Last reviewed 24 min read

Intermediate
Last verified: July 2026

Kali NetHunter Installation Guide

Install full Kali NetHunter on an unlockable Android device with a Samsung Galaxy S10 Exynos path as the primary example. This refresh prioritizes version checks, device fit, and recovery checkpoints so you can stop early if your hardware or firmware path is wrong.

Read This First

  • This will wipe your device. Back up everything first.
  • Samsung Galaxy S10-family NetHunter builds currently require a matching LineageOS-based path, not stock Samsung firmware.
  • Exynos Samsung models are the intended target. Many Snapdragon carrier variants still cannot be unlocked reliably.
  • Use a Linux machine for flashing, a known-good data cable, and a direct motherboard USB port instead of a hub or dock.
  • Set aside 2-4 hours, 4+ GB of downloads, and at least 60% battery on both the phone and laptop.
  • Unlocking the bootloader permanently trips Knox and may disable Samsung Pay, Secure Folder, and some enterprise controls.

Always Verify Latest Versions

Firmware, recoveries, and tools update frequently. Before flashing, confirm you have the latest compatible versions:

  • LineageOS: wiki.lineageos.org/devices/beyond1lte — beyond1lte currently ships LineageOS 22.2 (Android 15). Use whatever the official install page shows, and match your NetHunter build to it.
  • Lineage Recovery + vbmeta: the S10 official path flashes Lineage Recovery (recovery.img) and an empty vbmeta.img, both from the LineageOS install page. TWRP is no longer part of the supported S10 flow.
  • NetHunter: kali.org/get-kali/#kali-mobile — match the exact codename and LineageOS generation in the filename (e.g. beyond1lte-los for LineageOS 22.x). It installs as a Magisk module, not a recovery flash.
  • Magisk: github.com/topjohnwu/Magisk/releases — the official S10 guide currently recommends Magisk v28.1 and warns against v29. Confirm the version the Kali S10 doc recommends before flashing.

Freshness Rule for This Page

The authoritative source for the S10 is the official Kali NetHunter Galaxy S10 install doc. Re-check it, the LineageOS install page, and the NetHunter downloads page every time you reuse this guide. If any filename, LineageOS generation, recovery, or Magisk version differs from what is shown here, trust upstream and adjust before flashing.

Lab Runbook

Use this page as a controlled lab build, not a production hardening guide. Validate isolation before running exercises and write down the cleanup command before starting.

Critical risk Intermediate 2-4 hr

Plan

Linux host plus supported phone; 4 GB downloads plus backups. Device dependent. Isolation: Use only owned devices and authorized wireless targets.

Build

  • - Model verified
  • - Backups complete
  • - Matched ROM/recovery/NetHunter files

Validate

  • - adb and flashing tool detect device
  • - Downloaded files match codename
  • - First boot completes

Exercise

Run only the exercises tied to this lab and save screenshots, command output, logs, and timestamps outside disposable VMs.

Clean Up

  • - Keep stock firmware/recovery links
  • - Document Knox/warranty state
  • - Remove unauthorized test profiles

Compatibility Check — Go / No-Go

Do this before you download anything. Success depends on the exact model, codename, bootloader state, recovery support, base-ROM generation, and a known rollback path. Device-family names are not enough — if any row lands in the Stop column, resolve it before flashing.

Check Go signal Stop signal Evidence to keep
Official support Exact codename appears on the official Kali mobile download page. Only a similar model or an old forum build exists. URL, codename, filename, date.
Bootloader Unlock is supported for your exact model and region. Carrier, Snapdragon region, or OEM policy blocks unlock. Unlock-status screenshot or fastboot output.
Recovery Lineage Recovery (or supported recovery) matches your exact codename. Recovery exists only for another variant. Recovery filename, hash, source URL.
Base ROM LineageOS generation matches the NetHunter build (e.g. both 22.x). NetHunter ZIP expects a different LineageOS/Android generation. ROM version, Android version, codename.
Rollback Stock firmware, recovery path, and key combos are documented. No known stock image or unreliable USB detection. Firmware link, checksum, rollback notes.

