Kali Linux is considered one of the best toolboxes for security testing. Even a slim RasPi is suitable as a host to use the powerful distribution.

Kali Linux  is considered one of the best distributions for penetration testing and forensic purposes. Thanks to the triumph of the Internet of Things (IoT), the Debian-based successor to Backtrack Linux has long been available not only for computers with Intel/AMD processors, but also for the numerous single-board computers used in the embedded segment.

For the Raspberry Pi, the project provides numerous images. Thus, in addition to images specially designed for the Pi Zero and Zero W, you also get images for the RasPi models 2, 3 and 4, whereby a system image for the ARMv8 architecture with 64 bit is now additionally available for these types.

It is noticeable that the ARM images for the Raspberry Pi are consistently about 1 GByte in size and are thus considerably smaller than the images for Intel/AMD architectures.

Installation

To use Kali Linux optimally on the RasPi, it is recommended to download the image designed for the respective model from the project page. Then unpack the compressed archive on a PC. Make sure that enough free space is available on the mass storage devices.

The image intended for the RasPi 3 and 4, for example, requires around 6.5 GBytes when unpacked. Therefore, only MicroSD cards with a size of at least 8 GBytes can be used, the project recommends 16 GBytes. You should also use a memory card that is as fast as possible, since Kali otherwise works agonizingly slow on the RasPi due to the low data transfer rates of the storage medium.

On a Linux computer, transfer the unpacked image to the memory card using the command from Listing 1. Then boot the RasPi from the newly created card.

$ dd if=Image of=/dev/mmcblk0 bs=4M

The operating system thereby guides you into a graphical login, which opens an XFCE desktop with a GTK3 theme after authentication with the user name kali and the password kali. It gets by without unnecessary visual effects and is easy to use thanks to a conventional design with a panel at the top of the screen and a conventional menu.

Localization

First, you customize the keyboard layout and localization of the desktop. To change the keyboard to the German layout, click on the Start button at the top left of the panel bar and select Settings in the Start menu. After that, all setting options appear to the right of it.

Select Keyboard and click the Layout tab in the window that opens. Now remove the checkmark in front of Use system defaults and click on the Add button in the lower left corner. In the selection list that opens, select the German layout. Then delete the English layout from the list of active keyboard layouts.

Since the Debian derivative, unlike many other distributions with XFCE desktop, does not offer an option for the geographical adjustment of the working environment in the settings dialog, open a terminal and enter dpkg-reconfigure locales in it.

Incognito

Since Kali Linux has now achieved a certain degree of fame even beyond specialist circles, it seems to make sense in some situations to disguise the use of the distribution, which specializes in security tests, in public. The Debian derivative therefore contains a so-called undercover mode since 2019, which you can reach via the Usual Applications | Miscellaneous menu.

A click on the menu item Kali Undercover Mode rebuilds the complete desktop on the Raspberry Pi within seconds, so that it looks like a Windows 10 desktop. To switch back to the familiar XFCE desktop, click on Kali Undercover Mode again.

Software

Kali Linux is not suitable as an all-round distribution and only includes a few applications in the conventional submenus that are also suitable for use as a normal desktop system.

The smaller graphical applications from the XFCE pool are also only partially pre-installed in Kali. Besides Xfburn, a program for burning optical media, and the file manager Thunar, you will only find the slim text editor Mousepad, the XFCE task manager and the XFCE terminal. Only the Firefox browser is available as larger standard applications. For recording screencasts, Kazam is used, a slim Python program that you find with its own launcher in the panel bar.

In return, Kali also brings a handsome number of tools for security-specific and forensic tasks to the Raspberry Pi. Thus, you will find eleven different application groups in the main menu, but the last one, Kali**&**OffSec Links, only contains a number of links to websites that provide instructions and deal with security-specific topics.

Pentesters concerned with credential security will find the Password Attacks and Wireless Attacks groups a first port of call for spotting weak passwords at all system levels, including wireless access. The selection of programs is not limited to checking conventional IT infrastructures, but also deals with current short-range technologies such as RFID.

Intended for ordinary IT systems, on the other hand, are the applications in the Information Retrieval category, which scan networks and provide information about them. The Vulnerability Analysis group overlaps with this to some extent. For the RasPi, however, Kali keeps only the network scanner Nmap in this category.

