This is NOT just another rooted phone. The kernel was rebuilt by hand from Google's AOSP source to switch on the hardware-hacking features the stock Pixel kernel deliberately blocks — then loaded with the FULL Kali NetHunter on top. Look at what it can do.
Anyone can flash a pre-made image. This went further. The kernel was compiled from the Google AOSP source tree android-gs-raviole-6.1-android16, specifically to unlock the security-research hardware features that the stock Pixel kernel locks down. It boots and runs on the device right now.
Kernel: 6.1.124-android14-11-ga4662a84a15f-dirty
Getting external Wi-Fi injection drivers, OTG host mode and the BadUSB gadget stack to actually compile in and load on a modern Pixel running Android 16 is days of skilled work. That work is done, verified on-device, and ready to use. This is what separates this unit from a generic "rooted phone".
Sitting on top of that kernel is Kali NetHunter 2026.2 — the full ARM64 Kali Linux chroot — with the kali-linux-everything metapackage installed. That is 4,579 packages: essentially every tool in Kali Linux, the biggest possible toolset, pre-installed and ready to run.
Marquee tools already on board:
Metasploit Framework • aircrack-ng suite • wifite • Kismet • hcxdumptool • mdk4 • reaver • bully • bettercap • Responder • hashcat • Burp Suite • Nmap • SET (Social-Engineer Toolkit) • Wireshark • and thousands more.
Root is provided by Magisk 30.7 — full systemless root, verified as MagiskSU in the NetHunter app.
| Device | Google Pixel 6 (oriole) |
| Storage / RAM | 128 GB / 8 GB |
| Operating system | Android 16 |
| Kernel | Custom, compiled from AOSP source (6.1.124-android14-11) |
| Security OS | Kali NetHunter 2026.2 (kali-linux-everything, 4,579 pkgs) |
| Root | Magisk 30.7 (systemless / MagiskSU) |
| Bootloader | Unlocked (required for this build) |
| Condition | Used — fully functional |
Underneath all the security tooling it is still a normal, fully working Android 16 Pixel 6 — calls, apps, Play Store, the lot. Carry one device that handles your day and your lab, instead of two.
Is it still a normal phone I can use every day?
Yes. It's a standard Android 16 Pixel 6 — calls, texts, Play Store and your normal apps. NetHunter runs alongside Android and only does anything when you open it, so you can daily-drive it with the full toolkit on tap.
What makes the custom kernel special — isn't this just a rooted phone?
Much more than that. The kernel was compiled from Google's AOSP source to switch on hardware the stock Pixel kernel blocks: built-in 88XXau Wi-Fi injection drivers, a mac80211 injection patch, USB OTG host mode, a full BadUSB/HID gadget stack and unsigned-module loading. That bespoke kernel is what turns a Pixel 6 into a genuine portable security-research rig.
Do I need a Wi-Fi adapter, and is one included?
An external USB Wi-Fi adapter is NOT included. You don't need one for the internal Wi-Fi or most NetHunter tools. For monitor mode and injection on external hardware, the drivers are already built in and loaded — just plug a supported Realtek 88XXau adapter into the USB-C port via OTG.
Can it be reset or returned to stock Android?
Yes. Because the bootloader is unlocked, the device can be returned to fully stock Google firmware at any time by flashing the official Pixel 6 factory image — root, the custom kernel and NetHunter are all removable. Or leave it as-is and enjoy the full toolkit out of the box.
Will Wi-Fi, root and NetHunter all be working when it arrives?
Yes. Everything described is real, compiled in and verified loaded before sale: the custom kernel, Magisk root, the 88XXau injection drivers, and the full NetHunter 2026.2 chroot with 4,579 packages and the complete app suite. The photos show the actual kernel string, package count and loaded drivers.
Built and sold for authorised penetration testing, security research, CTF competitions and education — a genuinely capable mobile testing platform, engineered properly, from the kernel up. Always test only networks and devices you own or have explicit written permission to test.
PrivacyPortal · UK seller · priced in GBP (£). Note: a USB Wi-Fi adapter is not included — just plug in any supported 88XXau-class adapter and you're injecting.
This is a specialist security-research tool, not a consumer smartphone. Experience with Kali Linux and Kali NetHunter is expected. We are not a training service – we cannot teach you Kali or walk you through commands line by line, and we do not provide tutorials on how to use the tooling. You should already be comfortable with Kali, the NetHunter app and a Linux terminal before you buy.