Good Candidate

Official NetHunter build, unlockable bootloader, matching recovery, active ROM docs, and a known rollback path.

Research Candidate

Partial or community support exists, but one of recovery, ROM, kernel, or rollback is uncertain.

Do Not Flash Yet

Locked bootloader, mismatched codename, missing stock firmware, unclear recovery support, or no trustworthy source.

Which Edition Fits Your Device

Use This Guide

You have an unlockable device, you are comfortable wiping it, and you want full NetHunter with root and recovery-based flashing.

Choose Lite Instead

Your phone can be rooted but does not have a practical custom-kernel path. You still want the app, Kali container, and post-exploitation tooling.

Choose Rootless Instead

Your bootloader is locked, your model is a carrier Snapdragon Samsung, or you only need portable Kali tooling without kernel features.

Pre-Flight & Rollback Prep

Pre-Flight Checks

  1. Confirm your exact model number in Settings → About Phone, then map it to the correct codename before downloading anything.
  2. Confirm your NetHunter filename and your LineageOS build target the same generation (e.g. both LineageOS 22.x).
  3. Test adb devices and heimdall detect before you start flashing so cable and driver problems show up early.
  4. Download everything to local disk first. Do not depend on live mirror scraping while the phone is already in recovery mode.
  5. Keep a manual recovery path ready: official LineageOS install page, official NetHunter download page, and a fallback flashing machine if Heimdall misbehaves.

Write This Down Before Flashing

  • Download stock firmware / factory images and note their checksums before the device enters Download or Recovery mode.
  • Record the exact Download Mode and Recovery key combos for your model.
  • Keep the original USB cable and a known-good direct USB port on hand.
  • Note any Knox / warranty impact so there are no surprises later.
  • Do not proceed if the battery is low, USB disconnects intermittently, or device detection is unstable.

Capture your starting state so you can prove what changed and roll back cleanly:

bash 
adb devices
adb shell getprop ro.product.model
adb shell getprop ro.product.device
adb shell getprop ro.build.version.release
adb shell getprop ro.boot.flash.locked

# Hash every file you are about to flash and keep the list with your lab notes
sha256sum *.img *.zip *.apk 2>/dev/null | tee SHA256SUMS.local.txt
adb devices
adb shell getprop ro.product.model
adb shell getprop ro.product.device
adb shell getprop ro.build.version.release
adb shell getprop ro.boot.flash.locked

# Hash every file you are about to flash and keep the list with your lab notes
sha256sum *.img *.zip *.apk 2>/dev/null | tee SHA256SUMS.local.txt

1. Prerequisites & Downloads

Supported Devices

NetHunter has three practical installation paths. Pick the one that matches your hardware reality before you collect files:

NetHunter (Full)

Requires an unlockable device and an officially supported kernel path. This is the only route that gives you the full HID, BadUSB, and wireless feature set.

Use this page only if this is your target state.

NetHunter Rootless

No root required. Runs in Termux and avoids bootloader, recovery, and firmware changes.

Best fallback when your bootloader path is blocked.

NetHunter Lite

Rooted device with no custom-kernel dependency. App + Kali container, but not the full hardware feature set.

Useful when full NetHunter support is incomplete for your model.

This Guide Covers Full NetHunter

This walkthrough stays focused on full NetHunter for a Samsung Galaxy S10 Exynos (SM-G973F / beyond1lte). If your exact model differs, keep the flow but replace every download with the files for your codename.

LineageOS Required for Samsung Devices

Current Samsung S10-family NetHunter downloads are published against a LineageOS path (currently LineageOS 22.x / Android 15), not stock Samsung firmware. Do not rely on old screenshots, older ROM names, or a generic "latest" assumption. Verify the exact LineageOS generation encoded in the NetHunter filename and match it to the LineageOS device page for your codename before flashing.

