Kioptrix Downloads

Choose the Kioptrix virtual machine you need, then follow the setup guide. Older /dlvm/ links may bring you here because the archives are now available through external VulnHub mirrors.

New to Kioptrix? Start with Level 1: download and setup. This page contains download and setup information; solutions are linked separately.

Need a learning plan? Follow the seven-session beginner roadmap. If the image will not open, use the VMX, VMDK and appliance import checklist.

Kioptrix Level 1 (#1)

Kioptrix_Level_1.rar · 186 MB · VMware files

Download Level 1 — VulnHub mirror
Release details and checksums · Step-by-step setup guide

Kioptrix Level 2 — Level 1.1 (#2)

The updated archive is Kioptrix_Level_2-update.rar (406 MB). Older links use Kioptrix_Level_2.rar; use the updated release listed by VulnHub.

Download Level 2 — VulnHub mirror
Release notes, file details and checksums

Kioptrix Level 3 — Level 1.2 (#3)

Looking for KVM3.rar? Open the Level 3 guide for the download and preparation steps.

Level 3 download and setup guide
VulnHub release details

Kioptrix Level 4 — Level 1.3 (#4)

Choose the archive for your virtualization software. These are separate VM packages.

Level 4 release details and checksums

Kioptrix 2014 (#5)

kiop2014.tar.bz2 · 787 MB. The release page also lists compatibility notes and a small fix archive; review those if your virtualization software cannot open the VM.

Download Kioptrix 2014 — VulnHub mirror
Release notes, fixes and checksums

Check the archive before extracting it

Choose the exact release and package first. Compare the checksum of the downloaded archive with the checksum for that same filename on its release page. Rounded MB sizes are only a quick clue, not a complete integrity check.

# Linux example — use the actual archive filename
sha1sum KVM3.rar
# macOS example for the same archive
shasum -a 1 KVM3.rar

These examples calculate SHA-1 locally; they do not download or boot a VM. Compare only the hexadecimal digest, excluding the filename. If the release supplies MD5 instead, calculate MD5 and compare it with that MD5 value. Do not compare different algorithms.

A matching legacy MD5 or SHA-1 checksum helps detect a wrong or damaged download. It does not prove that an intentionally vulnerable VM is safe or establish cryptographic authenticity. If the digest differs, stop before booting: check the exact release, filename and completed download, then obtain another copy from the listed source.

Compare two checksum strings locally

No file is uploaded. This compares text you supply; it does not hash the archive.

Inputs remain on this page and clear on reload; the comparator sends and stores nothing.

Documentation: VulnHub file-integrity guidance. This proposed procedure has not been independently run in a VM for this update.

Before starting a lab

These machines are intentionally vulnerable. Use only an isolated practice network you control. Keep them separate from your everyday devices, personal data and public networks. Check the VulnHub safety guidance before starting.

Extract the complete archive, keep its files together and check compatibility with your virtualization software. If a mirror is unavailable, use the corresponding release page above to find its current download options. Downloads are hosted by VulnHub, not by this website.

Continue learning