30 minutes depending on your internet connection.
Step 3: Reboot after updates:
sudo reboot
Kali ARM images automatically expand the root partition on first boot. Verify:
df -h
You should see the root partition (/) using most of your SD card capacity.
If not expanded automatically:
sudo raspi-config --expand-rootfs
sudo reboot
Setting up Wi-Fi connectivity is crucial for mobile pentesting deployments.
If running the desktop environment:
For headless setups or remote configuration:
Step 1: Edit the WPA supplicant configuration:
sudo nano /etc/wpa_supplicant/wpa_supplicant.conf
Step 2: Add your network:
ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1
country=US
network={
ssid="YourNetworkName"
psk="YourPassword"
key_mgmt=WPA-PSK
}
Step 3: Save (Ctrl+O, Enter) and exit (Ctrl+X)
Step 4: Restart networking:
sudo systemctl restart networking
# or
sudo ifconfig wlan0 down
sudo ifconfig wlan0 up
Step 5: Verify connection:
ifconfig wlan0
ping -c 4 8.8.8.8
NetworkManager provides a more robust solution:
List available networks:
nmcli device wifi list
Connect to a network:
nmcli device wifi connect "NetworkName" password "YourPassword"
Check connection status:
nmcli connection show
For monitor mode and packet injection, you'll need compatible USB adapters:
Popular options:
Check adapter detection:
ifconfig -a
iw dev
lsusb | grep -i wireless
Enable monitor mode:
sudo airmon-ng start wlan1 # Adjust interface name
Verify monitor mode:
ifconfig # Look for wlan1mon or similar
iw dev wlan1mon info
Running Kali headless (without display/keyboard) is essential for drop boxes and remote deployments.
Kali ARM images have SSH disabled by default for security.
Method 1: Before First Boot (Recommended)
After flashing the SD card but before booting:
ssh:# Linux/macOS
touch /media/boot/ssh
# Windows
# Right-click in boot folder → New → Text Document → Rename to "ssh" (no extension)
Method 2: After First Boot
If already logged in:
sudo systemctl enable ssh
sudo systemctl start ssh
On the Pi itself:
hostname -I
ip addr show
From your network:
# Scan your local network
sudo nmap -sn 192.168.1.0/24
# Or use arp
arp -a | grep -i "b8:27:eb\|dc:a6:32\|e4:5f:01" # Common Raspberry Pi MAC prefixes
Check your router: Most routers list connected devices with their IP addresses in the admin interface.
From any computer on the same network:
ssh kali@<raspberry-pi-ip>
Example:
ssh kali@192.168.1.50
On first connection, you'll see a security prompt—type yes to continue.
Enter your password (default: kali if not changed).
Step 1: Generate an SSH key pair on your main computer:
ssh-keygen -t ed25519 -C "kali-pi-key"
Step 2: Copy the public key to your Pi:
ssh-copy-id kali@<raspberry-pi-ip>
Step 3: Test key-based login:
ssh kali@<raspberry-pi-ip>
You should connect without entering a password.
Step 4: (Optional) Disable password authentication:
sudo nano /etc/ssh/sshd_config
Find and change:
PasswordAuthentication no
ChallengeResponseAuthentication no
Restart SSH:
sudo systemctl restart ssh
For graphical access over the network:
Install TigerVNC:
sudo apt install tigervnc-standalone-server tigervnc-common -y
Start VNC server:
vncserver :1
Set a VNC password when prompted.
Connect from your computer: Use a VNC client (RealVNC, TigerVNC Viewer) and connect to:
<raspberry-pi-ip>:5901
Adding a touchscreen creates a truly portable pentesting device.
Hardware connection:
The official display is automatically detected—no driver installation needed!
Most HDMI touchscreens require driver installation or configuration.
Example: Waveshare displays
# Clone the driver repository
git clone https://github.com/waveshare/LCD-show.git
cd LCD-show/
# Install driver for your model (example: 3.5" HDMI)
sudo ./LCD35-show
The Pi will reboot and configure the display.
sudo apt install xinput-calibrator -y
xinput_calibrator
Follow the on-screen prompts to touch calibration points.