Expected Time and Failure Points

Most failed installs happen before flashing starts: wrong model, bad cable, unstable USB hub, or mismatched ROM/NetHunter version. Plan for 30-60 minutes of downloads and preparation, 15-30 minutes of flashing, and up to 15 minutes for the first boot.

What You'll Need

Hardware

  • ☑️ Samsung Galaxy S10 (SM-G973F/Exynos) — or your supported device
  • ☑️ Short, known-good USB-C data cable connected directly to the computer
  • ☑️ Linux PC/laptop (Kali Linux recommended)
  • ☑️ microSD card (optional, for storing images/wordlists)
  • ☑️ USB OTG adapter (for external WiFi adapters later)

Cable Quality Matters

Samsung flashing issues are often just transport issues. If ADB drops, Heimdall stalls, or the phone disconnects when entering Download Mode, swap the cable first and move to a direct USB port before troubleshooting software.

Software Downloads

Download all files to a folder on your Kali machine (e.g., ~/nethunter-install/).

File Source Notes
Heimdall (Linux Odin) GitHub Flashes recovery + vbmeta over Download Mode. Also in Kali's repos: apt install heimdall-flash
Lineage Recovery + vbmeta LineageOS install recovery.img + empty vbmeta.img. TWRP is not used on the current S10 path
LineageOS ROM LineageOS downloads Required — sideload before NetHunter (match your codename & generation)
MindTheGapps (optional) LineageOS Gapps Only if you want Google apps. Skip for a cleaner pentest device. Must match the LineageOS Android version
Magisk (renamed to .zip) GitHub For root. Official S10 doc recommends v28.1 and warns against v29 — sideloaded, then Direct Install in-app
NetHunter installer ZIP kali.org Pick your codename/generation (e.g. beyond1lte-los). Installed via Magisk → Modules, not recovery

Download by hand. The current S10 install is entirely adb sideload plus one Magisk module, so there is very little left to automate. The old TWRP-era auto-installer that used to live here no longer matches this flow and has been retired to avoid steering you down the wrong path.

If you do reuse a scripted download helper from elsewhere, never blind-run it: read it first, verify every URL and filename against upstream, run it download-only, and check hashes before anything touches a partition.

2. Unlock the Bootloader

Knox Will Be Tripped

Unlocking the bootloader on Samsung devices permanently trips Knox. Samsung Pay and some enterprise features will stop working. This cannot be reversed.

Step 2.1: Enable Developer Options

  1. Go to Settings → About Phone → Software Information
  2. Tap Build Number 7 times until you see "Developer mode enabled"
  3. Go back to Settings → Developer Options
  4. Enable OEM Unlocking (if grayed out, see troubleshooting)
  5. Enable USB Debugging

Step 2.2: Boot to Download Mode

  1. Power off the phone completely
  2. Connect USB cable to your Kali machine (leave phone end disconnected)
  3. Hold Volume Up + Volume Down simultaneously
  4. While holding both buttons, connect the USB cable to the phone
  5. Keep holding until you see the warning screen
  6. Press Volume Up to continue to Download Mode

Alternative Method

If the above doesn't work: Power off → Hold Bixby + Volume Down → Connect USB cable.

Step 2.3: Unlock on the Device

  1. From the Download Mode warning screen, long-press Volume Up to open the bootloader unlock prompt.
  2. Read the warning carefully, then confirm the unlock on the phone itself.
  3. Wait for the phone to wipe and reboot automatically.
  4. Complete basic Android setup again, then return to Developer Options and re-enable USB Debugging.

Do Not Use Heimdall to Unlock

Heimdall is for flashing partitions, not for initiating Samsung bootloader unlock. The unlock confirmation happens on the device in Download Mode and usually triggers a factory reset immediately.

