What Is Kali NetHunter

Kali NetHunter is a free, open-source mobile penetration testing platform for Android devices, built on top of Kali Linux. Released by Offensive Security in September 2014, it brings the full Kali toolset to smartphones and tablets — without needing a separate laptop. It works on rooted and non-rooted devices alike, depending on which edition you install.

How Kali NetHunter Works

NetHunter runs a Kali Linux environment directly on Android using a chroot container. This isolates the Kali filesystem from the Android OS while still accessing the device hardware. The setup includes the NetHunter app, a dedicated app store, and the Kali Desktop Experience (KeX) — which lets you run a full Kali desktop session via VNC or HDMI output.

The NetHunter app acts as a launcher for common attacks and services. From there, you can manage the Kali chroot, run Metasploit, start services, or configure network interfaces — all from a phone screen or a connected monitor.

Kali NetHunter Editions: Rootless, Lite, and Full

NetHunter ships in three editions. Each targets a different level of device access and capability.

NetHunter Rootless

This edition runs on any stock Android device without root or a custom recovery. It uses Termux and proot to set up a Kali environment, giving you access to most command-line tools. You won’t get Wi-Fi injection or HID attacks here — those require kernel-level support — but for network auditing, web app testing, or running tools like nmap and tcpdump, it works well.

NetHunter Lite

This edition is for rooted devices with a custom recovery (like TWRP) but no NetHunter-specific kernel. You get full root access inside the Kali chroot, which enables deeper integration and lets you run services with packet-level control. It’s the go-to option for older devices where active kernel development has stopped. Hardware-level attacks like HID exploitation still aren’t available at this tier.

NetHunter Full

The complete edition. It needs a custom kernel built specifically for your device. That kernel adds 802.11 wireless injection support, Bluetooth exploitation drivers, and USB gadget functionality for BadUSB and HID attacks. This is where NetHunter turns a phone into a hardware-level testing tool — capable of things most laptops can’t do without additional hardware.

Key Features of Kali NetHunter

Beyond the standard Kali toolset, NetHunter adds several attack classes that are specific to mobile hardware.

HID Keyboard Attacks let the device emulate a USB keyboard when connected to a target machine. The target treats it as a trusted input device, making it possible to execute pre-scripted commands without any interaction. BadUSB attacks work similarly — the device presents itself as a network adapter over USB, then performs man-in-the-middle interception on the target’s traffic.

Evil AP MANA attacks set up a rogue access point that captures credentials from devices trying to connect. With the full edition and a compatible USB adapter, you can also capture WPA handshakes using wireless 802.11 frame injection — something the ifconfig and wireless tooling in Kali handles cleanly once the kernel supports monitor mode.

NetHunter also includes the Social Engineer Toolkit, Metasploit Payload Generator, Exploit-DB SearchSploit, and a built-in wardriving module. The network interface tools and MAC changer are accessible directly from the app UI — no terminal required for basic operations.

Kali NetHunter vs Kali NetHunter Pro

NetHunter Pro is a separate project aimed at ARM64 Linux phones like the PinePhone and PinePhone Pro. While standard NetHunter runs on top of Android, NetHunter Pro runs Linux natively — no Android layer underneath. It supports dual-boot and provides a full desktop via HDMI on supported devices. The tradeoff is narrow device support; only a handful of ARM64 devices are officially compatible.

Standard NetHunter runs on a much wider range of Android hardware, including Samsung Galaxy, OnePlus, and Google Nexus devices. Official images are published quarterly by Offensive Security, and community build scripts cover dozens of additional models.

Supported Devices and Installation

NetHunter Rootless works on virtually any modern Android device — no compatibility list needed. For the Lite and full editions, Offensive Security publishes official images for popular devices, and the community maintains build scripts for others. Installation varies by edition: Rootless goes through Termux, while Lite and full editions are flashed via custom recovery.

The full edition also supports smartwatches running Android, such as the TicWatch Pro — a useful detail for covert physical assessments where a laptop would be conspicuous. You can use wget inside the Kali chroot to pull additional packages or scripts after the initial setup.

FAQs