I have completed a few Bug Bounty tutorials. All of them use Kali Linux installed on VMs. Either VirtualBox or VMWare. Is there a reason why Web App Pen testing would be done from a VM? I'm just wondering if just installing Kali on my machine is a bad idea for some reason I don't know.

Kali Linux provides ISO specifically for VirtualBox and VMWare so there must be some habit of running it on VMs

  • Is there a need for legitimate work to go trough a VM, what is the role of VM's in perfectly legal work.
    – Neil Meyer
    Commented Dec 6, 2023 at 13:14
  • 11
    Why do you think that there are legalities that would then require a VM? That's an odd and specific conclusion to make. and VMs don't make anything more or less legal.
    – schroeder
    Commented Dec 6, 2023 at 13:15
  • 2
    Many developers (including me at various times in my career) do all of their development work in VMs/containers for any number of reasons like reproducibility, isolation, ephemerality, similarity to the prod environment, available tooling, etc. N.B. most or all of which also apply to security engineers. Commented Dec 7, 2023 at 15:55
  • 1
    Remember, Kali is used by pentesters in hostile environments. You don't want anyone breaking into your pentesting platform and riding along to your next engagement; a VM's ability to roll back to a snapshot is thus very relevant. Commented Dec 7, 2023 at 16:36
  • 1
    @schroeder I can't check comment histories, but the question history seems to reinforce my (now deleted) point; I don't think OP implies they think there is a legal requirement to use VMs. Rather, that they think VM's are used for illegal activities - see "Bug bounty work is not illegal why is there a need to do it on a VM?" from the original pre-edited question. Commented Dec 9, 2023 at 9:28

5 Answers 5


Aside from the general isolation and packaging aspects mentioned by other answers, there’s a rather significant benefit to running pentesting tooling in a VM: It lets you snapshot the state of the system at a given point in time and roll back to that snapshot whenever you want.

This is really important if you’re serious about pentesting because:

  • It provides a way to guarantee a pristine environment, which is critical for ensuring repeatability of tests.
  • By snapshotting the VM part way through a test you can effectively suspend that test and come back to it later. This is useful for managing multiple tests.
  • It gives you an easy way to run multiple tests in parallel, because all decent VM software lets you clone snapshots quickly and efficiently compared to doing a new install for each new VM (essentially, you can use snapshots as system images).
  • It provides a way to relatively quickly drop data specific to a given job without having to hunt through the disk to find everything.

Most of these benefits also apply to containers (and there are in fact Docker images also provided by the Kali Linux team), but there are a lot cases where you truly do need an isolated OS kernel to work with, so a VM is generally preferred for this type of thing.


Pre-made virtual machines only mean that the tools are installed, configured and tested consistently. That's all. Some tools can be very difficult to get running.

It's only for your convenience.

Kali is not a great normal Linux distro to use for normal home use. So using it as a VM means you only fire it up when you want to. Again, it's just for your convenience.

Install the Kali ISO on your hardware or use a VM. Whichever option meets your needs.


Kali Linux, as many Security Pentesting tool kits, is not that suited for typical use.

Add to that that it’s always a good idea to isolate such tools so they only can work in those parts you are investigating…

Both of these reasons are why Kali is primarily tailored towards VM’s. (Although you could install it on bare metal or in a container).

  • if you trust your container engine isolation from the host system ...
    – Jakuje
    Commented Dec 7, 2023 at 11:29
  • 2
    when you do not trust the container isolation... you would not run it in a container... but in a VM... I therefor fail to see what your comment adds... All i say is that you COULD run it BM or in a container... not that you should.
    – LvB
    Commented Dec 7, 2023 at 13:10

As others have stated separating your pentest environment from your work environment is beneficial to both environments.

In addition some of the tools in Kali have to use unstable drivers, weak encryption ciphers and other packages that are not optimal or safe to use in non-pentest work environments.


Typically educational lab stuff and homework will use a VM to facilitate a student quickly setting up an environment regardless of what the native one is, and easily being able to make a fresh one between assignments. It makes supporting students with Windows/Mac/Linux computers much easier. Also the sandbox environment is desirable because it runs a much lower risk of the students breaking their own computers.

In real life? It is kind of a bold choice to run Kali as a daily driver OS, it has various restrictions around hardening packages/seccomp/etc... and perhaps a more limited array of drivers available. I absolutely know people who do, but it is an "entire lifestyle" sort of thing.

To do a few assignments, just use the VM and follow the directions!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .