Why This Matters
When you install Kali Linux, it boots and it runs. But a default install is not finished. The system is out of date the moment it is installed, the password is the well-known default, and a lot of small settings make daily work harder than it needs to be. This guide fixes all of that.
The list below is the same routine I follow on every new Kali machine, whether it is a virtual machine, a USB install, or bare metal. You do not need to do all 25 in one sitting. Start with the first nine — update and security — because those matter the most. The rest you can do when you have time.
First: Update and Check Your System
1. Run a full system update
Do this before anything else. Kali is a rolling release, which means updates come out all the time. A fresh image is already weeks or months behind. Use full-upgrade, not plain upgrade — Kali needs it because packages change often.
2. Check your Kali version and kernel
It is good to know exactly what you are running. This helps later when you search for help or report a bug.
3. Check your software sources
Your update sources should point to the official Kali repository. If updates fail with a key error, the signing key is usually the problem. Open the file and make sure it has the correct line.
4. Know your user (do not live as root)
Since 2020, Kali uses a normal user called kali instead of logging you in as root. This is safer. Keep it this way. Run single commands with sudo when you need root, but do not run the whole desktop as root for daily work. If you're setting up a server rather than a desktop, this same principle is step one of my full Linux server hardening guide.
Lock Down Security
5. Change the default password
The default login on a fresh Kali install is kali / kali. Everyone knows this. Change it right away, especially if the machine is reachable on a network.
6. Regenerate the SSH host keys
Every Kali image ships with the same SSH host keys. If you ever turn on SSH without changing them, your machine is easy to impersonate. Generate fresh keys now so you do not forget later.
7. Keep SSH off unless you need it
Kali keeps the SSH service disabled by default, which is correct. Only turn it on if you actually need to connect to the machine remotely. When you are done, turn it off again.
8. Set up a firewall
UFW (Uncomplicated Firewall) is the easiest way to control what can reach your machine. Install it, deny incoming connections by default, and turn it on.
9. Take a clean snapshot
If you run Kali in VirtualBox or VMware, take a snapshot now, while the system is fresh and updated. When you break something later — and you will — you can roll back to this clean state in seconds instead of reinstalling. In VirtualBox this is Machine → Take Snapshot. In VMware it is VM → Snapshot → Take Snapshot.
If You Run Kali in a Virtual Machine
10. Install the guest tools
Guest tools give you a proper screen resolution, a shared clipboard, and shared folders between your host and Kali. Without them, the window stays small and copy-paste does not work. Install the package that matches your software, then reboot.
11. Turn on shared folders and the clipboard
In your VM settings, set the shared clipboard to Bidirectional and add a shared folder. On VirtualBox you also need to add your user to the vboxsf group so you can read the shared folder.
12. Set your timezone and locale
Timestamps in your logs and tools should match your real time. Set the timezone and the system language once.
Make Kali Comfortable to Use
13. Get to know your shell
Kali uses Zsh as the default shell, not Bash. It is already set up with a clean prompt and good defaults, so you do not need to change anything. Just know that your settings file is ~/.zshrc, not ~/.bashrc.
14. Add a few aliases
Aliases are short names for commands you type often. Add them to ~/.zshrc, then reload the file. These three save a lot of typing.
15. Install quality-of-life tools
A few small tools make the terminal nicer to work in. tmux lets you split one terminal into many panes, htop shows running processes clearly, and bat is a better version of cat with colors.
16. Pick a text editor you like
You will edit scripts and notes a lot. The terminal editor nano is already installed and is fine for quick edits, and Kali's Xfce desktop also ships with the graphical editor Mousepad. For longer coding work, many people prefer VS Code or its open-source build VS Codium. These are not in Kali's repository, so download the .deb from the official site and install it like this.
17. Set up Git
Many tools and wordlists live on GitHub, and you will clone them often. Set your name and email once so Git stops asking.
