> ## Content Index
> Fetch the complete content index at: https://taiwanding.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Installing Kali Linux on WSL2: A Complete Guide to Tooling Up for Windows/AD Pentesting
- URL: https://taiwanding.com/en/install-kali-linux-wsl2-windows-ad-pentesting-guide/
- Published: 2026-03-26T06:13:52.000Z
- Updated: 2026-07-15T02:50:30.000Z
- Author: Kevin Chen
- Tags: #en, #en-tool

> This post documents my full process of installing Kali Linux via WSL2 on a new machine — including my strategy for choosing a metapackage, a breakdown of the 2,534 packages inside kali-linux-large, and my notes on preparing tooling as I move from web penetration testing into Windows/AD internal-network pentesting. The target reader is a member of Taiwan's infosec community who already has some basic Linux experience and wants to start building out a pentesting environment.

## 0x00 Intro: Why WSL2?

If you're like me — your main working environment is Windows, but pentesting needs a Linux toolchain — then WSL2 is currently the most hassle-free option. Compared to a traditional VM (VirtualBox / VMware), WSL2's advantages are:

- **Fast startup**: no waiting for a VM to boot — just open a terminal and go
- **Low resource footprint**: it shares Windows' memory, so there's no need to pre-allocate
- **Easy file sharing**: the Windows and Linux filesystems can access each other directly
- **Shared networking**: no need to set up bridged networking separately

Of course WSL2 has its limits too — you don't get full control over the Linux kernel, and USB devices require extra setup through `usbipd-win` before they'll work (unlike a VM, which supports them natively). But for web penetration testing, bug bounty, CTF practice, or even tackling HackTheBox machines, WSL2 is more than enough.

## 0x01 Installation Steps

### Step 1: Enable WSL

Open PowerShell with **administrator privileges** and run:

```powershell
wsl --install

```

This command automatically enables WSL2 and the Virtual Machine Platform.

### Step 2: Confirm WSL2 as the Default Version

```powershell
wsl --set-default-version 2

```

### Step 3: Install Kali Linux

```powershell
wsl --install -d kali-linux

```

Once the install finishes, it'll ask you to set a username and password. That credential pair is your Linux user.

### Step 4: Enter Kali and Update the System

```bash
sudo apt update && sudo apt full-upgrade -y

```

At this point you have a clean Kali Linux environment. But right now it has **almost no pentesting tools** in it — not even nmap. The next thing to decide is which metapackage to install.

## 0x02 Metapackage Selection Strategy

Kali's metapackages are essentially "bundle packages" that let you install a whole set of tools at once, instead of installing them one by one. The main official metapackages are `kali-linux-core`, `kali-linux-headless`, `kali-linux-default`, `kali-linux-large`, and `kali-linux-everything`. Of these, `default` is explicitly built on top of `headless`, `large` adds a large set of extended tools on top of the official default tool set, and `everything` covers packages for nearly every purpose.

### kali-linux-core

The most minimal Kali base. It depends on `kali-system-core` (core system components) plus `netcat-traditional` and `tcpdump`. It isn't "just two tools" — it's a working minimal system base, suited to people who want to customize their toolset completely.

### kali-linux-headless

**The official tool set that doesn't require a GUI/X11.** It includes the core CLI tools you need for a standard pentest: nmap, sqlmap, gobuster, hydra, john, hashcat, metasploit-framework, aircrack-ng, and so on.

**Who it's for**: pure web bug bounty players, people who only need CLI tools, and the baseline choice for WSL2 users.

### kali-linux-default (\~13 GB and up)

The tool set from the official default image. It depends on `kali-linux-headless` \+ `kali-system-gui` \+ `kali-tools-top10`, and additionally adds GUI tools like autopsy and zenmap. `kali-tools-top10` includes popular tools such as Burp Suite and Wireshark.

**Who it's for**: Kali users running a full desktop environment. Under WSL2, GUI tools aren't much use unless you've set up Win-KeX or an X server.

### kali-linux-large (\~19 GB and up) ⭐ The focus of this post

The expanded version that adds a large set of extended tools on top of the official default tool set. This used to be Kali's default package set (formerly named `kali-linux-full`); after the 2019.3 release it was replaced by `default`, and its role shifted to being the "advanced extension pack." Tools like zaproxy (OWASP ZAP), evil-winrm, and certipy-ad only show up at this layer.

