Using the operating system Kali Linux Using a virtual machine as the primary platform for everyday tasks isn't always practical or secure, so most information security professionals prefer to run it in a virtual environment. However, when it comes to testing the security of wireless networks, standard host network card emulation is no longer sufficient, as the virtual machine, by default, only accesses the internet through NAT, without seeing the physical interface. For a full-fledged Wi-Fi network audit, you need direct access to the wireless adapter, put it into monitor mode, and inject data packets.
The process of forwarding a USB device to a guest OS requires an understanding of the virtualization architecture and proper configuration of both the virtual machine, and the host system. Errors at this stage often result in the adapter either not being detected by the system at all or operating erratically, dropping the connection at a critical moment during airtime scanning. In this article, we'll cover the connection mechanics, selecting the appropriate hardware, and configuring drivers to ensure stable operation in this mode. Monitor Mode.
It's worth noting that the success of this operation directly depends on the compatibility of your WiFi adapter with the Linux kernel and hypervisor capabilities. Not all wireless cards are capable of working correctly through the virtualization layer, and some require manual compilation of kernel modules. Only adapters with Atheros, Ralink, and Realtek chipsets (of certain series) guarantee stable operation in packet injection mode within a virtual environment. Let's move from theory to practice and set up your workstation for pentesting.
Choosing a Compatible WiFi Adapter for Virtualization
The first and most critical step is hardware selection, as the modules built into laptops are almost never suitable for this purpose due to the lack of driver support for the necessary functions in a virtual environment. You'll need an external USB adapter that the host operating system can properly release and hand over full control to the guest OS. When choosing a device, pay primary attention to the chipset, not the manufacturer's brand or the advertised speed.
Devices based on chips are considered the most preferable. Atheros AR9271, which are renowned for their native support in the Linux kernel and the lack of need to install proprietary drivers. Chipset-based adapters have also proven themselves to be effective. Ralink RT3070 And Realtek RTL8812AU, although the latter may require additional fuss with installing kernel header files. Buying a cheap 200-ruble adapter with an unknown chip is guaranteed to waste time and nerves down the road.
- 📡 Atheros AR9271 — an ideal choice for beginners, works out of the box without installing additional drivers.
- 📡 Ralink RT3070 / RT5370 — budget options with good support, but sometimes requiring firmware updates.
- 📡 Realtek RTL8812AU — supports the 802.11ac standard, but requires manual compilation of drivers in Kali.
- 📡 MediaTek MT7601U — a popular chip in cheap adapters, there is support, but the monitor mode may work unstable.
⚠️ Important: Integrated WiFi modules (PCIe/M.2) in laptops are extremely difficult or impossible to route to a virtual machine without using complex PCI Passthrough technologies, which are only available in KVM/QEMU on a Linux host. For VirtualBox and VMware on Windows, use only USB adapters.
When purchasing, look for an external antenna, as reception sensitivity in monitor mode is critical for capturing handshakes from a distance. Adapters without an antenna or with a small internal antenna often fail to "see" weak signals, rendering the audit process pointless. Also, make sure the adapter supports the 802.11n standard or higher if you plan to test modern networks, although older standards are sufficient for basic interception.
Configuring VirtualBox to Forward USB Devices
If you use Oracle VM VirtualBox, USB port forwarding functionality may be limited by default or require the installation of an additional extension pack. Without this component, the virtual machine simply won't see the connected device, leaving it under the control of the host system. First, make sure you have the latest version installed. Extension Pack, corresponding to the version of your VirtualBox, which can be downloaded from the developer's official website.
After installing the extension pack, you need to configure the specific virtual machine. In the VirtualBox manager window, select your Kali Linux machine, click "Configure," and go to the "USB" section. Here, you need to enable the USB controller by selecting version 2.0 or 3.0 (depending on your adapter and host support). It's recommended to select USB 2.0 for maximum compatibility, as many older but reliable WiFi adapters work better with this emulation standard.
At the bottom of the USB settings window, you'll see a list of available filters. Create a new filter by clicking the plus icon on the right and selecting your WiFi adapter from the drop-down list. This will create a rule that will cause VirtualBox to automatically "take" the device from Windows/macOS when starting the virtual machine and pass it on. Kali Linux.
⚠️ Note: If after connecting the adapter, it disappears from the device manager on the host system and doesn't appear in Kali, try disabling the filter, rebooting the virtual machine, and then re-enabling the filter. Sometimes, restarting the VirtualBox USB service on the host is required.
It's also worth checking the permissions on your host system. On Windows, running VirtualBox as an administrator is sometimes necessary for USB forwarding to work correctly, especially if device initialization errors occur. On Linux hosts (Ubuntu, Debian, Arch), your user must be a member of the group vboxusers, otherwise access to USB ports will be blocked by kernel security policies.
VMware Workstation and Player Configuration
Company products VMware While traditionally considered more productive for graphical interfaces and USB, configuring them for WiFi passthrough presents its own challenges. Unlike VirtualBox, it doesn't require installing separate extension packs for basic USB functionality, but USB drivers must be installed correctly on the host system. VMware automatically creates virtual USB controllers when creating a machine, but their settings may require manual adjustment.
To set up, go to VM → Settings → USB ControllerMake sure the "Connect automatically when a USB device is connected" checkbox is selected. If you want to permanently assign the adapter to the virtual machine, you can add a specific device using the "Add" button and select your WiFi adapter from the list. VMware is renowned for its ability to switch devices between the host and guest on the fly without rebooting.
Within a running Kali Linux, you can manage the connection using the menu at the bottom of the VMware window. If the adapter is connected to the host but is needed in the virtual machine, simply select it from the menu. Removable Devices and click "Connect (Disconnect from Host)". This mechanism is convenient because it allows you to quickly return control of the adapter to the host system, for example, if you need to check the operation of the drivers on Windows.
