Building your own collection of hacker tools is great, but now it's customary to use one of the specialized distributions as a basis. This is usually Kali, but we will look at not only it, but also other distras for pentest, sometimes no less effective, and in some areas even more useful.
There are many distributions for pentest. Some are popular, others are not very popular, but they all aim to give the hacker a convenient and reliable tool for all occasions. The average hacker will never use most of the programs in such customized builds, but they are added to show off their status ("Look, you have 150 utilities, and I have 12,000!"). Today we will try to make an overview of most interesting distributions, both popular and undeservedly forgotten. If we missed something, don't hesitate to use comments. Let's go!
NST
Let's start with a little-known, but therefore no less interesting distribution. NST (Network Security Toolkit) is based on Fedora and is designed for network attacks. The interface is based on MATE, which evokes the feeling of the beginning of zero. The kit includes several dozen of the most important tools, mainly network scanners, clients for various services, and various traffic interceptors. But there are not enough such utilities as, for example, masscan, and even banal aircrack, although airsnort is available.
The main part of the software is located in the Internet folder
Most of the Goodies can be found in the applications → Internet folder. Here we have Angry IP Scanner, written, by the way, in Java, and Ettercap, and even OWASP ZAP, which we already wrote about in Hacker. There is a good collection of modules for all kinds of spoofing and scanning in the netwag package. In fact, it proved to be quite good, but it is a pity that it is not very convenient and terribly outdated.
All the software I've tested works fine. In General, anyone who misses the ancient interface and familiar tools is recommended.
Kali
As you probably know, Kali is one of the most widely distributed distributions for hackers, and it would be strange if we didn't write about it. Even schoolchildren know about it, and since relatively recently it has been available as an app directly from the Microsoft Store! Of course, accessibility is a definite plus, but the system is slightly overloaded with a set of tools (although not as much as BlackArch), and some of them work out of the box crookedly or do not work at all.
There is also no foolproof feature in Kali. As practice shows, not all users understand that you should not make this system the main one. From the core to the shell, it was created and optimized for performing combat tasks on the information security fronts and is poorly suited for quiet daily work. Many of the mechanisms needed in everyday life are simply missing there, and an attempt to install them is likely to cause failures in the normal operation of the OS, if it does not completely disable it.
In short, Kali is like matches-a powerful thing in skilled hands, it is easy to get, but it is better not to give it to children. It is not possible to cover all possible official and unofficial utilities at once (and there are more than 600 of them, for a moment) of this system, if only because new modules, frameworks, utilities and other gadgets are constantly appearing.
Kali is designed for a wide range of tasks, but the main one is attacks in the network environment, for example, finding vulnerabilities in web applications and gaining access to wireless networks. As the successor to BackTrack, Kali is generally well suited for working with wireless communication channels, especially Wi-Fi. Testing the strength of remote hosts is also possible using, for example, Metasploit (see our recent reviewfor more information), but the core and a significant part of the tools are focused on working with Wi-Fi.
Another of the advantages I note is the presence in the standard delivery of a large number of dictionaries for various attacks, not only on Wi-Fi, but also on Internet accounts and network services.
Kali works in WSL
For even greater usability, the official website offers a version of the distribution kit for virtual machines, because when hacking, it is much more reasonable to use the system without installing it — you never know who will then dig into your computer!
The verdict is: if you know how to use it, it's cool, but don't show it to your child. One of the authors saw what would happen if this instruction was violated.
DEFT
DEFT is home to Sunny Italy, and it's as generous as a cheese pizza, sprinkled with a variety of intelligence and hacking tools. At the same time, they are not tied to the distribution kit with blue electrical tape, but are quite harmoniously integrated into it. All together, it resembles an interesting and useful Swiss army knife.
Developed by DEFT on the Lubuntu platform and equipped with a user-friendly graphical interface. The product includes a set of specialized utilities, starting with antivirus programs, search engines for information in the browser cache, network scanners and other utilities, and ending with tools that are necessary when searching for hidden information on Yandex. disk.
Using this OS, you can easily access erased, encrypted, or corrupted data on various types of physical media.
The main Toolkit is hidden in the DEFT section, which, in turn, is located in some kind of"start" menu.
Initially, this distribution was designed for the needs of network police and information security incident response specialists, so another strength of DEFT is competitive intelligence, including analysis of relationships between social media accounts.