You also need a Windows PC to debug, reflash or recover the device if something goes wrong. If you do not have one, or you are not confident recovering a phone yourself, this listing is not for you.
If you are completely new to this, we would genuinely suggest starting with something like a Flipper Zero instead. Buying this device without the background to use it is the single most common reason people are disappointed with it.
These devices are temperamental by design. They run a custom kernel compiled specifically with penetration testing in mind, and building that kernel can remove or disable features you would normally expect on a standard smartphone – the fingerprint scanner is the most common example.
Do not expect this to behave like a normal phone. Calls, mobile data, VoLTE and SIM behaviour are not guaranteed, particularly on older handsets and on networks that have shut down their 2G/3G services. This is a lab and research tool, not a daily driver.
Never accept OTA or system updates. Updates remove root, break the NetHunter installation and can leave the device in a bootloop. Damage caused by running an update is not a fault with the device.
Full Kernel NetHunter is compatible with monitor mode and packet injection. However, the phone's internal Wi-Fi chipset does not perform them. You need an external USB Wi-Fi adapter (an Alfa or similar). Bluetooth Arsenal likewise requires an external Bluetooth adapter – our kernels support these without issue.
We do not supply Wi-Fi or Bluetooth adapters with this device. They must be purchased separately.
If monitor mode or injection is not working for you, it is because you are not using an external adapter – not because you have received a Lite build. Every device we sell as Full Kernel ships with the full kernel flashed.
Handset only. No charger, no cable, no retail box, and no Wi-Fi or Bluetooth adapter. An external adapter is required for monitor mode and injection and is your responsibility to source.
Every phone ships with its kernel file on the device, so you can reflash or reinstall yourself if needed.
The device comes with a working base Kali install. We do not preload kali-everything – that is roughly 20GB of tooling that 98% of users will never touch. Installing the specific Kali metapackages and modules you actually need is up to you.
Once your order is placed, message us and ask for access to our 24/7 help server. That is where you will find setup guidance, device-specific quick-start guides and troubleshooting help whenever you need it.
This device is sold strictly for education, research, development and authorised security testing on systems you own or have explicit written permission to test. Please do not contact us asking for help accessing, tracking or monitoring devices, accounts or networks that are not your own – we will not assist with it.
This phone is dispatched from the United Kingdom. If you are buying from outside the UK, your country may charge import duty, customs fees, VAT/GST or a carrier handling fee before the parcel is released to you. These charges are set by your own customs authority, they are not included in the item price, and as the seller we cannot calculate, pre-pay or refund them.
This applies to every destination outside the UK, including the United States. The postage options in the shipping panel below differ in speed only — import charges are payable by you on all of them.
The handset in this listing (Google Pixel 6 · 128GB · Grey) is pre-owned. It is sold as used and will show some cosmetic wear from normal use.
Please also bear in mind this model was released in 2021, so the unit you receive is around 5 years old. It has been tested and works, but it will not look or perform like a current handset.
The photographs show the kind of condition to expect. If cosmetic perfection matters to you, please look at them carefully first, or message us before buying and we will describe the exact handset you would receive. We would much rather answer that up front than have the handset travel twice.
The battery in a pre-owned phone is a consumable part. Unless this listing states otherwise, we test every device and only dispatch units showing 85% or above battery health.
Because this model dates from 2021, the cell is roughly 5 years old. Even at 85%+ health you should expect noticeably shorter runtime than a new handset, and you may want to budget for a replacement battery at some point.
We quote 85% as a minimum rather than an exact figure, because health readings shift with temperature, charge cycles and the reporting tool used. If you need the measured figure for the exact unit before you commit, ask and we will check it for you.
None of the above is a fault — it is how this kind of device works. Please factor it in before purchasing, and if you are unsure whether it suits you, message us and we will give you a straight answer.
Google Pixel 6 is sold unlocked, but your carrier decides what actually works. Please check compatibility before buying, particularly outside the UK:
The model reference for this unit is GB7N6. We are happy to supply the IMEI before purchase so you can check it against your carrier — just ask.
Handset only, unless an accessory is explicitly listed above or clearly shown in the photographs. Chargers, cables, cases and SIM tools are not included as standard. Every device is securely packaged for transit.
If anything above is unclear, or you want the exact condition, battery figure or IMEI of the unit you would receive, message us through eBay before purchasing and we will answer properly. If something is wrong after delivery, message us first — we would always rather put it right quickly than leave you with something that is not right.