Kali Linux 2024.3 Released With 6 New Penetration Testing Tools

Key Takeaways

• Kali Linux 2026.3, the third major update for the year, has been released, introducing six new penetration testing tools.
• The distribution now features Linux kernel 7.1.5 and an updated KDE Plasma 6.7 desktop environment.
• Significant enhancements have been made to Kali NetHunter, including wardriving support for the TicWatch Pro 3 series and improved compatibility with modern system components.
• Refreshed image-building scripts simplify the creation of Kali installations across various platforms, including non-Kali Debian hosts.

Kali Linux, the premier penetration testing distribution, has unveiled its third major update for 2026: Kali Linux 2026.3. Released on October 26, this iteration brings a suite of new tools for security professionals, an upgraded Linux kernel, and substantial improvements to its mobile testing platform, Kali NetHunter.

This release follows June’s Kali Linux 2026.2, which expanded its toolkit and refined virtual machine performance, and Kali Linux 2026.1, which focused on initial tool and mobile testing enhancements for the year.

Six New Penetration Testing Tools

The 2026.3 update integrates six new tools into Kali’s network repositories, expanding capabilities across web application analysis, network scanning, and radio frequency investigation.

Dalfox is an open-source scanner designed for automated cross-site scripting (XSS) detection and parameter verification, streamlining the discovery of critical web vulnerabilities.

For comprehensive web application mapping, Katana serves as a robust crawling and spidering framework. It assists researchers in identifying paths, files, and endpoints within web applications prior to in-depth testing.

Qsreplace facilitates repeatable web security tests by taking URLs from standard input and replacing query string values with a user-defined value, ideal for crafting consistent test scenarios.

Network reconnaissance gains a performance boost with Rustscan, a high-speed port scanner written in Rust. It efficiently scans broad port ranges and can seamlessly pipe its findings to Nmap for more detailed service enumeration.

Wireless security researchers will benefit from SDRangel, a Qt-based software-defined radio (SDR) front end. Supporting devices like RTL-SDR, BladeRF, and HackRF, it offers a visual interface for receiving, transmitting, and analyzing radio signals.

Finally, Snaffler-ng targets Windows SMB shares, diligently searching for exposed credentials and sensitive files. It supports NTLM and Kerberos authentication, DFS discovery, archive scanning, and offers various output formats, making it a powerful tool for internal network assessments.

These additions collectively empower security testers with enhanced capabilities for web discovery, XSS assessment, URL manipulation, rapid port scanning, radio frequency analysis, and file-share auditing. It is imperative that these tools are used exclusively on systems where explicit permission for assessment has been granted.

Linux Kernel 7.1.5 and Package Updates

Kali 2026.3 features a significant upgrade to its core, moving from Linux kernel 6.19 to 7.1.5. This kernel update, specifically 7.1.5-1kali1 for the rolling branch, underpins the entire distribution, providing critical enhancements in hardware support, driver compatibility, system calls, and security patches.

Users are advised to conduct thorough testing of wireless adapters, graphics drivers, virtualization tools, and any custom kernel modules to ensure compatibility before deploying the updated distribution in live security operations.

A major structural improvement in this release is the comprehensive refresh of Kali’s public image-building scripts. These are the same scripts used by the project to generate the official images available on the official Kali download page. The updated scripts now boast a more uniform structure, layout, command-line options, features, and output across all supported platforms.

Each refreshed project now includes a build-in-container.sh script. This script intelligently detects the presence of Docker or Podman, creates a build container, and executes the image build within that isolated environment. This innovation removes the prior requirement of building Kali on a Kali system, simplifying the process and making it more reproducible on other Debian-based hosts. Complementary to this, Kali has also enhanced its build documentation.

For users wishing to build a standard installer, cloning the kali-installer build repository, installing necessary packages, and executing sudo ./build.sh will generate a Kali rolling installer for AMD64 by default. Command-line options allow for customization, including hostname changes, package additions (like Rustscan), selection of kali-dev, choice of a netinst image, or targeting ARM64. Podman users can alternatively install Podman and run sudo ./build-in-container.sh.

The Kali team notes that some build scripts did not meet the 2026.3 deadline, with the remaining refresh slated for Kali 2026.4. Future stages will focus on automated builds, workflows, example configurations, and deeper customization. Teams utilizing CI jobs based on older scripts should review their pipelines, as changes introduced during this refresh may impact existing workflows.

KDE Plasma 6.7 and New Icons

The optional KDE desktop environment has been upgraded to Plasma 6.7. A notable new feature is per-screen virtual desktops, enabling users to change workspaces on individual monitors independently. This functionality is particularly useful for security professionals who manage multiple applications across displays, such as keeping Burp Suite on one screen, terminals on another, and documentation on a third. Plasma’s Overview also now supports quicker desktop switching via scrolling or Page Up/Page Down keys.

KDE Plasma 6.7 also delivers enhanced Wayland protocol and portal support, improved performance, and reduced power consumption for integrated Intel graphics, CPU-rendered applications, and multi-window full-screen setups. Other changes include the ability to duplicate network connections, and updates to System Monitor, software management, printing, background application display, microphone testing, and desktop search controls.

KDE has introduced a light and dark theme switch, refined the Breeze theme, reinstated the Oxygen and Air styles, and provided an early preview of its Union theming system.

Kali has also enriched its visual experience by adding icons to previously unadorned tools and updating existing ones. This makes applications easier to identify within the menu and on the Kali tools website. Despite the significant KDE updates, Xfce remains Kali’s default desktop environment.