There is even an interesting utility for detecting the geolocation of a given LinkedIn or Twitter account. I haven't been able to check how effectively this works at the moment, but it does manage to determine whether an account belongs to a country or city.
Unlike Kali Linux or Tsurugi, deft has foolproof protection built in. Without proper training, almost no tool can simply be launched, and without a deep understanding of the work of protective mechanisms, there is nothing to do here at all.
Literally every application or option requires root access, so don't rush to launch everything at once or create an unprivileged user.
I also found a "gift": several repositories from which DEFT takes updates are closed with keys. I spent a couple of days searching the forums until I found where to request data from, and the keys themselves were also found.
As a result, this system is good for monitoring and investigating incidents, especially if there is physical access to information carriers — whether it is a disk, flash drive or smartphone (hacker, boss, employee, competitor, wife, mistress, her Bati — underline).
Tsurugi
This distribution is generally not very well known in the circles of information security specialists-perhaps because of its youth. However, Tsurugi is a brainchild born from the joint efforts of the creators of DEFT and Kali. What came of it? Let's take a look!
Tsurugi (this word means a two-handed Japanese sword) is based on Ubuntu, using MATE as the GUI. It is designed more for predictive Analytics or OSINT than for pentest, but its tools, as well as some features, allow it to be used in this direction as well. Initially, the system is delivered in live image mode, but if desired, you can perform a permanent installation.
Standard desktop
Once logged in, we see a simple GUI, thoughtfully hung on all sides with widgets for CPU usage indicators, hard drives, RAM, network speed, and more.
Yes, the hand of the creators of Kali is quite noticeable here. An abundance of pre-installed tools that are not always needed immediately catches your eye. At the same time, the system interface looks more than minimalistic and compact. But the logic of the security system, like working with the web or protecting against tracking, is based on the best practices of DEFT.
The entire main Arsenal is located in Applications → TSURUGI.
Tsurugi Menu
This includes working with images, malware analysis, data recovery, and, as mentioned, a set of utilities for OSINT.
It should be borne in mind that this OS, like Kali, does not have protection from crooked hands. It is suitable for those who have good Linux skills and act prudently and thoughtfully. Just like a sharp Japanese sword should be!
Extensive tools allow you to use the system as a multitool for a wide range of tasks. Tsurugi may look a bit like Kali, but there are still some serious differences. Despite the fact that some of the utilities, just like in Kali, do not work correctly or do not work at all, the percentage of problematic tools here is much less, and it is clear that someone cares about this.
If for some reason you do not want to use Kali, then Tsurugi will be a worthy tool in your kit. We won't give you five stars at least because one of the authors of this review put a brick away from the sound of a sword at the start of the OS... However, let's not talk about sad things.
Parrot
This beautiful Linux distribution is based on Debian and was developed by the Frozenbox team specifically for testing the security of computer systems, searching for and evaluating a variety of vulnerabilities.
What's inside? The desktop environment here is still the same MATE. The user experience is (subjectively) pleasant.
At the top, in the Application section, you will find the anon Surf utility. One of the features of Parrot is that some anonymization tools are pre installed in it, and if you select Anonsurf Start, all system traffic will be redirected via Tor. In the same section, you can also use the opennic DNS project, which is a non-national alternative to top-level domain registries. Here, by selecting the Check IP option, you can check the current external IP.
The second section is Cryptography. Here you should pay attention to the GPA utility-a graphical interface of the GnuPG program designed for encrypting information and creating electronic digital signatures. This is essentially an alternative to PGP encryption. And if you need GPG, then the zulucrypt utility is at hand — an analog of VeraCrypt, which allows you to encrypt folders, partitions, flash drives, and so on.
The next (and most interesting) section is Parrot. It contains exactly those utilities for testing the security of computer systems, because of which this OS was included in our review. Many of the utilities presented are already known to us from Kali Linux, but there are also some unique ones.
I would like to focus on the "Internet" tab in more detail. Here we see the pre-installed Tor Browser and the Electrum bitcoin wallet, as well as the XSSer utility, a framework for detecting and exploiting XSS vulnerabilities in web applications. There is also an email client called Claws Mail, which is a full-fledged email client with gpg encryption support. The bonus is Ricochet IM-a decentralized anonymous messenger that works through the Tor network.
These are probably all the features of Parrot Security OS that I would like to tell you about. As you can see, Parrot OS is not only suitable for penetration testing, it can also serve as an OS for daily use by those who know why they need it.
Parrot seemed to us to be a high-quality and conveniently made OS. It's nice to work with a system where you don't need to fix your tools first.
BlackArch
BlackArch is the largest distribution package in terms of image size. The current version takes up more than 14 GB! By the way, you can download it via torrent if you want, and there are always a lot of seeds.
Appreciate the friendliness of the interface: if you managed to pump out this monster and launch it, you need to enter your username and password, which you should read about on the site in the installation instructions (this is root/blackarch, if anything). Apparently, they forgot about live users.
Next: after the login, you can't see any hints about the menu or anything like that. Before us is almost naked Fluxbox, so it is called by right-clicking anywhere on the desktop.
BlackArch app groups
All applications are conveniently categorized in the blackarch submenu of the main menu. There are 49 categories that have tools for every occasion. Navigate through menus with the mouse, as in Windows? Oh no, you can safely forget about the mouse in this distribution. Only the keyboard, only hardcore! On the other hand, once you've decided to get involved with *nix systems and hacking, it's silly to count on something else.
As for the tools themselves, here are all the popular and not so popular hacking tools, including, of course, such iconic ones as Metasploit and BeEF XSS. Reviewing all the tools in this truly huge Suite is even more hopeless than in the case of Kali and Parrot. So I'll go over the top of it, and if you're interested, you can go as far into the documentation as you want.
Wine attacks!
BlackArch isn't shy about using Wine to run some "non-native" apps. As an example - mft2csv (in the screenshot above), which parses the MFT of the NTFS file system for further analysis. Java is also available (OpenJDK 14.0.1).
MSF is also in place
The terminal, as well as the entire graphical shell of the system, looks dull, but the software versions are up-to-date. On the one hand, it seems that they wanted to make it like in a movie about hackers, on the other hand, the system is still quite usable, although it requires serious skills.
In General, if you are not ready to Wade through the minefield of configs, arguments when launching software, googling for every sneeze and other charms of this multitool-look in the direction of Kali and Parrot, there is at least something you can do without a desktop directory. Blackarch is more than unfriendly to newcomers. And, clear stump, do not think to put it as the main one.
BackBox
And in the end — another distribution that stands apart from the rest. BackBox does not claim to be the best hacker multitool, but it is perfectly suitable for everyday use. The graphical shell here is Xfce, which minimizes the consumption of system resources. Two versions are available for download from the site — ISO and Torrent. There is no image for VMS.
BackBox is based on Ubuntu (more precisely, Xubuntu), which makes it convenient to use it as a home OS, and there is also a lot of documentation and forums available for Ubuntu with answers to common questions. There are no kernel tweaks, so no amount of fraud will spoil anything. Such features make this distr an excellent choice for a novice pentester.
Backbox Linux 7 Menu
There are not so many tools out of the box, only about 200 pieces, but it is quite enough for the first steps in information security. In the rest of the BackBox is just Xubuntu with all its bugs, features and function.
An important plus that I can't help but pay attention to is that all the tools are very conveniently grouped in the menu. Even if you don't know any tools, for example, for attacks on Wi-Fi, you can easily find them.
There's not much else to say, just use it for your health.
Pivot table
Conclusions
There was supposed to be a lecture that it is unacceptable to use most of these distributions as the main OS, but it will not be. Try different genres, choose the one that is closer to your heart, and we wish you good luck.
There are many distributions for pentest. Some are popular, others are not very popular, but they all aim to give the hacker a convenient and reliable tool for all occasions. The average hacker will never use most of the programs in such customized builds, but they are added to show off their status ("Look, you have 150 utilities, and I have 12,000!"). Today we will try to make an overview of most interesting distributions, both popular and undeservedly forgotten. If we missed something, don't hesitate to use comments. Let's go!
NST
- First release: 2003
- Based on: Fedora
- Platforms: x64
- Graphical shell: MATE
Let's start with a little-known, but therefore no less interesting distribution. NST (Network Security Toolkit) is based on Fedora and is designed for network attacks. The interface is based on MATE, which evokes the feeling of the beginning of zero. The kit includes several dozen of the most important tools, mainly network scanners, clients for various services, and various traffic interceptors. But there are not enough such utilities as, for example, masscan, and even banal aircrack, although airsnort is available.