**Who it's for**: people who want to tackle Windows/AD machines, need a complete toolchain, and don't want to `apt install` something manually every single time.

### kali-linux-everything (\~34 GB and up)

Installs nearly everything. Unless you're doing pentesting in an offline/air-gapped environment, it's not recommended. Too many tools you'll never use just eat up space.

> **A note on sizes**: the numbers above are based on Kali 2024.1's official install-size page. Actual sizes vary depending on the desktop environment and system updates.

### My Choice: kali-linux-large

Since I was originally focused on web pentesting and only recently started dipping into Windows machines and AD environments, I went with `kali-linux-large`. My reasons:

1. **Complete Windows/AD toolchain**: evil-winrm, impacket, bloodhound.py, netexec, responder, and certipy-ad are all bundled in
2. **Saves the hassle of manual installs**: having to `apt install` something every time I hit a new machine gets annoying
3. **Space isn't an issue**: I have 200 GB+ free on disk, so 19.2 GB doesn't hurt at all

Install command:

```bash
sudo apt install -y kali-linux-large

```

## 0x03 Breaking Down kali-linux-large: What's Actually Inside Those 2,534 Packages?

In practice, installing `kali-linux-large` pulls in **2,534 packages**, with a download size of about **5.4 GB** and around **19.2 GB** of disk usage once installed.

These packages can be roughly grouped into the following categories:

### Information Gathering

| Tool                        | Purpose                           |
| --------------------------- | --------------------------------- |
| nmap / ncat                 | Port scanning and network probing |
| amass                       | Subdomain enumeration             |
| recon-ng                    | OSINT framework                   |
| theharvester                | Email / subdomain collection      |
| dnsenum / dnsrecon / dnsmap | DNS enumeration                   |
| masscan                     | High-speed port scanning          |
| nbtscan                     | NetBIOS scanning                  |
| enum4linux                  | SMB / LDAP enumeration            |
| arp-scan / netdiscover      | Local network host discovery      |
| dmitry                      | Deep information gathering        |
| fierce                      | DNS reconnaissance                |

### Web Penetration Testing

| Tool                        | Purpose                            |
| --------------------------- | ---------------------------------- |
| burpsuite                   | Web proxy / attack platform        |
| zaproxy                     | OWASP ZAP                          |
| sqlmap                      | Automated SQL injection            |
| nikto                       | Web server scanning                |
| gobuster / dirb / dirbuster | Directory brute-forcing            |
| ffuf                        | High-speed fuzzing tool            |
| wpscan                      | WordPress scanning                 |
| commix                      | Command injection tool             |
| xsser                       | XSS testing                        |
| wfuzz / skipfish            | Web fuzzing                        |
| whatweb / wafw00f           | Web fingerprinting / WAF detection |
| beef-xss                    | Browser exploitation framework     |
| joomscan                    | Joomla scanning                    |

### Windows / AD Pentesting ⭐ The Key Tools for Moving Into Internal Networks

This is the **most valuable part** of what `kali-linux-large` adds over `headless`:

| Tool                           | Purpose                                                        |
| ------------------------------ | -------------------------------------------------------------- |
| evil-winrm                     | WinRM remote connection (more convenient than RDP)             |
| impacket-scripts               | psexec, secretsdump, GetNPUsers, GetUserSPNs, etc.             |
| bloodhound.py                  | AD attack-path visualization (Python ingestor)                 |
| netexec                        | Bulk SMB/WinRM/LDAP/MSSQL scanning (successor to crackmapexec) |
| responder                      | LLMNR/NBT-NS poisoning attacks                                 |
| certipy-ad                     | AD Certificate Services (ADCS) attacks                         |
| mimikatz                       | Credential dumping (Windows binary)                            |
| nishang                        | Collection of PowerShell attack scripts                        |
| powersploit                    | PowerShell post-exploitation framework                         |
| smbmap / smbclient             | SMB share enumeration and access                               |
| ldap-utils                     | LDAP query tools                                               |
| passing-the-hash               | Pass-the-Hash tooling                                          |
| powershell-empire / starkiller | C2 frameworks                                                  |
| freerdp3-x11                   | RDP client (xfreerdp)                                          |

