Published on: 2026-07-23
With package-lists, you can only include packages that are already available in the official Kali repository.
However, if you have custom packages, you can include them in the live image by placing the .deb files in a packages.chroot directory
(for example: kali-config/config-gnome/packages.chroot if you build the GNOME variant).
Metapackages are empty packages whose sole purpose is to have many dependencies on other packages.
They make it easier to install sets of packages that you often want to install together.
The kali-meta source package builds all the metapackages provided by Kali Linux.
| Metapackage | Description |
|---|---|
kali-linux-core | The base system (it is pulled by all the other metapackages) |
kali-linux-headless | The default Kali Linux installation — command line tools only |
kali-linux-default | The default Kali Linux installation — both command line and graphical |
kali-linux-large | Wider range set of tools, which are not as commonly used |
kali-linux-everything | Metapackage of all the metapackages and other packages (almost everything Kali provides — really huge!) |
kali-tools-top10 | The ten most popular tools |
kali-tools-web | Web applications assessment tools |
kali-tools-passwords | Password cracking tools |
kali-tools-wireless | Collection of 802.11, Bluetooth, RFID and SDR wireless assessment tools |
kali-tools-forensics | Forensic tools (finding evidence of what happened) |
kali-tools-802-11 | Wireless assessment and analysis tools (802.11) |
kali-tools-bluetooth | Bluetooth focused tools |
kali-tools-crypto-stego | Cryptography and steganography tools |
kali-tools-fuzzing | Fuzzing attack tools |
kali-tools-gpu | GPU-powered tools (tools making use of the computing power of your GPU) |
kali-tools-hardware | Tools designed for attacking hardware |
kali-tools-rfid | Radio Frequency IDentification (RFID) tools |
kali-tools-sdr | Software Defined Radio (SDR) tools |
kali-tools-voip | Voice Over IP tools |
kali-tools-windows-resources | Pre-compiled Microsoft Windows binaries |
You can leverage these metapackages when you create custom package lists for live-build.
The full list of available metapackages and the tools they include can be found on the official Kali documentation.
| Herramienta | Para qué sirve |
|---|---|
| autopsy | Interfaz gráfica del Sleuth Kit. Análisis de discos, recuperación de archivos, timelines, etc. |
| sleuthkit | Suite de línea de comandos para análisis de sistemas de archivos (fls, icat, mmls, fsstat…). |
| guymager | Creación de imágenes forenses de discos (muy usado en adquisición). |
| dc3dd / dcfldd | Clonación y creación de imágenes forenses con hash en tiempo real. |
| ddrescue | Recuperación de datos de discos dañados. |
| foremost / scalpel / magicrescue | File carving (recuperar archivos borrados por firmas). |
| binwalk / binwalk3 | Análisis y extracción de firmware y archivos embebidos. |
| bulk-extractor | Extrae correos, URLs, tarjetas de crédito, etc. de imágenes de disco. |
| plaso | Creación de timelines forenses (log2timeline). |
| regripper / reglookup / libhivex-bin | Análisis de registros de Windows. |
| ewf-tools | Manejo de imágenes Expert Witness Format (.E01). |
| afflib-tools | Manejo de formato AFF (Advanced Forensics Format). |
| exifprobe / exiv2 / metacam | Extracción de metadatos de imágenes. |
| pdf-parser / pdfid | Análisis de PDFs maliciosos o con metadatos. |
| hashdeep / md5deep / ssdeep | Cálculo y comparación de hashes (integridad y fuzzy hashing). |
| chkrootkit / rkhunter / unhide | Detección de rootkits. |
| creddump7 / samdump2 / polenum | Extracción de hashes y credenciales de Windows. |
| pasco / galleta / rifiuti / rifiuti2 | Análisis de historial de Internet Explorer / cookies / recycle bin. |
| dumpzilla | Análisis de perfiles de Firefox. |
| radare2 / rizin-cutter / rz-ghidra / edb-debugger / ollydbg | Análisis y reverse engineering de binarios. |
| jadx / apktool / bytecode-viewer / javasnoop | Análisis de aplicaciones Android/Java. |
| wireshark / tcpdump / tcpflow / tcpick | Análisis de tráfico de red (PCAPs). |
| yara | Detección de malware con reglas. |
| volatility-related (a través de python3-dfvfs, etc.) | Análisis de memoria (aunque Volatility 3 se suele instalar aparte). |
| gpart / gparted / parted / lvm2 | Manejo de particiones. |
| xmount / xplico | Montaje de imágenes y análisis de tráfico de red a nivel forense. |
| 7zip / cabextract / unrar | Extracción de archivos comprimidos. |
| lynis | Auditoría de seguridad del sistema. |
| forensic-artifacts | Base de conocimiento de artefactos forenses. |