The main part of the software is located in the Internet folder
Most of the Goodies can be found in the applications → Internet folder. Here we have Angry IP Scanner, written, by the way, in Java, and Ettercap, and even OWASP ZAP, which we already wrote about in Hacker. There is a good collection of modules for all kinds of spoofing and scanning in the netwag package. In fact, it proved to be quite good, but it is a pity that it is not very convenient and terribly outdated.
All the software I've tested works fine. In General, anyone who misses the ancient interface and familiar tools is recommended.
Kali
- First release: 2013
- Based on: Debian
- Platforms: x86, x64, ARM, VirtualBox
- Graphical shell: Xfce
As you probably know, Kali is one of the most widely distributed distributions for hackers, and it would be strange if we didn't write about it. Even schoolchildren know about it, and since relatively recently it has been available as an app directly from the Microsoft Store! Of course, accessibility is a definite plus, but the system is slightly overloaded with a set of tools (although not as much as BlackArch), and some of them work out of the box crookedly or do not work at all.
There is also no foolproof feature in Kali. As practice shows, not all users understand that you should not make this system the main one. From the core to the shell, it was created and optimized for performing combat tasks on the information security fronts and is poorly suited for quiet daily work. Many of the mechanisms needed in everyday life are simply missing there, and an attempt to install them is likely to cause failures in the normal operation of the OS, if it does not completely disable it.
In short, Kali is like matches-a powerful thing in skilled hands, it is easy to get, but it is better not to give it to children. It is not possible to cover all possible official and unofficial utilities at once (and there are more than 600 of them, for a moment) of this system, if only because new modules, frameworks, utilities and other gadgets are constantly appearing.
Kali is designed for a wide range of tasks, but the main one is attacks in the network environment, for example, finding vulnerabilities in web applications and gaining access to wireless networks. As the successor to BackTrack, Kali is generally well suited for working with wireless communication channels, especially Wi-Fi. Testing the strength of remote hosts is also possible using, for example, Metasploit (see our recent reviewfor more information), but the core and a significant part of the tools are focused on working with Wi-Fi.
Another of the advantages I note is the presence in the standard delivery of a large number of dictionaries for various attacks, not only on Wi-Fi, but also on Internet accounts and network services.
Kali works in WSL
For even greater usability, the official website offers a version of the distribution kit for virtual machines, because when hacking, it is much more reasonable to use the system without installing it — you never know who will then dig into your computer!
The verdict is: if you know how to use it, it's cool, but don't show it to your child. One of the authors saw what would happen if this instruction was violated.
DEFT
- First release: 2005
- Based on: Ubuntu
- Platforms: x86
- Graphical shell: LXDE
DEFT is home to Sunny Italy, and it's as generous as a cheese pizza, sprinkled with a variety of intelligence and hacking tools. At the same time, they are not tied to the distribution kit with blue electrical tape, but are quite harmoniously integrated into it. All together, it resembles an interesting and useful Swiss army knife.
Developed by DEFT on the Lubuntu platform and equipped with a user-friendly graphical interface. The product includes a set of specialized utilities, starting with antivirus programs, search engines for information in the browser cache, network scanners and other utilities, and ending with tools that are necessary when searching for hidden information on Yandex. disk.
Using this OS, you can easily access erased, encrypted, or corrupted data on various types of physical media.
The main Toolkit is hidden in the DEFT section, which, in turn, is located in some kind of"start" menu.
Initially, this distribution was designed for the needs of network police and information security incident response specialists, so another strength of DEFT is competitive intelligence, including analysis of relationships between social media accounts.
There is even an interesting utility for detecting the geolocation of a given LinkedIn or Twitter account. I haven't been able to check how effectively this works at the moment, but it does manage to determine whether an account belongs to a country or city.
Unlike Kali Linux or Tsurugi, deft has foolproof protection built in. Without proper training, almost no tool can simply be launched, and without a deep understanding of the work of protective mechanisms, there is nothing to do here at all.
Literally every application or option requires root access, so don't rush to launch everything at once or create an unprivileged user.
