First off, huge shout out to GainSec for his original guide — you'll find it linked at the bottom. His version is geared more toward Android-savvy folks. I'm an iPhone user myself, so this was all new to me, and I wanted to document a version that works even if you're not deep in Android ecosystems.
This guide walks through a full build of Kali NetHunter on a Nexus 6P — nethunter is a lightweight Kali Linux flavor built for Android. I have been playing around with Kali on desktop for a while, but wanted a super mobile version. I tried going headless with a Raspberry Pi 4B + SSH from my iPhone, but it was incredibly frustrating for a linux noob. After some research, I found that certain phones have kernels built specifically for NetHunter. You can check the full list here:
nethunter.kali.org/kernels
The Nexus 6P stood out to me: it is affordable (~$50 used), supports full NetHunter, and was relatively easy to find unlocked. Mine came with a clean stock image and no lock — perfect for this build.
I’ll have to report on battery performance later.
Requirements
- USB drive
(with both USB-A & USB-C ends preferred) - Windows PC (for this guide)
- Unlocked Nexus 6P
- A few files I will link throughout
Step 1: Enable Developer Mode
- On the Nexus, go to Settings → System → About Phone
- Tap Build Number 5 times
- Back out one screen and go to Developer Options
- Enable USB Debugging
- Connect phone to PC and accept the prompt (check remember device!)
Step 2: Download Needed Files
I extracted the platform tools to C:\platform-tools
for simplicity and repacked the NetHunter files into 6P-NetHunter.zip
for a clean install like GainSec suggested.
Step 3: Install TWRP & Prep the Device
- Open PowerShell in
C:\platform-tools
- Run:
- When in bootloader mode (android robot on his back belly open), run:
- If that fails, try flashing it:
- You should now see the TWRP Recovery interface (blue/black screen)
- Wipe the phone:
- Go to Wipe → Format Data, type "yes"
- Then go to Advanced Wipe and select: Cache, Dalvik, System, Data
.\adb devices
.\adb reboot bootloader
.\fastboot boot twrp-3.7.0_9-0-angler.img
.\fastboot flash recovery twrp-3.7.0_9-0-angler.img
.\fastboot reboot recovery
Step 4: Install Magisk
- Insert the USB with Magisk + NetHunter ZIP
- From TWRP:
- Go to Mount → check USB OTG
- Go to Install → select
Magisk-v23.0.apk
- Check "Reboot after install" if desired
- Let the phone reboot
- Connect to Wi-Fi
- Open Magisk, follow prompts until it says "Installed"
Step 5: Install NetHunter
- Back to the bootloader, you will need to unplug that USB and replug the phone into your PC for this:
.\adb reboot bootloader .\fastboot boot twrp-3.7.0_9-0-angler.img
- Make sure to charge your phone before this next part!
Install can take ~25 min - Once in TWRP again:
- Mount USB OTG
- Install
6P-NetHunter.zip
Step 6: Final Setup
If the reboot box was checked, your phone will restart and you’ll see:
- NetHunter Store
- NetHunter Terminal
But not the full NetHunter app just yet! Here's what to do:
- Open the NetHunter Store
- Install the NetHunter app
- Grant all permissions
- Launch the app and verify Chroot is running
You Did It
Enjoy your fully mobile, root-enabled Kali NetHunter device.
Get out there and explore the physical net :)
Link to GainSec's original guide: gainsec.com