Hello 2024! Today we are unveiling Kali Linux 2024.1. As this is our the first release of the year, it does include new visual elements! Along with this we also have some exciting new mirrors to talk about, and of course some package changes – both new tools and upgrades to existing ones. If you want to see the new theme for yourself and maybe try out one of those new mirrors, download a new image or upgrade if you have an existing Kali Linux installation.The summary of the changelog since the 2023.4 release from December is:Introducing the Micro Mirror Free Software CDNWith this latest release of Kali Linux, our network of community mirrors grew much stronger, thanks to the help of the Micro Mirror CDN! Here’s the story.Last month we replied to a long-forgotten email from Kenneth Finnegan from the FCIX Software Mirror. The FCIX is a rather big mirror located in California, and they reached out to offer to host the Kali images on their mirror. To which we answered yes please, and that was it; shortly after, the Kali images were added to the FCIX mirror. So far so good, and it could have been the end of the story, but then Kenneth followed up:We’re now also operating another 32 other mirrors which are optimized for minimal storage and hosting only the highest traffic projects […] Would the Kali project be willing to accept ten additional mirrors from the FCIX organization?Wow, 10 additional mirrors, that sounds very nice indeed! But, wait, 32 mirrors??? How come? Where do all those mirrors come from? That was intriguing. As it turns out, Kenneth operates a network of mirrors, which was officially announced back in May 2023 on his blog: Building the Micro Mirror Free Software CDN. For anyone interested in Internet infrastructure, we encourage you to read it, that’s a well-written blog post right there, waiting for you.So what is the Micro Mirror CDN exactly? One-liner: a network of mirrors dedicated to serving Linux and Free Software. Contrary to traditional mirrors that host around 50TB of project files, Micro Mirrors are machines with “only” a few TB of storage, that focus on hosting only the most high-demand projects. In other words: they provide additional bandwidth where it’s needed the most. Another important difference with traditional mirrors is that those machines are not managed by the sponsor (the organization that funds the mirror). Usually, a sponsor provides the bandwidth, the mirror, and also administrates it. While here, the sponsor only provides the bandwidth, and it’s the FCIX Micro Mirror team that does everything else: buy the hardware, ship it to the data-center, and then manage it remotely via their public Ansible playbook.For anyone familiar with mirroring, it’s quite exciting to see such a project taking shape. Free software and Linux distributions have been distributed thanks to community-supported mirrors for almost three decades now, it’s a long tradition. It’s true that we’ve seen some changes over the last years, and these days some of the biggest FOSS projects are entirely distributed via a CDN, leaving behind the mirroring system. For Kali Linux we use a mixed approach: it is distributed in part thanks to 50+ mirrors across the world, and in part thanks to the Cloudflare CDN that acts as a ubiquitous mirror. We are lucky to benefit from a very generous sponsorship from Cloudflare since 2019. But smaller or newer projects don’t get this chance, thus community mirrors are still essential to free software distribution. That’s why it’s nice to see a project like the Micro Mirror CDN, it’s a novel approach in the field of mirroring, and with Kali Linux we are very grateful to be part of the journey.For any organization out there that has spare bandwidth and wants to support free software, the Micro Mirror project might be something you are interested in. You might want to look at their product brief for a more thorough description of the service, and email mirror at fcix dot net for more information. we’ll just quote one line that summarize it really well:From the hosting sponsor’s perspective, the Micro Mirror is a turnkey appliance, where they only need to provide network connectivity and remote hands to install the hardware, where all sysadmin and monitor work is handled by the FCIX team with the economy of scale on our side.A big thanks to the FCIX team, and Kenneth Finnegan in particular, for their generous offer. Thanks to their help, the Kali images are now served from ten additional mirrors: seven in the US, one in Colombia, one in the UK and one in Australia.And while we are talking about mirrors: we also got plenty of new mirrors from various sponsors during this release cycle, check the dedicated section below for details.2024 Theme RefreshAs for previous 20**.1 releases, this update brings with it our annual theme refresh, a tradition that keeps our interface as cutting-edge as our tools. This year marks the unveiling of our newest theme, meticulously crafted to enhance user experience from the moment you boot up. With significant updates to the boot menu, login display, and an array of captivating desktop wallpapers, for both our regular Kali and Kali Purple editions. We are dedicated to not only advancing our cybersecurity capabilities but also ensuring that the aesthetic appeal of our platform matches the power within.Boot menu:Login display:Desktop:Kali-Purple desktop:New wallpapers:Special thanks to @arszilla for not only suggesting two wallpaper variants but also contributing to the creation of one of the default wallpapers featured in this release. These additional images were crafted to complement the background colors of the Nord and Dracula color schemes. To access these wallpapers, simply install the kali-community-wallpapers package, which also offer many other stunning backgrounds created by our community contributors.Other desktop changesXfceWe are excited to introduce a convenient enhancement to our Xfce desktop. Now, users can effortlessly copy their VPN IP address to the clipboard with just a click, simplifying the workflow and enhancing productivity for our users. To take advantage of this functionality, ensure