Edit /boot/config.txt:
sudo nano /boot/config.txt
Add:
display_rotate=0 # 0=normal, 1=90°, 2=180°, 3=270°
Save and reboot:
sudo reboot
Install a virtual keyboard for touchscreen-only operation:
sudo apt install onboard -y
Launch from the application menu or:
onboard &
Transform your Raspberry Pi into a complete mobile pentesting platform.
Option 1: USB Power Banks
Use a quality power bank with these specifications:
Recommended models:
Runtime calculation:
Pi 4 average power: 5V × 1.2A = 6W
Power bank capacity: 10,000mAh × 3.7V = 37Wh
Estimated runtime: 37Wh ÷ 6W ≈ 6 hours (with efficiency losses ≈ 4.5 hours)
Option 2: UPS HAT Modules
Dedicated power HATs provide clean power and battery backup:
Advantages:
Option 3: Rechargeable Battery Packs
Fixed battery solutions:
Tactical/Portable Cases:
Compact Cases:
Considerations:
External antennas dramatically improve Wi-Fi range and signal quality.
USB adapter with antenna connector:
Antenna types:
Example setup:
Raspberry Pi → Alfa AWUS036ACH → RP-SMA extension cable → External 9dBi antenna
This setup can achieve 100+ meter range for Wi-Fi auditing.
Let's explore practical scenarios where a Kali Raspberry Pi excels.
Scenario: Security assessment of client wireless networks.
Setup:
Workflow:
sudo airmon-ng start wlan1
sudo airodump-ng wlan1mon
sudo airodump-ng -c 6 --bssid XX:XX:XX:XX:XX:XX -w capture wlan1mon
sudo aireplay-ng --deauth 10 -a XX:XX:XX:XX:XX:XX wlan1mon
Advantages:
Scenario: Persistent remote access during penetration tests (with authorization).
Setup:
Configuration:
Set up reverse SSH tunnel:
ssh -R 2222:localhost:22 -N -f user@your-server.com
Auto-start tunnel on boot:
sudo nano /etc/systemd/system/reverse-tunnel.service
Add:
[Unit]
Description=Reverse SSH Tunnel
After=network.target
[Service]
ExecStart=/usr/bin/ssh -R 2222:localhost:22 -N user@your-server.com
Restart=always
User=kali
[Install]
WantedBy=multi-user.target
Enable:
sudo systemctl enable reverse-tunnel.service
sudo systemctl start reverse-tunnel.service
Access from anywhere:
ssh -p 2222 kali@your-server.com
Use Cases:
Scenario: Man-in-the-middle attacks, credential harvesting (authorized testing only).
Setup:
Create fake AP:
Install hostapd and dnsmasq:
sudo apt install hostapd dnsmasq -y
Configure hostapd (/etc/hostapd/hostapd.conf):
interface=wlan0
driver=nl80211
ssid=FreeWiFi
hw_mode=g
channel=6
wmm_enabled=0
auth_algs=1
wpa=0
Configure dnsmasq (/etc/dnsmasq.conf):
interface=wlan0
dhcp-range=192.168.100.10,192.168.100.100,12h
dhcp-option=3,192.168.100.1
dhcp-option=6,192.168.100.1
Enable IP forwarding:
sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
Start services:
sudo systemctl start hostapd
sudo systemctl start dnsmasq
Capture traffic:
sudo tcpdump -i wlan0 -w rogue-ap-capture.pcap
Disclaimer: Only perform rogue AP attacks in authorized testing environments with written permission.
Scenario: Scheduled network reconnaissance and monitoring.
Setup script (/home/kali/scripts/auto-recon.sh):
#!/bin/bash
DATE=$(date +"%Y%m%d_%H%M%S")
TARGET="192.168.1.0/24"
OUTPUT_DIR="/home/kali/recon"
mkdir -p $OUTPUT_DIR
# Network scan
nmap -sn $TARGET -oN "$OUTPUT_DIR/hosts_$DATE.txt"
nmap -sV -sC -oN "$OUTPUT_DIR/services_$DATE.txt" -iL "$OUTPUT_DIR/hosts_$DATE.txt"
# Vulnerability scan
nmap --script vuln -oN "$OUTPUT_DIR/vulns_$DATE.txt" -iL "$OUTPUT_DIR/hosts_$DATE.txt"
echo "Recon complete: $DATE" >> $OUTPUT_DIR/recon.log
Scheduled execution (crontab):
crontab -e
Add:
0 2 * * * /home/kali/scripts/auto-recon.sh
This runs reconnaissance every night at 2 AM.