3. Flash Lineage Recovery

Why Lineage Recovery, Not TWRP

The current official S10 path installs everything through Lineage Recovery using adb sideload, and installs NetHunter itself as a Magisk module — you never flash TWRP or push ZIPs to /sdcard. Any guide that tells you to flash TWRP and then flash a NetHunter ZIP for the S10 predates this method. If in doubt, follow the official Kali S10 doc.

Step 3.1: Confirm Your Codename

Map your exact model to its codename, then download that device's recovery.img (Lineage Recovery) and an empty vbmeta.img from the LineageOS install page for your codename:

Device Model Number Codename
Galaxy S10 (Exynos) SM-G973F beyond1lte
Galaxy S10+ (Exynos) SM-G975F beyond2lte
Galaxy S10e (Exynos) SM-G970F beyond0lte
Galaxy S10 (Snapdragon) SM-G973U beyond1q — locked bootloader, no LineageOS

Exynos Only

This flow targets the Exynos international models (SM-G97xF). The US/China Snapdragon variants (SM-G97xU) have locked bootloaders and no LineageOS build, so this path does not apply to them — use NetHunter Rootless instead. Confirm your model in Settings → About Phone and stop if your filenames do not match it.

If Heimdall Is Unstable

Run heimdall detect before you attempt a flash. If the device disconnects repeatedly, change cable, change USB port, reboot both devices, and only then troubleshoot packages or drivers. Do not keep retrying a flaky flash with the same hardware setup.

Step 3.2: Flash Recovery + vbmeta with Heimdall

With the phone in Download Mode (from Section 2), flash Lineage Recovery and the empty vbmeta in one command. Writing the empty vbmeta disables Android Verified Boot so the custom recovery and ROM will boot.

bash 
# Navigate to your download folder
cd ~/nethunter-install

# Phone in Download Mode:
#   power off -> hold Vol Up + Vol Down -> plug in USB -> Vol Up to continue

# Confirm Heimdall sees the device
heimdall detect

# Flash Lineage Recovery to the RECOVERY partition and write the empty
# vbmeta to disable Verified Boot. --no-reboot keeps you in Download Mode.
heimdall flash --RECOVERY recovery.img --VBMETA vbmeta.img --no-reboot
# Navigate to your download folder
cd ~/nethunter-install

# Phone in Download Mode:
#   power off -> hold Vol Up + Vol Down -> plug in USB -> Vol Up to continue

# Confirm Heimdall sees the device
heimdall detect

# Flash Lineage Recovery to the RECOVERY partition and write the empty
# vbmeta to disable Verified Boot. --no-reboot keeps you in Download Mode.
heimdall flash --RECOVERY recovery.img --VBMETA vbmeta.img --no-reboot

Filenames

recovery.img is the Lineage Recovery image for your codename; vbmeta.img is the empty vbmeta from the same LineageOS install page. If your filenames differ, rename them or adjust the command — the --RECOVERY and --VBMETA flags are what matter.

Step 3.3: Boot Straight Into Recovery

This is the single most common place people brick the flow. You must jump directly from Download Mode into recovery. If you let stock Android boot even once, it restores the stock recovery and you have to flash again.

  1. Leave USB disconnected after the flash completes.
  2. Force-exit Download Mode: hold Volume Down + Power for ~7 seconds until the screen goes black.
  3. The instant the screen goes black, switch to Volume Up + Bixby + Power and keep holding.
  4. Release when the Lineage Recovery menu appears.

Wipe Everything First

In Lineage Recovery, choose Factory reset → Format data/factory reset and confirm before sideloading anything. This clears Samsung's forced encryption so the new ROM boots cleanly. You can navigate the menu with the volume keys and select with power.

4. Install LineageOS, Magisk & NetHunter

Everything from here is done with adb sideload from Lineage Recovery, then finished inside the Magisk app. Do it in order — the ROM must be in place before root, and root must work before NetHunter.

Order of Operations

  1. In Lineage Recovery: Factory reset → Format data (done in Section 3.3).
  2. Sideload the LineageOS ROM.
  3. Sideload MindTheGapps — optional; skip for a cleaner pentest device.
  4. Sideload Magisk (renamed to .zip), reboot, then finish root in the Magisk app.
  5. Push the NetHunter installer and install it as a Magisk module.

Step 4.1: Sideload LineageOS (and optional GApps)

In Lineage Recovery choose Apply update → Apply from ADB, then sideload each file. Re-enter Apply from ADB before each new sideload.

bash 
# Recovery: Apply update -> Apply from ADB, then on your Kali machine:

# 1) Sideload the LineageOS ROM (match your exact filename)
adb -d sideload lineage-22.2-*-beyond1lte-signed.zip

# 2) (Optional) Google apps — re-enter Apply from ADB first, then:
adb -d sideload MindTheGapps-*-arm64-*.zip
#    A "Signature verification failed" prompt is normal for GApps — choose Yes.
#    Skip this file entirely if you do not want Google services.
# Recovery: Apply update -> Apply from ADB, then on your Kali machine:

# 1) Sideload the LineageOS ROM (match your exact filename)
adb -d sideload lineage-22.2-*-beyond1lte-signed.zip

# 2) (Optional) Google apps — re-enter Apply from ADB first, then:
adb -d sideload MindTheGapps-*-arm64-*.zip
#    A "Signature verification failed" prompt is normal for GApps — choose Yes.
#    Skip this file entirely if you do not want Google services.

Step 4.2: Sideload Magisk and Finish Root

Use the Version the Kali Doc Recommends

The official S10 guide currently recommends Magisk v28.1 and explicitly warns against v29 (known issues on this device). Check the doc for the current recommendation before you download.
bash 
# Recovery expects a .zip, so copy the Magisk APK to a .zip first
cp Magisk-v28.1.apk Magisk-v28.1.zip

# Recovery: Apply update -> Apply from ADB, then:
adb -d sideload Magisk-v28.1.zip

# Now reboot to system (Recovery -> Reboot -> System) and finish Android setup.
# Then open the Magisk app:
#   - If it asks to finish setup, allow it (it may reboot once)
#   - Install -> "Direct Install (Recommended)" -> Reboot
# Recovery expects a .zip, so copy the Magisk APK to a .zip first
cp Magisk-v28.1.apk Magisk-v28.1.zip

# Recovery: Apply update -> Apply from ADB, then:
adb -d sideload Magisk-v28.1.zip

# Now reboot to system (Recovery -> Reboot -> System) and finish Android setup.
# Then open the Magisk app:
#   - If it asks to finish setup, allow it (it may reboot once)
#   - Install -> "Direct Install (Recommended)" -> Reboot

After the reboot, confirm Magisk shows an installed version number (not "N/A") before continuing. If it does not, re-open Magisk and run Direct Install again.

Step 4.3: Install NetHunter as a Magisk Module

With root working, push the NetHunter installer to the phone and install it from inside Magisk — there is no recovery flash for this step.

bash 
# From normal Android (root working), push the NetHunter installer:
adb push kali-nethunter-*-beyond1lte-*.zip /sdcard/

# In the Magisk app:
#   Modules -> Install from storage -> select the NetHunter zip
#   Reboot when prompted
# From normal Android (root working), push the NetHunter installer:
adb push kali-nethunter-*-beyond1lte-*.zip /sdcard/

# In the Magisk app:
#   Modules -> Install from storage -> select the NetHunter zip
#   Reboot when prompted

Internal Wi-Fi Monitor Mode (Nexmon)

The S10's built-in Wi-Fi only does monitor mode / injection if you also install the optional Nexmon Magisk module for your kernel. Without it, use a supported external USB adapter (see Post-Install). Match the Nexmon module to your exact LineageOS/kernel build.

First Boot Takes Time

The first boot after installing the NetHunter module can take 5-15 minutes. The screen may stay black or sit on the logo for a while. Do not force restart — let it complete.

Healthy First Boot

Boot animation runs for several minutes, then Android setup appears and Magisk plus NetHunter apps are present.

Recovery Loop

Usually points to a bad recovery handoff, storage mount issue, or an incomplete ROM flash.

Samsung Logo Loop

Usually means version mismatch, encryption not cleared, or the wrong flash order. Go back to recovery instead of repeatedly hard rebooting.

5. First Boot & Configuration

Step 5.1: Initial Android Setup

  1. Complete Android setup wizard (WiFi, skip Google account for now)
  2. Open the app drawer — you should see NetHunter, NetHunter Store, NetHunter Terminal, and Magisk
  3. Open Magisk and verify it shows "Installed" with a version number

Step 5.2: Grant Root Access

  1. Open NetHunter app
  2. A Magisk superuser prompt will appear — tap Grant
  3. The app will initialize and download additional components
  4. Open NetHunter Terminal — grant root when prompted

Step 5.3: Verify Installation

bash 
# Open NetHunter Terminal and run:

# Check root access
su -c id
# Should show: uid=0(root)

# Check NetHunter chroot
nethunter
# Should drop you into Kali shell

# Verify Kali
cat /etc/os-release
# Should show Kali Linux

# Check kernel features
nethunter -c "ls /lib/modules"
# Should list kernel modules

# Exit chroot
exit
# Open NetHunter Terminal and run:

# Check root access
su -c id
# Should show: uid=0(root)

# Check NetHunter chroot
nethunter
# Should drop you into Kali shell

# Verify Kali
cat /etc/os-release
# Should show Kali Linux

# Check kernel features
nethunter -c "ls /lib/modules"
# Should list kernel modules

# Exit chroot
exit

6. Post-Install Setup

Update Kali Chroot

bash 
# Enter NetHunter chroot
nethunter

# Update package lists and upgrade
apt update && apt full-upgrade -y

# Install additional tools
apt install -y seclists wordlists nmap sqlmap

# Clean up
apt autoremove -y && apt autoclean

# Exit chroot
exit
# Enter NetHunter chroot
nethunter

# Update package lists and upgrade
apt update && apt full-upgrade -y

# Install additional tools
apt install -y seclists wordlists nmap sqlmap

# Clean up
apt autoremove -y && apt autoclean

# Exit chroot
exit

Configure Kali Services

NetHunter includes a service manager. Open the NetHunter app and navigate to:

SSH Server

Enable to SSH into your phone from another machine. Change default credentials!

Apache + MySQL

Host phishing pages or run local web tools.

VNC Server

Get a full Kali desktop on your phone.

Bluetooth Arsenal

Bluetooth scanning and attacks.

External WiFi Adapter Setup

For packet injection and monitor mode, connect a supported external USB WiFi adapter via OTG:

bash 
# Recommended adapters with NetHunter kernel support:
# - Alfa AWUS036ACH (RTL8812AU)
# - Alfa AWUS036NHA (Atheros AR9271)
# - Panda PAU05 (RT5372)

# Connect adapter via OTG cable, then:
nethunter

# Check interface
ip a
# Should show wlan1 or similar

# Enable monitor mode (using NetHunter app is easier)
airmon-ng check kill
airmon-ng start wlan1

# Verify monitor mode
iwconfig
# Should show wlan1mon in Monitor mode
# Recommended adapters with NetHunter kernel support:
# - Alfa AWUS036ACH (RTL8812AU)
# - Alfa AWUS036NHA (Atheros AR9271)
# - Panda PAU05 (RT5372)

# Connect adapter via OTG cable, then:
nethunter

# Check interface
ip a
# Should show wlan1 or similar

# Enable monitor mode (using NetHunter app is easier)
airmon-ng check kill
airmon-ng start wlan1

# Verify monitor mode
iwconfig
# Should show wlan1mon in Monitor mode

HID Attacks (Keyboard Emulation)

One of NetHunter's killer features — your phone acts as a USB keyboard to type payloads:

  1. Open NetHunter → HID Attacks
  2. Choose a payload (e.g., PowerShell reverse shell, Windows backdoor)
  3. Connect phone to target Windows PC via USB
  4. Tap Execute — phone types the payload automatically

Authorized Use Only

HID attacks are extremely powerful. Only use on systems you own or have explicit written permission to test.