### Password Cracking

| Tool                                  | Purpose                                    |
| ------------------------------------- | ------------------------------------------ |
| john / john-data                      | John the Ripper                            |
| hashcat / hashcat-utils               | GPU password cracking                      |
| hydra                                 | Online password brute-forcing              |
| medusa                                | Parallel login brute-forcing               |
| ncrack                                | Network authentication cracking            |
| crunch / cewl                         | Wordlist generation                        |
| hashid / hash-identifier              | Hash type identification                   |
| ophcrack                              | Windows password cracking (rainbow tables) |
| rainbowcrack / rcracki-mt             | Rainbow table attacks                      |
| maskprocessor / statsprocessor / pack | Hashcat rule and mask tools                |
| fcrackzip / truecrack                 | Archive / TrueCrypt cracking               |

### Exploitation

| Tool                 | Purpose                                    |
| -------------------- | ------------------------------------------ |
| metasploit-framework | Penetration testing framework              |
| armitage             | Metasploit GUI                             |
| exploitdb            | Exploit database                           |
| msfpc                | MSFvenom payload generator                 |
| set                  | Social-Engineer Toolkit                    |
| gophish              | Phishing attack platform                   |
| caldera              | MITRE ATT&CK automated adversary emulation |

### Wireless

| Tool                               | Purpose                    |
| ---------------------------------- | -------------------------- |
| aircrack-ng                        | Wi-Fi cracking suite       |
| kismet                             | Wireless network detection |
| reaver / bully                     | WPS cracking               |
| wifite                             | Automated Wi-Fi attacks    |
| cowpatty                           | Offline WPA-PSK cracking   |
| mdk3                               | Wi-Fi DoS                  |
| hostapd / asleap                   | Rogue AP / LEAP cracking   |
| pixiewps                           | Offline WPS cracking       |
| bluelog / blueranger / bluesnarfer | Bluetooth attack tools     |

### Reverse Engineering

| Tool                 | Purpose                           |
| -------------------- | --------------------------------- |
| ghidra / ghidra-data | NSA reverse engineering framework |
| radare2              | Command-line reversing tool       |
| gdb                  | GNU debugger                      |
| edb-debugger         | GUI debugger                      |
| binwalk / binwalk3   | Firmware analysis                 |
| jadx                 | Android APK decompilation         |
| dex2jar              | DEX to JAR conversion             |
| apktool              | Android APK unpacking             |
| bytecode-viewer      | Java bytecode viewer              |

### Forensics

| Tool                      | Purpose                      |
| ------------------------- | ---------------------------- |
| autopsy / sleuthkit       | Digital forensics platform   |
| foremost / scalpel        | File carving                 |
| bulk-extractor            | Bulk data extraction         |
| dc3dd / dcfldd            | Forensic dd                  |
| ewf-tools                 | E01 image tools              |
| regripper / reglookup     | Windows registry analysis    |
| chntpw                    | Windows password reset       |
| extundelete / recoverjpeg | File recovery                |
| hashdeep                  | File integrity verification  |
| pasco / galleta           | IE browsing history analysis |

### Sniffing & Spoofing

| Tool               | Purpose                         |
| ------------------ | ------------------------------- |
| wireshark / tshark | Packet analysis                 |
| ettercap-graphical | MITM attacks                    |
| dsniff             | Password sniffing               |
| mitmproxy          | HTTP/HTTPS proxy                |
| netsniff-ng        | High-performance packet capture |
| yersinia           | Layer 2 attacks                 |
| hping3             | Packet crafting                 |
| hexinject          | Packet injection                |
| dnschef            | DNS proxy/spoofing              |

### Network Tunneling & Pivoting

| Tool         | Purpose                       |
| ------------ | ----------------------------- |
| proxychains4 | Proxy chaining                |
| socat        | Multipurpose network tool     |
| dns2tcp      | DNS tunneling                 |
| iodine       | DNS tunneling                 |
| ptunnel      | ICMP tunneling                |
| sslh         | SSL/SSH multiplexing          |
| stunnel4     | SSL-encrypted tunneling       |
| redsocks     | Transparent proxy redirection |
| udptunnel    | UDP tunneling                 |
| miredo       | Teredo IPv6 tunneling         |
| openvpn      | VPN connections               |

### Programming Languages & Development Environments

large also includes a complete development toolchain:

- **C/C++**: gcc, g++, make, gdb
- **Python**: a huge number of Python3 modules (over 500 python3-\* packages)
- **Ruby**: ruby3.3-dev + lots of gems (metasploit dependencies)
- **Go**: golang-1.24 (the foundation for tools like amass and gobuster)
- **Java**: openjdk-21 + openjdk-11 (needed by Burp Suite and ghidra)
- **.NET**: dotnet-sdk-6.0 (needed by cross-platform PowerShell)
- **Node.js**: nodejs + npm (some tools depend on it)
- **PHP**: php8.4 + apache2 (for spinning up test environments)
- **MariaDB / PostgreSQL**: database servers