Maximize your Raspberry Pi's pentesting capabilities with these optimizations.
Edit configuration:
sudo nano /boot/config.txt
Add overclocking settings:
# Raspberry Pi 4
over_voltage=6
arm_freq=2000
gpu_freq=750
# Raspberry Pi 5
over_voltage_delta=50000
arm_freq=3000
Warning: Overclocking increases heat and power consumption. Ensure adequate cooling!
Monitor temperature:
watch -n 1 vcgencmd measure_temp
Keep temperatures below 80°C under load.
Increase swap for memory-intensive operations:
sudo dphys-swapfile swapoff
sudo nano /etc/dphys-swapfile
Change:
CONF_SWAPSIZE=2048
Restart swap:
sudo dphys-swapfile setup
sudo dphys-swapfile swapon
Disable unnecessary services:
sudo systemctl disable bluetooth.service
sudo systemctl disable avahi-daemon.service
sudo systemctl disable triggerhappy.service
Reduce boot delay:
sudo nano /boot/cmdline.txt
Add to end of line:
quiet
Disable IPv6 (if not needed):
sudo nano /etc/sysctl.conf
Add:
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
Apply:
sudo sysctl -p
Use external SSD for databases:
# Format USB SSD
sudo mkfs.ext4 /dev/sda1
# Create mount point
sudo mkdir /mnt/ssd
# Add to fstab
echo "/dev/sda1 /mnt/ssd ext4 defaults 0 0" | sudo tee -a /etc/fstab
# Mount
sudo mount -a
# Move PostgreSQL data (for Metasploit)
sudo systemctl stop postgresql
sudo mv /var/lib/postgresql /mnt/ssd/
sudo ln -s /mnt/ssd/postgresql /var/lib/postgresql
sudo systemctl start postgresql
Proper cooling is essential for sustained performance and hardware longevity.
Heatsinks:
Thermal pads:
Performance:
Case fans:
Fan control:
Manual (always on):
# Pin 14 (GPIO 4) high
echo "4" > /sys/class/gpio/export
echo "out" > /sys/class/gpio/gpio4/direction
echo "1" > /sys/class/gpio/gpio4/value
Automatic (temperature-based):
Install fan control script:
sudo apt install python3-gpiozero -y
Create script (/usr/local/bin/fan-control.py):
#!/usr/bin/env python3
import time
from gpiozero import OutputDevice
fan = OutputDevice(4)
THRESHOLD_TEMP = 60.0 # Start fan at 60°C
while True:
temp = float(open('/sys/class/thermal/thermal_zone0/temp').read()) / 1000
if temp > THRESHOLD_TEMP:
fan.on()
else:
fan.off()
time.sleep(10)
Make executable and run at boot:
sudo chmod +x /usr/local/bin/fan-control.py
sudo nano /etc/systemd/system/fan-control.service
Add:
[Unit]
Description=Temperature-based fan control
After=network.target
[Service]
ExecStart=/usr/bin/python3 /usr/local/bin/fan-control.py
Restart=always
[Install]
WantedBy=multi-user.target
Enable:
sudo systemctl enable fan-control.service
sudo systemctl start fan-control.service
Performance:
For extreme cooling:
Considerations:
The Raspberry Pi's 40-pin GPIO header enables hardware integration.
Raspberry Pi 4/5 GPIO layout:
3V3 (1) (2) 5V
GPIO2 (3) (4) 5V
GPIO3 (5) (6) GND
GPIO4 (7) (8) GPIO14 (UART TX)
GND (9) (10) GPIO15 (UART RX)
...