that xclip is installed on your system (sudo apt update && sudo apt -y install xclip). With this improvement, managing your VPN connections on Kali Linux becomes even more seamless and intuitive.Thank you @lucas.parsy for your contribution that made this feature possible!Other Xfce changes:Kali-undercover updated to fix compatibility with latest XfceFixed a bug with xfce-panel and Kali’s customized cpugraph plug-inGnome-ShellFor Gnome desktop one notable change is the replacement of the eye-of-gnome (eog) image viewer with Loupe, continuing the transition to GTK4 based applications. Additionally, the latest update of Nautilus file manager arrived to Kali’s repositories, delivering a significant boost in file search speed and introducing a refreshed sidebar design.Icon ThemeFollowing with the desktop enhancements, we’ve added a few new app icons, ensuring a fully themed experience for default installations of Kali Linux. Additionally, we’ve refreshed our icon theme with new symbolic icons, enhancing consistency system-wide.Kali NetHunter UpdatesWe finally got our hands on a brand new Samsung Galaxy S24 Ultra and yes!, NetHunter rootless runs like a dream. Fortunately, Android 14 lets us disable child process restrictions in developer settings so we no longer have to use the adb command line to enable KeX support.
We have updated our documentation to reflect these changes.@yesimxev managed to add the popular Bad Bluetooth HID attack the the NetHunter app for both phones and even smartwatches!
Your browser does not support the video tag.The icons for our NetHunter and NHTerm apps have received a makeover and @kimocoder & @martinvlba spent countless days updating the codebase to ensure compatibility with the latest Android version.The community engagement is at an all time high, which is reflected by the following new kernels:Realme C15TicWatch Pro 3(Updated) Samsung Galaxy S9+Xiaomi Poco X3 NFCThanks heaps to everyone that contributed, we wouldn’t be here without you!Stay tuned as there are many more kernels already on the way!The following new tools made it into this Kali release (via the network repositories):blue-hydra – Bluetooth device discovery serviceopentaxii – TAXII server implementation from EclecticIQreadpe – Command-line tools to manipulate Windows PE filessnort – Flexible Network Intrusion Detection SystemThe focus was adding new libraries this release, and there is always numerous packages updates. Plus we also bump the Kali kernel to 6.6!There has also been a tool submitted from the community which has been merged into Kali:above – Invisible protocol sniffer for finding vulnerabilities in the networkIf you are wanting a tool in Kali quicker than what we can add, please see our blog post from a previous release.MiscellaneousBelow are a few other things which have been updated in Kali, which we are calling out which do not have as much detail:Due to the ongoing /usr-merge transition in Debian, using 2023.4 or older versions of our netboot images will no longer work. Make sure to either grab weekly image or Kali 2024.1!Friendly reminder, if you are getting “weird special characters” when trying to use keyboard shortcuts to copy/paste clipboard, the default is to use “ctrl+shift+c” and “ctrl+shift+v”.ctrl+c (without shift) in Unix is used to kill programs!Should you wish, you can alter the default behaviour in your favourite terminal programKali Website UpdatesKali DocumentationOur Kali documentation has had various updates:A way to make a project even stronger is to help its documentation. Kali is no exception. If you are able to please do contributed.Tool DocumentationOur tool documentation is always getting various updates from us, but we received a great contribution from Daniel:If you are wanting to help Kali, and give back, submitting to kali.org/tools is a great way to contributed.Kali Blog RecapSince our last release, we did the following blog posts:These are people from the public who have helped Kali and the team for the last release. And we want to praise them for their work (we like to give credit where due!):Anyone can help out, anyone can get involved!New Kali MirrorsWe have some new mirrors! Plenty of new mirrors, in fact. The last quarter was quite incredible on this front, and now is the time to give credits.Let’s start with North America:Now for the rest of the world:On top of that, as said above, there is now the Micro Mirror CDN that serves Kali images via 10 points of presence: 7 in the US, 1 in Colombia, 1 in the UK and 1 in Australia!To wrap that up: THANK YOU to all of you, individuals and companies, who provide bandwidth and help us distribute Kali to everyone out there!If you have the disk space and bandwidth, we always welcome new mirrors.Kali Team Discord ChatSince the launch of our Discord server with Kali 2022.3, we have been doing an hour long voice chat with a number of Kali team members. This is when anyone can ask questions (hopefully relating to Kali or the information security industry) to us.The next session will happen a little later than normal, Friday, 22nd March 2024 18:00 -> 19:00 UTC/+0 GMT.
It will once again be on OffSec’s Discord.Please note, we will not be making a recording of this event – its live only.Get Kali Linux 2024.1Fresh Images:
So what are you waiting for? Go get Kali already!Seasoned Kali Linux users are already aware of this, but for the ones who are not, we do also produce weekly builds that you can use as well. If you cannot wait for our next release and you want the latest packages (or bug fixes) when you download the image, you can just use the weekly image instead.
This way you will have fewer updates to do.
Just know that these are automated builds that we do not QA like we do our standard release images. But we gladly take bug reports about those images because we want any issues to be fixed before our next release!Existing Installs:
If you already have an existing Kali Linux installation, remember you can always do a quick update:┌──(kali㉿kali)-[~]
└─$ echo “deb http://http.kali.org/kali kali-rolling main contrib non-free non-free-firmware” | sudo tee /etc/apt/sources.list
[…]

