Is Using Kali Linux for Penetration Testing Legal in India?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

What is Kali Linux actually for, and who uses it?

It is a Debian-based distribution that bundles hundreds of open-source security tools with a consistent environment, and it is used by penetration testers, red teamers, security engineers and defenders who need to reproduce attacker techniques safely. It ships with a live web server, host and mobile device options on the same network, and every tool pre-installed with sane defaults. The important clarification for a business owner or a judge is that the distribution is not evidence of intent. The same tools can be installed individually, and a tool that nobody runs is not an attack. Intent and authorisation are what separate a tester from an offender, and they are established by the paperwork, not by the software on the laptop.

What does the law say about running tools against systems?

Section 43 of the Information Technology Act, 2000 criminalises unauthorised access to a computer, computer system or computer network, and section 66 prescribes the punishment. The Ministry of Electronics and Information Technology has stated in Parliament that any act, including ethical hacking, undertaken with the permission or consent of the owner does not attract liability. So an unauthorised scan of a third party's network, an uninvited wireless audit of an office you do not own, or running a credential tool against a target that never agreed can be criminal, and the criminal process in India now handles cyber cases comfortably. The 21,900 digital-arrest complaints involving over Rs 647 crore recorded in the first eight months of 2026 show how much of this country's cyber crime volume is now documented, adjudicated and published.

What should a rules-of-engagement document say about tooling?

It should be specific enough to be enforceable. Name the systems by hostname and IP range. Name the permitted tool categories, and where a destructive technique is unavoidable, require written approval per use. Prohibit denial-of-service testing, password spraying against accounts that are out of scope, social engineering of the client organisation's staff without written approval for that specific campaign, and the exfiltration of real personal data. Set the test window in hours, not days, so that an activity outside the window is obviously out of bounds. Name the tester or the testing team and the source IP addresses. Require immediate notification on contact with production data, and require that all artefacts be deleted or handed over on completion, which is what protects the client when a tool has captured something sensitive.

What separates a professional test from a scan?

The report, and the reasoning behind it. A scan produces a severity list produced by a tool's heuristics. A professional test produces a working attack path: the initial foothold, the escalation, the objective reached, the business consequence in rupees, and the evidence that it is reproducible. It also produces the false positives, because a report claiming zero issues is usually a report claiming a broken scope. At AAVETech the engagement is fixed-price at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, with a 5 to 10 working day turnaround, a retest after remediation included, and a written rules-of-engagement document signed before the first packet leaves.

What are the common questions about K?