Full pinout: https://pinout.xyz
Visual feedback for drop box status:
Hardware:
Connection:
Control script:
#!/usr/bin/env python3
from gpiozero import LED
from time import sleep
status_led = LED(17)
while True:
status_led.on()
sleep(1)
status_led.off()
sleep(1)
Trigger actions with a button press:
Hardware:
Connection:
Detection script:
#!/usr/bin/env python3
from gpiozero import Button
import subprocess
button = Button(27)
def button_pressed():
print("Button pressed! Starting scan...")
subprocess.run(["nmap", "-sn", "192.168.1.0/24"])
button.when_pressed = button_pressed
print("Waiting for button press...")
pause()
Control high-power devices:
Use cases:
Hardware:
Connection:
Control:
from gpiozero import OutputDevice
from time import sleep
relay = OutputDevice(22)
relay.on() # Energize relay (close circuit)
sleep(5)
relay.off() # De-energize relay (open circuit)
For more Kali Linux tutorials, check out our complete tutorial series covering everything from installation in VirtualBox to essential post-installation setup.
Most Kali tools work on Raspberry Pi's ARM architecture, but some limitations exist:
Fully compatible:
Limited performance:
Not available:
Workaround: Use the Raspberry Pi for data collection and reconnaissance, then transfer captures to a more powerful workstation for intensive analysis.
Runtime depends on several factors:
Raspberry Pi 4 (4GB):
Raspberry Pi 5 (8GB):
Tips to extend battery life:
powersavePower bank recommendations:
Top recommendations for monitor mode and packet injection:
Best overall: Alfa AWUS036ACH
Best budget: Alfa AWUS036NHA
Ultra-portable: TP-Link TL-WN722N v1
Warning: Avoid newer versions of TL-WN722N (v2, v3) that use Realtek chipsets with poor monitor mode support.
Installation:
# Most adapters work out of the box, but if needed:
sudo apt update
sudo apt install realtek-rtl88xxau-dkms # For RTL8812AU
Yes, with realistic expectations:
Excellent for:
Not ideal for:
Performance comparison:
Best practice: Use the Raspberry Pi as a field device for data collection and reconnaissance, then perform intensive analysis on a more powerful system.
Yes, and it offers significant performance improvements:
Advantages of USB boot:
Requirements:
Setup process:
Step 1: Update bootloader (from SD card boot):
sudo apt update
sudo apt full-upgrade -y
sudo rpi-eeprom-update -a
sudo reboot
Step 2: Configure boot order:
sudo raspi-config
Navigate to:
Save and reboot.
Step 3: Flash Kali to USB drive (same process as SD card):
sudo dd if=kali-linux-*-raspberry-pi4-arm64.img of=/dev/sda bs=4M status=progress conv=fsync
Step 4: Power off, remove SD card, insert USB drive, power on.
The Pi will now boot from USB!
Recommended USB drives:
Running Kali Linux on Raspberry Pi creates a powerful, portable penetration testing platform that fits in your pocket. From on-site Wi-Fi auditing to covert drop box deployments, the combination of Kali's comprehensive toolset and the Raspberry Pi's compact form factor opens up new possibilities for security assessments.
We've covered everything from initial installation and configuration to building a complete mobile pentesting kit with battery power, cooling solutions, and hardware integration. Whether you're a professional penetration tester needing a discrete field device or an ethical hacking enthusiast exploring portable security tools, a Kali Raspberry Pi setup delivers exceptional value and capability.
Key takeaways:
✅ Choose the right hardware: Raspberry Pi 4 (4GB+) or Pi 5 for best performance
✅ Optimize for your use case: Headless drop box, mobile auditing, or full portable workstation
✅ Invest in quality peripherals: USB Wi-Fi adapters (Alfa) and power banks make a huge difference
✅ Implement proper cooling: Essential for sustained performance and hardware longevity
✅ Understand limitations: Use as a field device; perform intensive analysis on more powerful hardware
For more comprehensive Kali Linux guides, explore our tutorials section where you'll find everything from VirtualBox installation to creating bootable USB drives. Don't forget to check out our pentesting tools database for detailed information on the tools you'll be running on your Raspberry Pi.
Ready to build your mobile pentesting platform? Grab a Raspberry Pi, follow this guide, and start exploring the world of portable ethical hacking!
External Resources:
Author: Andrax Pentester / Syed Abrar
Last Updated: 2026
25 min read
Master Nano, Vim, and Emacs text editors for penetration testing on Kali Linux. Learn essential commands, shortcuts, and workflows for editing config files, bash scripts, and analyzing securi
28 min read