Checksum Verification: Kali Linux Download
Saturday, September 30, 2023 at 12:00 AM | 2 min read
Last modified on Monday, August 17, 2026 at 11:09 AM
Verifying the SHA-256 checksum of a Kali Linux ISO download against the hash published on kali.org, using macOS's built-in shasum command
Before installing any security tooling, I want to know two things: that the file I downloaded is actually the file the distributor built, and that whatever I do with it next stays isolated from my main system. This project covers both: verifying a Kali Linux .iso with a SHA-256 checksum on macOS, then installing it into an isolated virtual machine.
Verifying the download
macOS ships with shasum built in, so no third-party tools are needed to check a download's integrity. Running shasum -a 256 against the downloaded .iso produces a SHA-256 hash, a fixed-length "fingerprint" of the file. It gets compared against the checksum kali.org publishes for that same build. A match means the file wasn't corrupted or tampered with in transit; any change to the file, even a single bit, produces a completely different hash.
Installing in an isolated VM
Verifying the download is only half the job. The other half is making sure that running security tools like Wireshark, or testing anything exploit- or protocol-related, stays contained to a disposable environment instead of touching the host Mac. I used UTM (free, QEMU-based) to run Kali on Apple Silicon, which is a straightforward path but comes with a handful of ARM64/QEMU-specific quirks: a CD/DVD drive reference that doesn't fully clear via the UI, a graphical installer that can go visually blank (worked around with a Serial console device), and a LUKS disk-encryption prompt that renders invisibly at early boot due to a keyboard-layout mismatch between typed and pasted input.
This isn't a step-by-step install tutorial. Plenty of those already exist. The checksum verification steps, SHA-256 background, and the specific UTM quirks and fixes above are written up in full in the project README on GitHub.