
_Verifying the SHA-256 checksum of a Kali Linux ISO download against the hash
published on kali.org, using macOS's built-in `shasum` command_

Before installing any security tooling, I want to know two things: that the
file I downloaded is actually the file the distributor built, and that
whatever I do with it next stays isolated from my main system. This project
covers both: verifying a Kali Linux `.iso` with a SHA-256 checksum on macOS,
then installing it into an isolated virtual machine.

## Verifying the download

macOS ships with `shasum` built in, so no third-party tools are needed to
check a download's integrity. Running `shasum -a 256` against the downloaded
`.iso` produces a SHA-256 hash, a fixed-length "fingerprint" of the file.
It gets compared against the checksum kali.org publishes for that same
build. A match means the file wasn't corrupted or tampered with in transit;
any change to the file, even a single bit, produces a completely different
hash.

## Installing in an isolated VM

Verifying the download is only half the job. The other half is making sure
that running security tools like Wireshark, or testing anything exploit- or
protocol-related, stays contained to a disposable environment instead of
touching the host Mac. I used [UTM](https://mac.getutm.app/) (free,
QEMU-based) to run Kali on Apple Silicon, which is a straightforward path but
comes with a handful of ARM64/QEMU-specific quirks: a CD/DVD drive reference
that doesn't fully clear via the UI, a graphical installer that can go
visually blank (worked around with a Serial console device), and a LUKS
disk-encryption prompt that renders invisibly at early boot due to a
keyboard-layout mismatch between typed and pasted input.

## More on this project

This isn't a step-by-step install tutorial. Plenty of those already exist.
The checksum verification steps, SHA-256 background, and the specific UTM
quirks and fixes above are written up in full in the
project README on GitHub.


Verifying a Kali Linux ISO download with a SHA-256 checksum on macOS using shasum, then installing it into an isolated UTM virtual machine on Apple Silicon.

Checksum Verification: Kali Linux Download


_A close-up shot of a water droplet hanging from a stainless steel faucet, highlighting surface tension_

This project is a network traffic analysis built around a single question:
what does a TLS connection actually reveal before encryption exists? Using
tcpdump to capture live traffic on a Kali Linux interface and Wireshark to
analyze it, the project traces a full TLS 1.3 handshake from the first
plaintext bytes through to a decrypted HTTPS response.

The core finding is the Server Name Indication (SNI) field inside the TLS
ClientHello message. Even though the rest of an HTTPS connection is
encrypted, the SNI field travels in plaintext, because it's sent before any
session keys are negotiated. That means the destination hostname is visible
to anyone capturing traffic on the network, regardless of encryption. The
project also includes a separate decryption walkthrough, using the
SSLKEYLOGFILE environment variable to have Wireshark decrypt a live HTTPS
session directly, confirming what's actually inside the encrypted traffic
once the keys are available.

## More on this project

This isn't a summary of the whole investigation. The full walkthrough,
including the tcpdump commands, the Wireshark analysis steps, the
SSLKEYLOGFILE decryption process, and the TLS 1.2-versus-1.3 handshake
comparison, is written up in full in the
project README on GitHub.


A network traffic analysis using Wireshark and tcpdump that captures a TLS handshake and shows how the destination hostname still leaks in plaintext through the SNI field.

projects tag: cybersecurity

Checksum Verification: Kali Linux Download

TLS SNI Leak Analysis