Set Up Your Pentest Toolkit
18. Install the larger tool set (if you used a light install)
The default Kali image already has the common tools. But if you installed the light or minimal version, you are missing a lot. The kali-linux-large metapackage installs the full standard toolkit. It is several gigabytes, so do it on a good connection.
19. Install drivers for your WiFi adapter
If you plan to do wireless testing, you need a USB WiFi adapter that supports monitor mode. Built-in laptop WiFi usually does not work for this. Many adapters also need a driver package. If you do not have an adapter yet, see my guide to the best WiFi adapters for Kali Linux.
20. Download and prepare wordlists
Password cracking needs wordlists. Kali includes the famous rockyou.txt, but it comes compressed. Unzip it now so it is ready. For more lists and where to get them, read my full guide to wordlists for Kali Linux.
21. Set up your browser for web testing
If you will test web applications, install the FoxyProxy extension in Firefox to switch your proxy on and off quickly, and import Burp Suite's certificate so HTTPS traffic shows up. The full steps are in my Burp Suite tutorial.
22. Build a safe practice lab
You cannot legally practice on real targets, so build your own. The standard setup is your Kali machine plus an intentionally vulnerable machine like Metasploitable 2 or DVWA, all on a private network that is not exposed to the internet. My Top 10 Kali tools guide explains how the lab fits together.
23. Bookmark legal practice platforms
When you do not feel like building VMs, online labs are ready to go. TryHackMe is good for beginners with guided rooms. HackTheBox is harder and feels closer to real targets. Both are legal because the targets belong to them.
Build Good Habits
24. Learn the basic commands
Almost everything in Kali happens in the terminal. If commands still feel confusing, spend an hour with my guide to the Kali Linux commands every beginner should know. Once those feel natural, every tutorial on this site becomes easier to follow.
25. Make updating a weekly habit
Because Kali rolls forward constantly, an old install breaks in strange ways. Run your update command once a week. If you made the alias in step 14, this is just one word.
Once your install is dialed in, the fastest way to go from "tools installed" to "actually knows what I'm doing" is a good book. These three are the ones I recommend most:
- Linux Basics for Hackers (OccupyTheWeb) — the best starting point if you're new to Linux and the command line. View on Amazon →
- The Hacker Playbook 3 (Peter Kim) — practical, scenario-based, and modern; great once you have the basics down. View on Amazon →
- The Web Application Hacker's Handbook — the foundational web-pentesting reference; pairs perfectly with our Burp Suite tutorial. View on Amazon →
Affiliate links — I may earn a small commission at no extra cost to you. Full disclosure.
Frequently Asked Questions
What is the first thing I should do after installing Kali Linux?
Run a full system update with sudo apt update && sudo apt full-upgrade -y. A fresh Kali image is already out of date because Kali is a rolling release, and many later steps depend on having current packages. After that, change the default password and set up a firewall.
Is the default Kali username and password still kali / kali?
Yes. Since the 2020.1 release, Kali logs in as a normal user named kali with the password kali, instead of using the root account. Change this password right away with the passwd command, especially if the machine can be reached over a network.
Should I run Kali Linux as root?
No. Modern Kali uses a normal user on purpose because it is safer. Run individual commands with sudo when you need root access, but do not log in to the whole desktop as root for everyday use. Running as root makes it easy to damage the system by mistake.
Do I need to update Kali Linux often?
Yes, about once a week. Kali is a rolling release, so updates arrive continuously. If you let an install fall months behind, upgrades can fail or break tools. Always use full-upgrade rather than plain upgrade, because Kali expects that behavior.
Why is my Kali screen so small in VirtualBox?
You have not installed the guest tools yet. Run sudo apt install -y virtualbox-guest-x11 and reboot. After that, the screen will resize to fill the window and the shared clipboard will start working.
Do I need a special WiFi adapter for Kali Linux?
For wireless testing, yes. Most built-in laptop WiFi cards do not support monitor mode or packet injection, which WiFi attacks require. You need a compatible USB adapter, and some need an extra driver package. See the guide to the best WiFi adapters for Kali Linux for tested options.