7. Troubleshooting

OEM Unlock is grayed out

Connect to WiFi and leave the phone on for 7 days (Samsung's waiting period for new devices). If it's a carrier-locked phone, you may need to unlock from carrier first.

Heimdall doesn't detect device

First eliminate transport issues: swap the cable, move to a direct USB port, disconnect hubs, and boot the phone fully back into Download Mode before changing packages.

bash 
# Add udev rules for Samsung
sudo tee /etc/udev/rules.d/51-android.rules << 'EOF'
SUBSYSTEM=="usb", ATTR{idVendor}=="04e8", MODE="0666", GROUP="plugdev"
EOF

# Reload udev
sudo udevadm control --reload-rules
sudo udevadm trigger

# Reconnect device and try again
# Add udev rules for Samsung
sudo tee /etc/udev/rules.d/51-android.rules << 'EOF'
SUBSYSTEM=="usb", ATTR{idVendor}=="04e8", MODE="0666", GROUP="plugdev"
EOF

# Reload udev
sudo udevadm control --reload-rules
sudo udevadm trigger

# Reconnect device and try again

Samsung boots back to stock recovery

That usually means Android booted once before you entered Lineage Recovery, so stock restored itself. Re-flash recovery.img + vbmeta.img with Heimdall, then boot directly into recovery (Vol Up + Bixby + Power) without letting Android boot in between.

Boot loop after flashing

Boot back into Lineage Recovery (Vol Up + Bixby + Power) and:

  1. Go to Factory reset → Format data and confirm
  2. Verify your LineageOS ROM and NetHunter filenames target the same generation (e.g. both LineageOS 22.x)
  3. Re-sideload in order: LineageOS → (optional GApps) → Magisk, then re-add the NetHunter module from the Magisk app
  4. If it still fails, do a clean re-flash following the official LineageOS install guide before retrying NetHunter

NetHunter app shows "Chroot not found"

The chroot may not have extracted. Open NetHunter → Kali Chroot Manager and tap Install Kali Chroot. Choose "Full" for all tools or "Minimal" for faster install.

Magisk opens as a stub or root prompts never appear

Launch Magisk once after first boot, run Install → Direct Install, and reboot. If root is still missing, return to Lineage Recovery and re-sideload the recommended Magisk .zip before troubleshooting NetHunter itself.

WiFi injection not working

Your device may not have a custom kernel with injection patches. Check the NetHunter supported devices page. If not listed, you'll need NetHunter Lite with an external adapter.

8. Notes for Other Devices

Use Vendor-Specific Unlock Paths

The overall logic stays the same on other devices, but bootloader unlock, recovery flashing, and anti-rollback behavior vary by vendor. Treat the sections below as direction, not as a substitute for the official recovery and ROM instructions for your exact model.

OnePlus Devices

Excellent NetHunter support. Bootloader unlock is simpler (Settings → Developer Options → OEM Unlock is instant).

  • • Use fastboot instead of Heimdall
  • • 7/8/9 series are A/B (no recovery partition): fastboot boot twrp.img, then flash from booted TWRP
  • • OnePlus 7/8/9 series have full kernel support

Google Pixel

Great development support but limited NetHunter kernel features.

  • • Use fastboot
  • • fastboot flashing unlock
  • • NetHunter Lite recommended

Xiaomi Devices

Bootloader unlock requires Mi Unlock tool and a waiting period (72h-30d).

  • • Apply via Mi Unlock
  • • Some models have excellent kernel support
  • • Check XDA forums for device-specific guides

Snapdragon Samsung

US carrier variants often have locked bootloaders that cannot be unlocked.

