| Guide | GDE-022 |
| Topic | Kali Linux OSINT |
| Domain | OSINT tooling |
| Last updated | August 2026 |
Short answer: Install Kali as a VM, update it, add the information-gathering metapackage, confirm theHarvester and Recon-ng run, then register Maltego separately. Snapshot the result so each investigation starts from a clean baseline.
What is Kali Linux for OSINT?
Kali Linux for OSINT is a free, Debian-based Linux distribution that bundles reconnaissance tools, including theHarvester, Recon-ng, SpiderFoot and Maltego, into a single preconfigured environment rather than requiring an investigator to install and maintain each tool separately.
Kali Linux is maintained by OffSec as a rolling-release distribution built for penetration testing and security research, with fresh quarterly point releases. Its information-gathering toolset overlaps heavily with OSINT work: most of the command-line and framework tools referenced across other Signal & Shadow guides are preinstalled on Kali's official images or available directly from its repositories.
Investigators use it less for any single feature than for the environment itself: a disposable, resettable machine that keeps investigation tooling isolated from a personal device, its browsing history, its accounts and its files.
| • | Standing up a dedicated, disposable environment for OSINT work separate from a personal machine |
| • | Running command-line reconnaissance tools that have no polished standalone app |
| • | Trying several OSINT frameworks without managing individual installs and dependencies |
| • | Resetting to a clean snapshot before starting a sensitive or higher-risk investigation |
| • | Following OSINT training material and walkthroughs written against a Kali environment |
How do you set up Kali Linux for OSINT work?
Choose an installation method, install the information-gathering toolset, then confirm the core reconnaissance tools this guide covers are ready to run.
Free before paid. Every tool below is free; Kali itself carries no licence cost and none of the tools this guide configures require a paid tier to function.
Kali Linux: Free, no login required to download. The base distribution this guide covers, available as a pre-built VM image, a WSL package, a Live USB image or a bare-metal installer.
VirtualBox: Free and open source. The most common way to run Kali's official VM image without dual-booting or dedicating separate hardware.
theHarvester: Free and open source, included in Kali's information-gathering metapackage. Gathers emails, subdomains, hostnames and open ports from public sources against a target domain.
Recon-ng: Free and open source, included in the same metapackage. A modular reconnaissance framework with a workspace-based workflow suited to larger investigations.
SpiderFoot: Free and open source, packaged directly in Kali's repositories. Automates correlation across 200-plus data source modules; covered in more depth in Signal & Shadow's dedicated SpiderFoot guide.
Maltego Community Edition: Free with registration. Preinstalled on Kali images but requires its own separate Maltego ID account before it will run transforms; covered in Signal & Shadow's dedicated Maltego guide.