If you download the kali-linux-live-amd64.iso , you can burn it to a USB, boot it, and click the "Install Kali" icon on the desktop. This gives you a graphical installer.

A compromised ISO is the perfect vector for a supply chain attack. Threat actors routinely repackage legitimate Linux ISOs with rootkits, reverse shells, or cryptocurrency miners. Imagine spending a week learning to use msfvenom to generate payloads, only to realize that your own system was the target from the moment you booted the ISO.

Conversely, the "Installer" ISO also has a "Live" mode on the boot menu.

But if you navigate to kali.org , scroll to the Torrent section, verify the GPG signature, and flash it with dd or Rufus—congratulations. You have passed the first exercise.

Get SHA256SUMS and SHA256SUMS.gpg from the same folder as the ISO.

But before you can run a packet capture or crack a WPA handshake, you have to clear the first, most deceptively simple hurdle: