BackBox Linux can be easily downloaded from its official download page. Although both direct and torrent downloads are available, it's usually recommended to use the latter.

After downloading the ISO image, a verification step is required in order to exclude any potential file corruption during the download. This verification is done calculating the sha256 digest (md5 is weak nowadays) of the downloaded file and comparing it with the sha256 value of the file in the download page. It's as easy as opening a terminal and running:

sha256sum /path/to/BackBox/ISO/image

If the string obtained from the output of the above command doesn't match the one in the download page it indicates that the file was corrupted during the download and the download has to be performed once more.

With the ISO image downloaded and verified, you can now create a BackBox bootable device.