01
What it is
Kali Linux for OSINT is a free, Debian-based Linux distribution that bundles reconnaissance tools, including theHarvester, Recon-ng, SpiderFoot and Maltego, into a single preconfigured environment rather than requiring an investigator to install and maintain each tool separately.
Kali Linux is maintained by OffSec as a rolling-release distribution built for penetration testing and security research, with fresh quarterly point releases. Its information-gathering toolset overlaps heavily with OSINT work: most of the command-line and framework tools referenced across other Signal & Shadow guides are preinstalled on Kali's official images or available directly from its repositories.
Investigators use it less for any single feature than for the environment itself: a disposable, resettable machine that keeps investigation tooling isolated from a personal device, its browsing history, its accounts and its files.
When to use this guide
- Standing up a dedicated, disposable environment for OSINT work separate from a personal machine
- Running command-line reconnaissance tools that have no polished standalone app
- Trying several OSINT frameworks without managing individual installs and dependencies
- Resetting to a clean snapshot before starting a sensitive or higher-risk investigation
- Following OSINT training material and walkthroughs written against a Kali environment
02
How do you set up Kali Linux for OSINT work?
Choose an installation method, install the information-gathering toolset, then confirm the core reconnaissance tools this guide covers are ready to run.
Free before paid. Every tool below is free; Kali itself carries no licence cost and none of the tools this guide configures require a paid tier to function.
Kali Linux: Free, no login required to download. The base distribution this guide covers, available as a pre-built VM image, a WSL package, a Live USB image or a bare-metal installer.
VirtualBox: Free and open source. The most common way to run Kali's official VM image without dual-booting or dedicating separate hardware.
theHarvester: Free and open source, included in Kali's information-gathering metapackage. Gathers emails, subdomains, hostnames and open ports from public sources against a target domain.
Recon-ng: Free and open source, included in the same metapackage. A modular reconnaissance framework with a workspace-based workflow suited to larger investigations.
SpiderFoot: Free and open source, packaged directly in Kali's repositories. Automates correlation across 200-plus data source modules; covered in more depth in Signal & Shadow's dedicated SpiderFoot guide.
Maltego Community Edition: Free with registration. Preinstalled on Kali images but requires its own separate Maltego ID account before it will run transforms; covered in Signal & Shadow's dedicated Maltego guide.
Before you begin
Stop at the login
Kali's official Live Boot and pre-built VM or ARM images use the default credentials kali/kali, unchanged since Kali moved to a non-root user policy in the 2020.1 release. A bare-metal or WSL installation prompts for a custom username and password instead; either way, change the default password on first boot before installing anything further.
Legal considerations
Kali Linux itself is legal to download, install and run anywhere; it is a general-purpose Linux distribution, not a restricted or regulated tool. What is not automatically legal is how its individual tools are pointed: running an information-gathering scan against a target you do not own or have authorisation to assess can cross into unauthorised access depending on jurisdiction and the tool's aggressiveness. Passive OSINT lookups against public sources carry materially less legal exposure than active scanning.
The method
01
Choose an installation method and get Kali running
Goal · Get a working Kali environment before installing any OSINT-specific tooling
For most investigators, the official pre-built VM image for VirtualBox or VMware is the fastest path: import the image, boot it, and log in with kali/kali. WSL is a lighter option for Windows users who want command-line tools without a full VM. A Live USB or bare-metal install suits investigators who want Kali as a dedicated resettable machine rather than a guest inside another OS.
02
Update the system before installing anything
Goal · Avoid installing OSINT tools against an outdated package base
Run sudo apt update followed by sudo apt full-upgrade on first boot, since Kali is a rolling release and its official images can be weeks old by the time they are downloaded. Reboot if the upgrade flags a required restart.
03
Install the information-gathering metapackage
Goal · Pull in Kali's OSINT-relevant toolset in one step rather than installing tools individually
Run sudo apt install kali-tools-information-gathering to install the metapackage covering Kali's open-source intelligence tools, including theHarvester and Recon-ng if they are not already present on the image. Full installs (Kali Everything) include this by default; lighter images do not.
