Turning an ordinary smartphone into a powerful security auditing tool is a task that requires technical training, but opens up unique opportunities. Kali NetHunter is a penetration testing platform specifically adapted for devices based on Android. It allows you to run tools like aircrack-ng, metasploit i nmap right from your pocket, turning your phone into a portable hacking station.
The installation process is not trivial and involves interaction with low-level system components. You have to go from unlocking the bootloader to configuring the kernel to support package injection. Mistakes at any stage can result in the device becoming unusable, so it is critical to understand each step before performing it.
In this guide, we will detail all the necessary steps, from selecting compatible hardware to the first successful attack in a test environment. We will not use automatic installers that hide the essence of the processes, but will consider manual installation via TWRP or a method without root access so that you have full control of your system.
Preparing equipment and choosing an image version
The first and most important step is choosing a compatible device. Not every smartphone is capable of fully performing functions Kali NetHunter. Ideal candidates are considered to be devices from the Google Nexus and Pixelseries, as well as some models from OnePlus and Xiaomi. The key factor here is the presence of a custom kernel with support for monitoring and injection modes for the Wi-Fi chipset.
There are three main installation options, each of which has its own requirements and limitations. The choice depends on whether you are ready to lose the warranty and data on the device.
- 📱 NetHunter Rootless —a version that does not require root access and unlocking the bootloader, works like a regular application, but with limited functionality.
- 🔓 NetHunter Lite —requires root access, but uses the standard Android kernel, which limits the ability to work with wireless interfaces.
- ⚡ NetHunter Full —full version with a custom kernel that supports all pentesting functions, including attacks on Wi-Fi and HID attacks.
To work with the full version, you will need to download the corresponding ZIP archive from the official repository Offensive Security. Make sure you choose an image that strictly matches the codename of your device (for example flounder for Nexus 9 or bacon for OnePlus One). Using the wrong image can lead to the gadget being “bricked.”
⚠️ Attention: Before starting any manipulations, be sure to create a complete backup copy of all important data. The process of unlocking the bootloader and flashing custom software leads to the complete removal of user data from the device.
Unlocking the bootloader and getting root access
If you chose the installation path for the full version or Lite, you need to get advanced access rights to the system. The standard procedure begins with enabling developer mode. To do this, go to Settings → About phone and quickly click 7 times on the item Build number. After this, a new section will appear in the menu For developers.
Inside the developer menu, activate the option USB Debugging. This will allow the computer to interact with the device via the protocol ADB. Next, you need to put your phone into fastboot mode. This is usually done with a combination of the power and volume down keys when the device is turned off, or with the command adb reboot bootloader via the terminal on the PC.
fastboot oem unlockRunning this command will erase all data on the device. A warning will appear on the smartphone screen confirming the action. After successfully unlocking the bootloader, the next step is to install a custom recovery, which is most often used TWRP. The recovery image is flashed with the command fastboot flash recovery twrp.img.
Obtaining root access is carried out by flashing the archive Magisk through the installed TWRP. This is a critical component to operate Kali NetHunteras it provides the application with the necessary privileges to manage network interfaces and make system calls. Without root access, the functionality of the platform will be severely limited.
☑️ Device preparation checklist
Installing NetHunter via custom recovery
After preparing the environment, you can proceed to the direct installation of the pentester operating system. Copy the downloaded ZIP archive Kali NetHunter to the internal memory of your smartphone or SD card. Reboot the device into Recovery Mode by holding down the corresponding buttons or using the command adb reboot recovery.
In the menu TWRP select item Install and find the archive with the NetHunter image. Before installation, it is recommended to completely clear partitions Data, Cache and Dalvik through the menu Wipeto avoid file conflicts. This is especially important if other custom firmware was previously installed on the device.
Start the installation process by swiping across the screen. The installer will automatically unpack the files, configure the environment chroot and install the necessary binary files. The process may take from 5 to 15 minutes depending on the memory speed of your device. When finished, press the button Reboot System.
⚠️ Attention: TWRP menu interfaces and section names may differ depending on the recovery version and smartphone model. Always check the documentation for your specific device to ensure you do not delete critical system partitions.
When you first boot, the system may run slower than usual as applications are optimized and the environment is adjusted. Don't panic if the download process takes longer than usual. After the Android desktop appears, you will see a new application Kali NetHunter in the menu.
What to do if the installation is frozen?
If the installation process is frozen during the unpacking stage, do not turn off the device immediately. Wait 20 minutes. If there is no progress, try rebooting into recovery and performing the installation again, having previously formatted the data partition in the ext4 file system.
