Kali Linux and offensive tooling in authorised testing: what the distribution is for, what written authorisation must cover, and where testing turns to crime.
Using Kali Linux for authorised security testing is legal in India, and the distribution exists for that purpose. What is not legal is running it against systems you are not authorised to test. The Ministry of Electronics and Information Technology has stated in Parliament that any act, including ethical hacking, undertaken with the permission or consent of the owner does not attract liability under the Information Technology Act, 2000. The distinction in practice is a signed rules-of-engagement document: named systems, dates, a test window, permitted techniques, prohibited actions, the tester's identity, and a client contact who can halt the test.
It is a Debian-based distribution that bundles hundreds of open-source security tools with a consistent environment, and it is used by penetration testers, red teamers, security engineers and defenders who need to reproduce attacker techniques safely. It ships with a live web server, host and mobile device options on the same network, and every tool pre-installed with sane defaults. The important clarification for a business owner or a judge is that the distribution is not evidence of intent. The same tools can be installed individually, and a tool that nobody runs is not an attack. Intent and authorisation are what separate a tester from an offender, and they are established by the paperwork, not by the software on the laptop.
Section 43 of the Information Technology Act, 2000 criminalises unauthorised access to a computer, computer system or computer network, and section 66 prescribes the punishment. The Ministry of Electronics and Information Technology has stated in Parliament that any act, including ethical hacking, undertaken with the permission or consent of the owner does not attract liability. So an unauthorised scan of a third party's network, an uninvited wireless audit of an office you do not own, or running a credential tool against a target that never agreed can be criminal, and the criminal process in India now handles cyber cases comfortably. The 21,900 digital-arrest complaints involving over Rs 647 crore recorded in the first eight months of 2026 show how much of this country's cyber crime volume is now documented, adjudicated and published.
It should be specific enough to be enforceable. Name the systems by hostname and IP range. Name the permitted tool categories, and where a destructive technique is unavoidable, require written approval per use. Prohibit denial-of-service testing, password spraying against accounts that are out of scope, social engineering of the client organisation's staff without written approval for that specific campaign, and the exfiltration of real personal data. Set the test window in hours, not days, so that an activity outside the window is obviously out of bounds. Name the tester or the testing team and the source IP addresses. Require immediate notification on contact with production data, and require that all artefacts be deleted or handed over on completion, which is what protects the client when a tool has captured something sensitive.
The report, and the reasoning behind it. A scan produces a severity list produced by a tool's heuristics. A professional test produces a working attack path: the initial foothold, the escalation, the objective reached, the business consequence in rupees, and the evidence that it is reproducible. It also produces the false positives, because a report claiming zero issues is usually a report claiming a broken scope. At AAVETech the engagement is fixed-price at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, with a 5 to 10 working day turnaround, a retest after remediation included, and a written rules-of-engagement document signed before the first packet leaves.
| Activity | Authorised? | Condition |
|---|---|---|
| Scanning systems listed in the signed scope | Yes | Inside the agreed test window |
| Credential testing against in-scope accounts | Yes | Named accounts, rate limited, no lockout risk |
| Running offensive tooling on owned training infrastructure | Yes | Documented, isolated environment |
| Scanning a third party's network without consent | No | Liability under IT Act 2000, s.43 and s.66 |
| Social engineering of client staff without written approval | No | Out of scope unless separately authorised |
| Retaining real personal data beyond the engagement | No | Breaches the data handling clause |
Using Kali Linux for authorised security testing is legal in India, and the distribution exists for that purpose. What is not legal is running it against systems you are not authorised to test. The Ministry of Electronics and Information Technology has stated in Parliament that any act, including ethical hacking, undertaken with the permission or consent of the owner does not attract liability under the Information Technology Act, 2000. The distinction in practice is a signed rules-of-engagement document: named systems, dates, a test window, permitted techniques, prohibited actions, the tester's identity, and a client contact who can halt the test.
No. Installing an open-source distribution of security tools is not an offence, and the tools in it are published for testing and research. Liability attaches to what you do with them against systems, not to having them installed.
Only for the portion you administer. Scanning a network that belongs to your employer is fine with the employer's authority and a documented scope; scanning a neighbouring flat's Wi-Fi, a co-working space's network or a public hotspot is unauthorised access, which is exactly what section 43 of the Information Technology Act, 2000 addresses.
Yes. A written authorisation letter and a signed rules-of-engagement document covering systems, dates, permitted and prohibited techniques, data handling and confidentiality. The Ministry of Electronics and Information Technology has confirmed in Parliament that consent removes liability, but consent that cannot be evidenced later is not consent in practice.
A working attack path rather than a tool list: the entry point, the steps taken, the objective achieved, the business impact, reproduction steps a developer can follow, and a prioritised remediation plan with a retest.
Roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, so a focused web application test lands between Rs 60,000 and Rs 3,50,000. At AAVETech engagements are fixed-price with a written scope and signed rules of engagement, and the retest is included.
Read the full guide on AAVETech: Is Using Kali Linux for Penetration Testing Legal in India?.
Send us the systems in scope and we will return an authority-to-test letter and a rules-of-engagement document naming the permitted techniques.
Talk to an analyst about this.