An important aspect for VMware is configuring the virtual machine's network adapters. Even if you forward USB WiFi, you still have a virtual network interface (usually NAT) through which the machine accesses the internet for updates. Don't disable it completely, otherwise you'll lose access to the repositories. Kali, which will make it difficult to install the missing drivers for the forwarded adapter.
USB 3.0 Issues in VMware
If your adapter isn't detected in USB 3.0 mode, try forcibly switching the port in the VM settings to USB 2.0. Some older WiFi chipsets don't work correctly with VMware xHCI controller emulation, causing connection drops or complete device invisibility.
Installing drivers and checking the monitor mode
After successfully forwarding the device to the virtual machine, the next step is to check its visibility in the system and install the necessary drivers. In the Kali Linux terminal, enter the command lsusbto make sure the system sees the connected device. If the device appears in the list but does not create a network interface (for example, wlan0), then the problem lies in the lack of drivers or firmware.
Installing drivers often requires kernel header files. Run the command sudo apt update && sudo apt install linux-headers-$(uname -r)to prepare the system for compiling modules. If your adapter requires proprietary drivers (for example, for Realtek), you may need to clone the repository from GitHub and compile the module manually using utilities. make And install.
After installing the drivers, you need to check the monitor mode support. Use the utility iwconfig or more modern iw devTo switch the adapter to the full-bandwidth listening mode, run the command:
sudo ip link set wlan0 downsudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up
If the commands are executed without errors, check the status with the command iwconfig. Your interface line should indicate Mode:MonitorIf you see the error “Device or resource busy,” it means that the process NetworkManager or another service is attempting to manage the adapter. In this case, you need to temporarily stop the network manager with the command sudo systemctl stop NetworkManager.
☑️ Checking adapter readiness
Solving common connection errors
Even when following all the instructions, users often encounter a number of common problems that can be confusing. One of the most common errors is "Failed to set channel," or the inability to change the channel. This is often due to the region being set incorrectly, and the adapter attempting to operate on prohibited frequencies. To fix this, use the command sudo iw reg set US or your country code to unblock channels.
Another common issue is that the adapter "disconnects" after a few minutes of use. This may be caused by USB power-saving settings in the host operating system. In Windows, go to Device Manager, find the USB controllers, and disable the "Disable device to save power" permission in the properties. On a Linux host, you may need to disable USB auto-suspend using TLP settings or similar utilities.
| Error | Probable cause | Solution method |
|---|---|---|
| Unknown USB Device | Extension Pack (VirtualBox) drivers are not installed. | Install the Extension Pack of the same version |
| Device busy | NetworkManager has seized the interface | Stop NetworkManager: systemctl stop NetworkManager |
| ioctl(SIOCSIWMODE) failed | The driver does not support Monitor Mode. | Replace the adapter with a compatible one (Atheros/Ralink) |
| Failed to init librt | Library or permissions conflict | Run terminal as root or check USB permissions |
It's also worth mentioning the issue of a stuck device. If you disconnected the adapter from the virtual machine, but it doesn't reappear in the host system and isn't detected, try physically reconnecting it to a different USB port. Sometimes the virtual machine doesn't release the resource correctly, and only a full reboot of the host or virtualization service resolves the issue.
Alternative methods and using Live USB
If all attempts to redirect a USB adapter to a virtual machine fail due to the specifics of your hardware or hypervisor, the "gold standard" is always running Kali Linux from a Live USB. This method eliminates all issues with USB bridge drivers and virtualization, as the OS works directly with the hardware. You simply write the Kali image to a USB drive (using Etcher or Rufus) and boot from it.
The advantage of a Live USB is that you get native support for all WiFi adapter features, including packet injection and external antennas, without any performance loss. However, this method has a drawback: by default, all system changes are not saved after a reboot unless persistence is configured. To configure persistent storage, you'll need to create a special partition on the flash drive when writing the image.
Another option is to use WSL2 (Windows Subsystem for Linux) with USB forwarding, but this method is considered experimental and less stable for pentesting. WiFi support in WSL2 is limited and requires complex network interface forwarding, so for serious wireless networking, it's better to use a full virtual machine or a Live USB.
⚠️ Warning: When running in Live USB mode without persistence, all installed packages and saved logs will disappear after power off. Be sure to configure data saving to an external drive or a second flash drive if you plan to run the installation for a long time.
The choice between a virtual machine and a Live USB depends on your needs. If you need the comfort of a desktop, the ability to easily take system snapshots, and work alongside other operating systems, a virtual machine is preferable. However, if maximum WiFi stability and compatibility with any adapter are your top priorities, a Live USB is unrivaled.
Why doesn't my adapter see 5 GHz networks in monitor mode?
Many budget adapters only support the 2.4 GHz band. To use the 5 GHz band (802.11a/n/ac standard), a dual-band adapter is required. Furthermore, the driver must support channel hopping in this band, which is not implemented in all chipsets.
Is it possible to use a laptop's built-in WiFi for Kali in VirtualBox?
Theoretically, you can try redirecting the internal PCIe module as USB (if it's emulated that way), but in practice, this almost never works reliably. Integrated cards often lack the packet injection features in the Windows/macOS drivers required for redirection.
How do I get control of the adapter back into Windows?
In the virtual machine menu (VirtualBox or VMware), find the USB icon in the lower status bar or in the devices menu. Click on the name of your adapter to uncheck the connection. The device should automatically return to control of the host operating system.
Does Kali Linux require internet access for its WiFi adapter to work?
Kali doesn't require internet access for packet capturing; the adapter operates offline. However, internet access is required for installing drivers, kernel updates, and tools such as aircrack-ngConfigure NAT for the virtual machine's primary network interface.