Major Kali NetHunter Changes

Kali NetHunter, the project’s platform for Android and wearable security testing, sees some of the most innovative updates in this release. The team successfully addressed compatibility issues between modern systemd and udev components and older mobile kernels without requiring extensive patching.

Wardriving capabilities are now extended to the TicWatch Pro 3 series. An updated libnexmonkali library enables internal Wi-Fi monitor mode on the watch, allowing compatible tools within the Kali chroot, such as Aircrack-ng and Kismet, to leverage the watch’s wireless hardware. Kali’s TicWatch guide confirms support for all Pro 3 GPS, LTE, Ultra GPS, and Ultra LTE variants, although installation necessitates modifications to the bootloader, recovery, operating system, root, and NetHunter.

WearHunter is an experimental new feature allowing users to control a NetHunter watch from a phone via ADB over Wi-Fi or Bluetooth. It supports command execution and application installation, with further functionalities planned. NFC Arsenal now provides direct NFC access to the Kali chroot, enabling the reading, cloning, and editing of Mifare Classic cards without an external adapter. Additionally, the release introduces KernelSU support, facilitating the installation of a generated installer ZIP through the KernelSU application when paired with a patched kernel.

Other NetHunter improvements include fixes for TicWatch Pro 3 reboot issues and early support for devices that do not utilize a ramdisk. Bluetooth Arsenal’s airplane mode has been reinstated. Starting EvilTwin and Wardriving operations is now simpler, and custom commands support Nexmon monitor mode and Wifite. Kali also resolved a crash related to the NetHunter application’s storage request and delivered various other bug fixes and performance enhancements.

Nine new device kernels have been integrated, covering a range of devices including Google Pixel (LineageOS 22.2, Android 15), Huawei P9 (EMUI 8 or LineageOS 16), LG K20 Plus (LineageOS 14.1), Moto G Stylus 5G 2022 (LineageOS 23.2), Nubia Z17 (LineageOS 22.2), POCO X5 5G and Redmi Note 12 5G (crDroid 12), Redmi Note 5 Pro (LineageOS 18.1), Sony Xperia 10 V (LineageOS 23.2), and Ulefone Armor 34+ (Android 16).

The release announcement also highlighted the “Wardriver Project,” a custom 2021 Honda Civic Type R showcased at the Cars and Cops event in Altus, Oklahoma. This project demonstrated the convergence of vehicle culture, wireless research, and cybersecurity in a single build.

Website and Documentation Updates

Kali has synchronized the category layout and icons from its desktop menu with the kali.org/tools website. Users who prefer the previous, more concise view can still access the Top 100 tools page.

The documentation has been expanded with three new pages: guides on extracting and squashing vendor firmware for mainline Linux, importing a pre-made Kali QEMU virtual machine, and utilizing NetHunter EvilTwin.

Nine existing guides have been updated, covering topics such as Live USB persistence, resolving graphics issues on bare-metal systems, NetHunter on the TicWatch Pro 3, Kali as a UTM guest, the Xfce FAQ, Kali NetHunter, Raspberry Pi full-disk encryption, setting up a Kali mirror, and SSH configuration.

The release cycle also saw the addition of four new European mirrors. The Netherlands gained mirror.hacker.nl and mirror.netone.nl, Portugal added mirror.randhost.com, and Switzerland received kalimirror.velden.media. While Kali’s mirror system directs users to nearby servers, its documentation strongly advises against adding extra repositories to the Kali source configuration, as this can lead to installation instability.

Kali expressed gratitude to the community members who contributed to documentation, tool pages, NetHunter, and package maintenance. The extensive list of contributors underscores the significant role external contributions play in developing mobile kernel support, device integration, documentation, and packaging efforts.

Downloading and Upgrading Kali 2026.3

New users can obtain tested installer, live, virtual machine, ARM, cloud, container, and NetHunter images from the official Kali download page. Kali recommends using the latest point-release image for most users. While weekly images contain more recent packages and can reduce post-installation updates, they are automated builds and do not undergo the same level of quality assurance as standard point-release images.

Existing Kali rolling users should first verify that /etc/apt/sources.list.d/kali.sources correctly points to the official kali-rolling repository, including the main, contrib, non-free, and non-free-firmware components. After confirmation, users can execute sudo apt update followed by sudo apt full-upgrade -y. If the system indicates a reboot is necessary, users should restart before verifying the update.

To confirm the installed release, run grep VERSION /etc/os-release, which should display 2026.3. The active kernel version can be checked with uname -r; for an AMD64 release, this might show 7.1.5+kali-amd64, though the exact kernel string may vary by architecture.

Kali’s guidance recommends checking for updates regularly (every few days or weeks), or sooner if a critical tool or security fix is released. It also advises testing all necessary tools before any planned security engagement and avoiding updates during active work, as a rolling package change could potentially disrupt a tool at an inconvenient moment.

What You Should Do

• New Installations: Download the latest Kali Linux 2026.3 images from the official Kali download page. Opt for the point-release images for stability.
• Existing Rolling Users: Ensure your /etc/apt/sources.list.d/kali.sources points to the official kali-rolling repository with all required components.
• Update Sequence: Execute sudo apt update followed by sudo apt full-upgrade -y to update your system. Reboot if prompted.
• Verify Installation: Confirm the updated version with grep VERSION /etc/os-release and the kernel with uname -r.
• Test Tools: Before any critical security engagement, test all necessary tools to ensure compatibility and functionality with the new kernel and updated packages.
• Avoid Updates During Engagements: Refrain from performing system updates during active penetration testing or security work to prevent potential tool breakage from rolling package changes.
• Review Build Scripts: If you use Kali’s build scripts for custom images, review your pipelines due to the refreshed script structure, as older workflows may be affected.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.