  • • Check model: SM-G973U (locked) vs SM-G973U1 (unlocked)
  • • U1 (unlocked) variants may work
  • • Consider NetHunter Rootless as fallback

Best Devices for NetHunter (2026)

Always confirm current support on the official NetHunter devices list before buying — support moves.

  • OnePlus 7/7T/8/8T/Nord — Long-standing favorites: easy unlock, full kernel features
  • Samsung Galaxy S10 (Exynos) — This guide's target; solid HID + LineageOS path
  • Google Pixel 6 / 7 / 8 — Trivial unlock and clean AOSP base (often NetHunter Lite for kernel features)
  • Xiaomi Poco F-series — Budget-friendly with active custom-kernel communities

Quick Reference Card

S10 Boot Key Combos

Download Mode Vol Up + Vol Down + USB cable
Recovery (Lineage) Vol Up + Bixby + Power (hold until logo)
Force Restart Vol Down + Power (hold 10+ sec)
Safe Mode Hold Vol Down during boot logo
bash 
# === NETHUNTER QUICK COMMANDS ===

# Enter Kali chroot
nethunter

# Start Kali chroot with command
nethunter -c "nmap -sV 192.168.1.1"

# Start KeX (VNC desktop)
nethunter kex &

# Check root
su -c id

# WiFi monitor mode (in chroot)
airmon-ng start wlan1

# Packet capture
airodump-ng wlan1mon

# === HEIMDALL COMMANDS ===
heimdall detect
heimdall flash --RECOVERY recovery.img --VBMETA vbmeta.img --no-reboot
heimdall print-pit  # Print partition table

# === S10 SIDELOAD (in Lineage Recovery: Apply update -> Apply from ADB) ===
adb -d sideload lineage-*-beyond1lte-signed.zip
adb -d sideload Magisk-v28.1.zip   # renamed from .apk
# === NETHUNTER QUICK COMMANDS ===

# Enter Kali chroot
nethunter

# Start Kali chroot with command
nethunter -c "nmap -sV 192.168.1.1"

# Start KeX (VNC desktop)
nethunter kex &

# Check root
su -c id

# WiFi monitor mode (in chroot)
airmon-ng start wlan1

# Packet capture
airodump-ng wlan1mon

# === HEIMDALL COMMANDS ===
heimdall detect
heimdall flash --RECOVERY recovery.img --VBMETA vbmeta.img --no-reboot
heimdall print-pit  # Print partition table

# === S10 SIDELOAD (in Lineage Recovery: Apply update -> Apply from ADB) ===
adb -d sideload lineage-*-beyond1lte-signed.zip
adb -d sideload Magisk-v28.1.zip   # renamed from .apk

Go Deeper After Setup

Wireless Pentesting Put the NetHunter build to work on authorized Wi-Fi methodology. Mobile Testing Move into Android and iOS security assessment workflows.

Operational Safety Baseline

Apply these rules before running any lab command on this page.

  • Work only on systems you own or have explicit authorization to test.
  • Keep vulnerable services off your home LAN and off public interfaces.
  • Take clean snapshots before every exercise and before every vulnerable configuration change.
  • Use dedicated cloud accounts, subscriptions, and projects with billing alerts before deployment.
  • Write down the teardown command before you run the setup command.

Validation Checkpoints

  • -adb and flashing tool detect device
  • -Downloaded files match codename
  • -First boot completes
  • -NetHunter app and chroot launch

Cleanup And Rollback

  • -Keep stock firmware/recovery links
  • -Document Knox/warranty state
  • -Remove unauthorized test profiles

Practice Next

Mobile Testing Wireless Lab

Related Topics

Kali Linux Setup

Configure your desktop Kali machine

Wireless Pentesting

WiFi attacks and WPA cracking

Physical Security

HID attacks and social engineering

Mobile Testing

Android and iOS security assessment