04
Confirm theHarvester and Recon-ng run correctly
Goal · Establish the two baseline command-line tools work before layering on anything else
Run theHarvester -d example.com -b all against a domain you control to confirm the tool runs and returns results, then launch recon-ng and run workspaces create test to confirm the framework initialises. Both ship with Kali's information-gathering metapackage and need no separate account.
05
Install and launch SpiderFoot
Goal · Add automated multi-source correlation to the toolchain
SpiderFoot ships in Kali's repositories; if it is not already present, install it with sudo apt install spiderfoot. Launch it with spiderfoot -l 127.0.0.1:5001 and open the address in a browser to reach its web interface. No account is required for the self-hosted tool itself, though individual modules need their own free-tier API keys for full coverage.
06
Register Maltego separately
Goal · Activate the one preinstalled tool that needs its own account before it will run
Maltego ships on Kali images but will not run transforms until activated with a free Maltego ID. Register through Maltego's Community Edition page and log in from the desktop application on first launch; this is the same registration step covered in Signal & Shadow's dedicated Maltego guide.
07
Snapshot the environment once configured
Goal · Preserve a clean, working baseline to return to
Take a VM snapshot, or note the WSL or bare-metal state, once the toolchain above is installed and confirmed working. Reverting to this baseline before each new investigation keeps the environment disposable rather than accumulating case-specific files and history over time.
03
What goes wrong with a Kali OSINT setup?
Most problems come from the environment itself, not the tools it runs.
An outdated image looks broken, not old: A Kali VM or ISO downloaded months ago can have package conflicts or missing dependencies that look like a tool failure rather than what it actually is, a stale rolling-release snapshot.
Verifying check: Run a full update and upgrade before troubleshooting an installation error, and check the image's release date against Kali's current point release before assuming a tool is broken.
Preinstalled does not mean configured: Tools like Maltego and SpiderFoot ship on the Kali image but are not usable out of the box; Maltego needs a separate account, and several SpiderFoot modules need their own API keys.
Verifying check: Distinguish the binary being present from the tool being ready to use before reporting a tool as installed and working.
Default credentials are public knowledge: The kali/kali login on official VM and Live images is documented and well known, not a meaningful security boundary.
Verifying check: Treat kali/kali as a setup convenience to change immediately, not as protection for anything sensitive stored in the environment.
Active scanning tools carry more legal exposure than passive lookups: Kali bundles both passive OSINT tools and active scanning tools, such as port and vulnerability scanners, in the same information-gathering category, and it is easy to reach for an aggressive tool out of habit.
Verifying check: Confirm whether a given tool queries public sources passively or actively contacts the target before running it against anything you do not have explicit authorisation to assess.
Chain of custody: A Kali environment is infrastructure, not evidence. Document the setup rather than the machine itself, since the environment's configuration affects how reproducible a finding is.
Record the Kali image version or release date used for the investigation.
Note which tools and metapackages were installed, and when.
Export findings from each tool immediately rather than relying on the live environment as the record.
Snapshot or document the environment state at the point findings were generated, in case a tool's behaviour needs to be reproduced later.
04
Go deeper
Reference cards for the workflows this environment supports.
CARD · OPS-001
OPSEC for investigators: eight-step baseline.
Signal, Mullvad and ProtonMail. Device separation and session documentation to chain-of-custody standard.
CARD · DIG-001
WHOIS investigation: domain name to attribution chain.
ViewDNS, SecurityTrails and crt.sh. Registrant email pivots that map infrastructure and hosting networks.
TUTORIAL · T22 · PREMIUM
Network mapping with Maltego and Gephi.
Build, visualise and interrogate relationship graphs using open-source and community transforms.
Evidentiary standard
Signal & Shadow operates to the LST-001 evidentiary standard. All claims are graded against the LST-001 v1.0.3 confidence tiers (Confirmed, Corroborated, Reported, Alleged) per the canonical voice and structural specification.
About Signal & Shadow
Signal & Shadow is an independent forensic investigation and methodology practice publishing tutorials, reference cards, and forensic dossiers for working practitioners. Founded by Derek Bowler.
