This is NOT just another rooted phone. The kernel was rebuilt by hand from Google's AOSP source to switch on the hardware-hacking features the stock Pixel kernel deliberately blocks — then loaded with the FULL Kali NetHunter on top. Look at what it can do.
Anyone can flash a pre-made image. This went further. The kernel was compiled from the Google AOSP source tree android-gs-raviole-6.1-android16, specifically to unlock the security-research hardware features that the stock Pixel kernel locks down. It boots and runs on the device right now.
Kernel: 6.1.124-android14-11-ga4662a84a15f-dirty
Getting external Wi-Fi injection drivers, OTG host mode and the BadUSB gadget stack to actually compile in and load on a modern Pixel running Android 16 is days of skilled work. That work is done, verified on-device, and ready to use. This is what separates this unit from a generic "rooted phone".
Sitting on top of that kernel is Kali NetHunter 2026.2 — the full ARM64 Kali Linux chroot — with the kali-linux-everything metapackage installed. That is 4,579 packages: essentially every tool in Kali Linux, the biggest possible toolset, pre-installed and ready to run.
Marquee tools already on board:
Metasploit Framework • aircrack-ng suite • wifite • Kismet • hcxdumptool • mdk4 • reaver • bully • bettercap • Responder • hashcat • Burp Suite • Nmap • SET (Social-Engineer Toolkit) • Wireshark • and thousands more.
Root is provided by Magisk 30.7 — full systemless root, verified as MagiskSU in the NetHunter app.
| Device | Google Pixel 6 (oriole) |
| Storage / RAM | 128 GB / 8 GB |
| Operating system | Android 16 |
| Kernel | Custom, compiled from AOSP source (6.1.124-android14-11) |
| Security OS | Kali NetHunter 2026.2 (kali-linux-everything, 4,579 pkgs) |
| Root | Magisk 30.7 (systemless / MagiskSU) |
| Bootloader | Unlocked (required for this build) |
| Condition | Used — fully functional |
Underneath all the security tooling it is still a normal, fully working Android 16 Pixel 6 — calls, apps, Play Store, the lot. Carry one device that handles your day and your lab, instead of two.
Is it still a normal phone I can use every day?
Yes. It's a standard Android 16 Pixel 6 — calls, texts, Play Store and your normal apps. NetHunter runs alongside Android and only does anything when you open it, so you can daily-drive it with the full toolkit on tap.
What makes the custom kernel special — isn't this just a rooted phone?
Much more than that. The kernel was compiled from Google's AOSP source to switch on hardware the stock Pixel kernel blocks: built-in 88XXau Wi-Fi injection drivers, a mac80211 injection patch, USB OTG host mode, a full BadUSB/HID gadget stack and unsigned-module loading. That bespoke kernel is what turns a Pixel 6 into a genuine portable security-research rig.
Do I need a Wi-Fi adapter, and is one included?
An external USB Wi-Fi adapter is NOT included. You don't need one for the internal Wi-Fi or most NetHunter tools. For monitor mode and injection on external hardware, the drivers are already built in and loaded — just plug a supported Realtek 88XXau adapter into the USB-C port via OTG.
Can it be reset or returned to stock Android?
Yes. Because the bootloader is unlocked, the device can be returned to fully stock Google firmware at any time by flashing the official Pixel 6 factory image — root, the custom kernel and NetHunter are all removable. Or leave it as-is and enjoy the full toolkit out of the box.
Will Wi-Fi, root and NetHunter all be working when it arrives?
Yes. Everything described is real, compiled in and verified loaded before sale: the custom kernel, Magisk root, the 88XXau injection drivers, and the full NetHunter 2026.2 chroot with 4,579 packages and the complete app suite. The photos show the actual kernel string, package count and loaded drivers.
Built and sold for authorised penetration testing, security research, CTF competitions and education — a genuinely capable mobile testing platform, engineered properly, from the kernel up. Always test only networks and devices you own or have explicit written permission to test.
PrivacyPortal · UK seller · priced in GBP (£). Note: a USB Wi-Fi adapter is not included — just plug in any supported 88XXau-class adapter and you're injecting.