Setting up the environment and updating tools
After successful installation, you need to carry out the initial setup of the application. Run Kali NetHunter and grant it superuser rights when prompted by Magisk. In the main menu of the application you will find a section Chroot Manager. This is where the main container with Kali Linux tools is managed.
The first thing you need to do is download the full image of the Kali file system. This can be an archive of several gigabytes, so it is recommended to use a stable Wi-Fi connection. In the application, press the button Update or Download Chroot. The system will download the required image and check its integrity.
| Component | Description | Default status |
|---|---|---|
| Chroot Environment | Full Kali Linux environment | Requires downloads |
| Kali Kernel | Specialized kernel with patches | Depends on the firmware |
| BusyBox | Set of command line utilities | Installed |
| HID Attack | Keyboard emulation for attacks | Requires configuration |
After downloading the image, you need to update the repositories and installed packages inside the container. This can be done through the app's GUI or through the terminal. Use command apt update && apt full-upgrade to get the latest versions of security tools. Regular updates are critical for effective work with vulnerabilities.
Use an external USB Wi-Fi adapter with the Atheros AR9271 or Realtek RTL8812AU chipset for full work with wireless networks. Built-in modules of smartphones often do not support monitoring mode.
Working with the terminal and basic commands
The main work in Kali NetHunter is carried out through the command line. The application provides a built-in terminal emulator that starts a session within chroot environment. To get started, enter the command nethunter in the Android terminal or run Kali Terminal from the NetHunter launcher.
You will find yourself in a Linux environment with root access. There are hundreds of security audit tools available here. To check the network functionality, use the utility ifconfig or ip addr. If you connected an external Wi-Fi adapter, it should appear in the list of interfaces, usually as wlan0 or wlan1.
You can use the power of nmapto scan the network. A simple command nmap -sV 192.168.1.1 will allow you to obtain information about the services running on the gateway. More complex tasks, such as intercepting WPA2 handshakes, require switching the interface to monitoring mode with the command airmon-ng start wlan0.
Do not forget that working with network packets requires caution. Conduct testing only on your own networks or in laboratory conditions specifically designed for this purpose. Unauthorized access to other people's networks is a violation of the law.
An external Wi-Fi adapter with support for packet injection is a prerequisite for conducting serious tests of wireless networks, since the built-in chips of smartphones often have software limitations.
Solving common problems and compatibility
During operation, users may encounter a number of technical difficulties. One of the most common problems is the lack of monitoring mode support for the built-in Wi-Fi module. In this case, the system will work, but the wireless network audit functions will not be available without external equipment.
Another common problem is unstable USB-OTG operation. Not all smartphones correctly supply power to external devices. If your adapter is not detected, try using an active USB hub with external power. Also make sure that the device kernel has the necessary drivers for your adapter model.
⚠️ Please note: Hardware specifications and compatibility are constantly changing. Before purchasing an external adapter, be sure to check the current list of supported devices on the official Kali Linux community forum or in the documentation for the specific version of NetHunter.
If the application crashes when you launch the terminal, check the access rights and the presence of an installed Chroot image. Sometimes reinstalling the application without deleting data or clearing the application cache in Android settings helps. For complex logging cases, use the command logcat in ADB to analyze the causes of the failure.
How to return the device to its original state?
To completely remove NetHunter and return to the stock firmware, you need to unlock the bootloader again (if it was closed), download the stock factory image for your device model and flash it via fastboot using the command flash-all.bat (Windows) or flash-all.sh (Linux/Mac).
Is it possible to install NetHunter without unlocking the bootloader?
Yes, there is a version for this NetHunter Rootless. It installs like a regular APK application and does not require root access. However, the functionality of this version is limited: you will not be able to use tools that require direct access to network interfaces and the system kernel, such as injection of Wi-Fi packets.
Will installing NetHunter erase all data on the phone?
When installing the full version through custom recovery (TWRP), the data will be deleted during the process of unlocking the bootloader and formatting partitions. The Rootless version does not require deleting data, but for stable operation of the full version, a clean installation is recommended.
Does NetHunter work on Android 13 and newer?
Support for new versions of Android depends on the specific device and the availability of a compatible custom kernel. The official NetHunter team is constantly updating images, but support may be delayed for the latest smartphone models. Always check the support status of your model on the official website.
Do you need a computer to install NetHunter?
For a full installation (Full/Lite), a computer is required to unlock the bootloader via fastboot and flash the recovery firmware. The Rootless version does not require a computer; installation is performed directly on the smartphone via a browser and file manager.
Is it safe to use NetHunter for training?
Using the platform is safe for the device if you follow the instructions. However, using tools to attack networks that you do not own is illegal. Use NetHunter exclusively for educational purposes, on your own networks or in special laboratory environments (CTF).