The group Establish access allows you to establish a connection across several proxies. However, it only contains the command line tool Proxychains. In Sniffing & Spoofing you will find the well-known graphical tool Wireshark, which allows you to record and analyze network traffic.

Other tools for locating vulnerabilities in the network can be found in the Web Applications and Database Assessment groups. Within them are tools for auditing WordPress installations and SQL databases. These overlap in these two categories. The Exploitation Tools group contains the Metasploit framework and Searchsploit, two applications for developing and applying exploits, although Searchsploit can also be used offline. In the Reverse Engineering group, you will also find the NASM shell, an assembler.

Most of the programs listed in the categories are command line tools. The call usually opens the program with the help parameter, so that you can see a list of the respective program-specific options in the terminal, partly also with examples of their application.

Trimmed down

In direct comparison with the Kali Linux version for Intel/AMD-based systems, it is noticeable that the RasPi variant contains considerably less software. For example, the forensics, reporting and social engineering tools categories integrated in the Linux variant are missing. The existing application categories also hold significantly fewer programs in the RasPi variant than in the x86-based version.

Most notably, all applications for short-range technologies like Bluetooth are missing, as well as new tools to scan the Internet of Things for security vulnerabilities, such as the home smart home installation. In addition, the Intel/AMD-based version also brings more standard applications for conventional purposes.

For example, the RasPi variant lacks submenus and applications that help uncover security vulnerabilities in heterogeneous IT infrastructures. This loss of important tools can be traced back to the partly very limited computing power of older RasPi models, which makes the use of resource-intensive applications seem pointless.

However, if you are using a device from one of the current series, it is possible to upgrade the existing Kali image after installation and thus obtain the same range of functions as with the variants for Intel/AMD-based computers. To do this, open the terminal and first update the package sources with administrator rights (Listing 2, first line). Then install the metapackage kali-linux-default (second line).

sudo apt-get update
sudo apt-get install kali-linux-default

It installs the missing applications including all dependencies, whereby the routine automatically detects the used computer architecture and operating system variant. On the RasPi 4, it reinstalls a whopping 2778 MBytes in the 64-bit version, which takes a correspondingly long time.

You should expect a time expenditure of two to three hours in this case, even with a fast SD card as the system drive. Also, before reinstalling these packages, check with df -h whether there is still enough free memory available.
If you do not need the complete range of functions, but only individual menus with their applications, you can find a corresponding metapackage for each submenu.

Superficial

You can also change the graphical working environment in the same way. The system supports Mate, LXDE, Gnome, KDE Plasma, i3, Enlightenment E17 and XFCE. With installation of the appropriate metapackages, you also get many of the desktop-specific applications and utilities.

The developers also provide metapackages for task-specific applications. If you would like to extend the basic package with further functions for a special task field, all tools, which Kali Linux combines in this area in a menu, can be installed separately.

For example, the documentation lists metapackages for hacking hardware components as well as special Bluetooth tools or tools for VoIP infrastructures. There is also a short description for each of the categorized applications.

If you want to encrypt the Kali system on the Raspberry Pi for security reasons, the developers offer an encryption option based on LUKS, but you have to set it up manually in a complex way. You can find detailed documentation about this on the Kali Linux website [3].

In the practical test

For the practical test the author used the distribution on an older RasPi 3 and a new RasPi 4 with 4 GByte RAM. The operating system works on all systems stably, their full achievement unfolds the combination however only with careful planning of the employment scenarios and the selection of the operating system variant oriented at it.

Accordingly, the hardware must also be suitable for the respective purpose. Basically, you should only consider sufficiently large and fast MicroSD cards as mass storage, since noticeable latencies already occur on the RasPi 3 when the SD card works too slowly.

On the Model 4, this phenomenon even occurred in an intensified form with older memory cards. For weaker systems like the RasPi 3 or even a second-generation device, you should also assemble your Kali Linux yourself using the metapackages due to the smaller RAM, in order to not use up resources unnecessarily and thus slow down the system.

Conclusion

Kali Linux also cuts a good figure on the Raspberry Pi. The system can be configured in great detail, for example to take into account the different hardware capacities of the individual model generations of the small computer. The very good documentation makes it easy for less experienced users to use all the tools. With the appropriate adaptation, Kali Linux on the RasPi is therefore hardly inferior to its larger siblings on Intel/AMD hardware.