┌──(kali㉿kali)-[~]
└─$ sudo apt update && sudo apt -y full-upgrade
[…]

┌──(kali㉿kali)-[~]
└─$ cp -vrbi /etc/skel/. ~/
[…]

┌──(kali㉿kali)-[~]
└─$ [ -f /var/run/reboot-required ] && sudo reboot -f
You should now be on Kali Linux 2024.1 We can do a quick check by doing:┌──(kali㉿kali)-[~]
└─$ grep VERSION /etc/os-release
VERSION=”2024.1″
VERSION_ID=”2024.1″
VERSION_CODENAME=”kali-rolling”

┌──(kali㉿kali)-[~]
└─$ uname -v
#1 SMP PREEMPT_DYNAMIC Kali 6.6.9-1kali1 (2024-01-08)

┌──(kali㉿kali)-[~]
└─$ uname -r
6.6.9-amd64
NOTE: The output of uname -r may be different depending on the system architecture.As always, should you come across any bugs in Kali, please submit a report on our bug tracker. We will never be able to fix what we do not know is broken! And Social networks are not bug trackers!Want to keep in up-to-date easier? Automate it! We have a RSS feeds and newsletter of our blog to help you.

Open Source Tripwire is a free software security and data integrity tool used for monitoring and alerting on specific file changes on Linux systems.
Tripwire performs intrusion detection functions by taking a snapshot of a known system state and later comparing it with any other, changed, state. Tripwire does it by comparing files’ new signatures with the ones taken when the database was originally created (or later updated).
Installation
Install Tripwire:
$ sudo yum install tripwire
Configuration
Generate the system-specific cryptographic key files:
$ sudo /usr/sbin/tripwire-setup-keyfiles
Initialise the Tripwire database file:
$ sudo /usr/sbin/tripwire –init
Tripwire Configuration File twcfg.txt
Open the file /etc/tripwire/twcfg.txt for editing and modify as required. The content of an example file is listed below for references.
ROOT =/usr/sbin
POLFILE =/etc/tripwire/tw.pol
DBFILE =/var/lib/tripwire/$(HOSTNAME).twd
REPORTFILE =/var/lib/tripwire/report/$(HOSTNAME)-$(DATE).twr
SITEKEYFILE =/etc/tripwire/site.key
LOCALKEYFILE =/etc/tripwire/$(HOSTNAME)-local.key
EDITOR =/bin/vim
LATEPROMPTING =false
LOOSEDIRECTORYCHECKING =false
MAILNOVIOLATIONS =false
EMAILREPORTLEVEL =3
REPORTLEVEL =3
MAILMETHOD =SENDMAIL
SYSLOGREPORTING =false
MAILPROGRAM =/usr/sbin/sendmail -oi -t
TEMPDIRECTORY =/tmp
GLOBALEMAIL [email protected]
Tripwire Policy File twpol.txt
Open the file /etc/tripwire/twpol.txt for editing and configure to match your system. For example, you may want to add monitoring for /etc/httpd if you have Apache installed, or disable integrity checking for Korn shell /bin/ksh if it’s not installed on the system.
When the configuration is done and you’re happy with the files and folders you want to monitor, you then need to implement the rules by recreating the encrypted policy file which Tripwire reads:
$ sudo twadmin -m P -S /etc/tripwire/site.key /etc/tripwire/twpol.txt
Reinitialise the Tripwire Database
Reinitialise the database to implement the policy:
$ sudo tripwire –init
Finally, run a check for any violations:
$ sudo tripwire –check
Housekeeping
In practice, you should delete the plain text policy and configuration files that are no longer required:
$ sudo rm /etc/tripwire/twcfg.txt /etc/tripwire/twpol.txt
If you later need to regenerate the plain text policy file, pass the encrypted file to twadmin:
$ sudo twadmin –print-polfile | sudo tee /etc/tripwire/twpol.txt
The same goes for the plain text configuration file:
$ sudo twadmin –print-cfgfile | sudo tee /etc/tripwire/twcfg.txt
One thing to note, Tripwire will not recognise any configuration changes until the configuration text file is correctly signed and converted to /etc/tripwire/tw.pol with the twadmin command:
$ sudo twadmin –create-cfgfile -S /etc/tripwire/site.key /etc/tripwire/twcfg.txt
The configuration file does not not alter any Tripwire policies, therefore it’s not required to regenerate the Tripwire database.
Crontab
Tripwire should be added to /etc/cron.daily/ automatically. If this isn’t desired, you can remove the configuration file and add it to the root user crontab instead, for example:
0 3 * * * /sbin/tripwire –check –email-report –silent –no-tty-output