### Reporting & Documentation

| Tool       | Purpose                               |
| ---------- | ------------------------------------- |
| dradis     | Pentest report collaboration platform |
| faraday    | Vulnerability management platform     |
| cherrytree | Hierarchical note-taking              |
| pipal      | Password analysis statistics          |
| cutycapt   | Web page screenshots                  |

## 0x04 Things to Watch Out for After Installing

### Naming Differences for Common Tools

On Kali, some tools have different names than you might expect:

| The name you expect | The actual name on Kali                      |
| ------------------- | -------------------------------------------- |
| httpx               | httpx-toolkit (the ProjectDiscovery version) |
| crackmapexec        | netexec (renamed in the newer version)       |
| xfreerdp            | xfreerdp3 (the freerdp3-x11 package)         |

### SecLists Path

After installing `seclists`, the wordlists live at:

```
/usr/share/seclists/

```

## 0x05 Moving From Web Pentesting Into Windows/AD: Notes on the Toolchain Shift

If you're like me — originally focused on web pentesting (bug bounty, PortSwigger Labs, web CTFs) and now wanting to start trying Windows machines and AD environments — here are my notes on making the toolchain switch.

### Web Pentesting vs Windows/AD Pentesting: A Difference in Tooling Mindset

**Web pentesting** usually follows this tool-usage pattern:

```
Recon → Find an entry point → Fire a payload → Grab the flag
(nmap → gobuster → sqlmap/burp → done)

```

**Windows/AD pentesting**, on the other hand, is a long chain:

```
Recon → Find an entry point → Initial foothold → Info gathering → Lateral movement → Privilege escalation → Own the domain controller
(nmap → web exploit → evil-winrm → bloodhound → impacket → mimikatz → DC)

```

The number and variety of tools is far greater, which is exactly why `kali-linux-large` suits this direction better than `headless`.

### My First Windows Machine

My first Windows machine was ElMariachi-PC on PwnTillDawn. The attack chain was simple:

1. **nmap** found SMB (445), RDP (3389), and ThinVNC on port 60000
2. Exploited **CVE-2019-17662** (ThinVNC Path Traversal) using `curl --path-as-is` to read the config file and grab the plaintext password
3. Used **xfreerdp** to connect to the desktop over RDP and grab the flag

### The AD Beginner Path From Here

With the complete toolchain in `kali-linux-large`, here are the beginner AD machines you can tackle next:

- **HackTheBox - Sauna**: an intro to AS-REP Roasting
- **HackTheBox - Forest**: classic AD fundamentals
- **HackTheBox - Active**: Kerberoasting + GPP passwords

The tools these machines require are all in large: `impacket-scripts` (GetNPUsers.py, GetUserSPNs.py), `bloodhound.py`, `evil-winrm`, `smbclient`, `ldap-utils`, and so on.

### A Suggested AD Fundamentals Skill Tree

```
Week 1: Understand basic AD architecture (DC, Domain, Trust, Kerberos vs NTLM)
Week 2: Learn to use BloodHound to read attack paths
Week 3: Practice the basic attacks (Kerberoasting, AS-REP Roasting, Pass-the-Hash)
Week 4: Tackle a full AD machine and write a writeup

```

## 0x06 Wrap-Up

| Item           | Recommendation                                                   |
| -------------- | ---------------------------------------------------------------- |
| Install method | WSL2 (easy, fast, good enough)                                   |
| Metapackage    | kali-linux-large (top pick for the Windows/AD direction)         |
| Disk space     | 200 GB is plenty; remember to compact the VHDX periodically      |
| GPU            | WSL2 has no Vulkan; tools that need a GPU should go through CUDA |
| Tool names     | httpx → httpx-toolkit, crackmapexec → netexec                    |

**If you're a pure web bug bounty player**, `kali-linux-headless` is enough — just manually install `feroxbuster`, `nuclei`, and `httpx-toolkit` on top.

**If you want to head in the Windows/AD direction**, go straight for `kali-linux-large`. It spares you the endless manual installs down the line and lets you focus on learning attack techniques instead of setting up your environment.