What's New in Kali Linux 2025.2: New Tools, CARsenal and NetHunter Updates
Kali Linux 2026.2 is out now with 13 new hacking tools, a renamed CARsenal car hacking toolkit, NetHunter smartwatch support, and a redesigned Kali Menu aligned with MITRE ATT&CK. Learn how to upgrade and explore all the changes.
Quick answer: Kali Linux 2025.2 added 13 new tools, including azurehound, binwalk3, rubeus and gitxray, renamed its CAN toolkit to CARsenal with new car-testing tools, reorganised the menu around MITRE ATT&CK, moved to GNOME 48 and KDE Plasma 6.3, and expanded NetHunter with smartwatch support. Newer Kali versions have been released since.
Key takeaways
- This release is Kali 2025.2.
- Highlights: 13 new tools, CARsenal automotive toolkit, ATT&CK-based menu, GNOME 48, NetHunter smartwatch support.
- Kali is a rolling release; apt update and full-upgrade brings you to the current version.
- Check kali.org for the latest release before relying on this list.
A correction first
The release described here is Kali Linux 2025.2, published in mid-2025, which is also what this page's address says. Kali has shipped newer releases since then. Before you download anything, check the official Kali documentation and the release announcements on kali.org for the current version, and treat this article as a record of what 2025.2 introduced.
What changed in Kali 2025.2?
Four things stand out: a renamed and expanded car-security toolkit (CARsenal), thirteen new tools, a tool menu reorganised along the MITRE ATT&CK framework, and updates to the NetHunter mobile platform, plus the usual desktop upgrades.
CARsenal: automotive security tools
The earlier "CAN Arsenal" menu was renamed CARsenal and given a friendlier interface. Cars use the CAN bus to let their control units talk to each other, and testing that network is a specialist job. New or highlighted tools:
| Tool | What it does |
|---|---|
| hlcand | A modified slcand that supports ELM327 adapters, the cheap OBD-II dongles |
| VIN Info | Decodes vehicle identification numbers |
| CaringCaribou | A CAN security exploration framework with a listener, fuzzer, UDS and XCP support |
| ICSim | Simulates a virtual CAN network, so you can practise without a car |
ICSim is the useful one for learners. It gives you a safe target. Test only vehicles and ECUs you own or have written permission to test, because interfering with a moving or road-going vehicle can cause physical harm.
The 13 new tools
| Tool | Purpose | Defender's angle |
|---|---|---|
| azurehound | Collects BloodHound data from Azure and Entra ID | Shows attack paths in your tenant; use it to find over-privileged identities |
| bloodhound-ce-python | Python data collector for BloodHound Community Edition | Maps Active Directory relationships from Linux |
| sharphound | The Windows collector for BloodHound | Collection is noisy; watch for mass LDAP queries |
| binwalk3 | Firmware analysis and extraction | Check IoT firmware for hard-coded secrets |
| bopscrk | Builds targeted wordlists | Shows why predictable passwords fail |
| crlfuzz | Scans for CRLF injection | Find header-injection bugs in your own apps |
| donut-shellcode | Generates in-memory shellcode loaders | Detection teams study it to tune endpoint rules |
| gitxray | Security insights from GitHub repositories | Spot exposed secrets and risky contributors |
| ldeep | LDAP enumeration | Reveals what any authenticated user can read in AD |
| ligolo-ng-common-binaries | Tunnelling and pivoting binaries | Understand lateral movement to detect it |
| chisel-common-binaries | Tunnelling binaries | Same |
| rubeus | Kerberos abuse and enumeration | Know Kerberoasting to monitor for it |
| tinja | Tests for template injection | Test your own templating code |
Package names in Kali can differ slightly from the upstream project names, so search with apt search before installing.
Menu now follows MITRE ATT&CK
Kali's application menu used to follow an older layout inherited from BackTrack, the distribution Kali replaced. In this release it was reorganised around the MITRE ATT&CK tactics, such as reconnaissance, credential access and lateral movement. The practical benefit is that you can look for a tool by what you want to achieve, and that red and blue teams share the same vocabulary.
Desktop updates
- GNOME 48 with improvements such as notification stacking and HDR support.
- KDE Plasma 6.3 with better fractional scaling.
- A new document viewer, Papers, in place of Evince, following the GNOME change.
NetHunter updates
Kali NetHunter, the Android penetration-testing platform, gained first support for a smartwatch (TicWatch Pro 3), including wireless injection, WPA2 handshake capture and deauthentication on that device. A KeX teaser for Android Auto head units was shown, along with new or updated kernels for several phones including Xiaomi Redmi 4/4X and Redmi Note 11, Realme C15 and Samsung Galaxy S9 and S10. Wi-Fi attacks, like all testing, are lawful only on networks you own or have permission to assess.
How to update an existing Kali install
- Take a VM snapshot or backup first.
- Check that your repository entry is the rolling one:
cat /etc/apt/sources.listshould contain a line likedeb http://http.kali.org/kali kali-rolling main contrib non-free non-free-firmware. Only if it is wrong, replace it. Do not overwrite the file blindly if you use mirrors. - Update and upgrade:
sudo apt update && sudo apt -y full-upgrade - Reboot if the system asks for it:
[ -f /var/run/reboot-required ] && sudo reboot -f - Confirm the version:
grep VERSION /etc/os-release
Because Kali is a rolling release, running these commands today brings you to the current release, not to 2025.2.
Does this matter for exams?
Tool menus and versions rarely decide an exam result. OffSec's own courses supply their lab environments and instructions. What helps is understanding what each category of tool does and what traces it leaves, which is the defender's view in the table above.
Next steps
If you are new to the platform, read what Kali Linux is and why it is popular and the Kali features overview. For structured training on the distribution itself, see WebAsha's KLCP Kali Linux Certified Professional course.
Related reading
Frequently Asked Questions
What's Your Reaction?
Like
0
Dislike
0
Love
0
Funny
0
Wow
0
Sad
0
Angry
0
Vaishnavi is a skilled tech professional at the Ethical Hacking Training Institute in Pune, responsible for managing and optimizing the technical infrastructure that supports advanced cybersecurity education. With deep expertise in network security, backend operations, and system performance, she ensures that practical labs, online modules, and assessments run smoothly and securely. Her behind-the-scenes contributions play a vital role in delivering a seamless and secure learning experience for aspiring ethical hackers.