I also found a "gift": several repositories from which DEFT takes updates are closed with keys. I spent a couple of days searching the forums until I found where to request data from, and the keys themselves were also found.
As a result, this system is good for monitoring and investigating incidents, especially if there is physical access to information carriers — whether it is a disk, flash drive or smartphone (hacker, boss, employee, competitor, wife, mistress, her Bati — underline).
Tsurugi
- First release: 2018
- Based on: Ubuntu
- Platforms: x86 (partially), x64
- Graphical shell: MATE
This distribution is generally not very well known in the circles of information security specialists-perhaps because of its youth. However, Tsurugi is a brainchild born from the joint efforts of the creators of DEFT and Kali. What came of it? Let's take a look!
Tsurugi (this word means a two-handed Japanese sword) is based on Ubuntu, using MATE as the GUI. It is designed more for predictive Analytics or OSINT than for pentest, but its tools, as well as some features, allow it to be used in this direction as well. Initially, the system is delivered in live image mode, but if desired, you can perform a permanent installation.
Standard desktop
Once logged in, we see a simple GUI, thoughtfully hung on all sides with widgets for CPU usage indicators, hard drives, RAM, network speed, and more.
Yes, the hand of the creators of Kali is quite noticeable here. An abundance of pre-installed tools that are not always needed immediately catches your eye. At the same time, the system interface looks more than minimalistic and compact. But the logic of the security system, like working with the web or protecting against tracking, is based on the best practices of DEFT.
The entire main Arsenal is located in Applications → TSURUGI.
Tsurugi Menu
This includes working with images, malware analysis, data recovery, and, as mentioned, a set of utilities for OSINT.
It should be borne in mind that this OS, like Kali, does not have protection from crooked hands. It is suitable for those who have good Linux skills and act prudently and thoughtfully. Just like a sharp Japanese sword should be!
Extensive tools allow you to use the system as a multitool for a wide range of tasks. Tsurugi may look a bit like Kali, but there are still some serious differences. Despite the fact that some of the utilities, just like in Kali, do not work correctly or do not work at all, the percentage of problematic tools here is much less, and it is clear that someone cares about this.
If for some reason you do not want to use Kali, then Tsurugi will be a worthy tool in your kit. We won't give you five stars at least because one of the authors of this review put a brick away from the sound of a sword at the start of the OS... However, let's not talk about sad things.
Parrot
- First release: 2013
- Based on: Debian
- Platforms: x86, x64, ARM
- Graphical shell: MATE
This beautiful Linux distribution is based on Debian and was developed by the Frozenbox team specifically for testing the security of computer systems, searching for and evaluating a variety of vulnerabilities.
What's inside? The desktop environment here is still the same MATE. The user experience is (subjectively) pleasant.
At the top, in the Application section, you will find the anon Surf utility. One of the features of Parrot is that some anonymization tools are pre installed in it, and if you select Anonsurf Start, all system traffic will be redirected via Tor. In the same section, you can also use the opennic DNS project, which is a non-national alternative to top-level domain registries. Here, by selecting the Check IP option, you can check the current external IP.
The second section is Cryptography. Here you should pay attention to the GPA utility-a graphical interface of the GnuPG program designed for encrypting information and creating electronic digital signatures. This is essentially an alternative to PGP encryption. And if you need GPG, then the zulucrypt utility is at hand — an analog of VeraCrypt, which allows you to encrypt folders, partitions, flash drives, and so on.
The next (and most interesting) section is Parrot. It contains exactly those utilities for testing the security of computer systems, because of which this OS was included in our review. Many of the utilities presented are already known to us from Kali Linux, but there are also some unique ones.
I would like to focus on the "Internet" tab in more detail. Here we see the pre-installed Tor Browser and the Electrum bitcoin wallet, as well as the XSSer utility, a framework for detecting and exploiting XSS vulnerabilities in web applications. There is also an email client called Claws Mail, which is a full-fledged email client with gpg encryption support. The bonus is Ricochet IM-a decentralized anonymous messenger that works through the Tor network.
These are probably all the features of Parrot Security OS that I would like to tell you about. As you can see, Parrot OS is not only suitable for penetration testing, it can also serve as an OS for daily use by those who know why they need it.
Parrot seemed to us to be a high-quality and conveniently made OS. It's nice to work with a system where you don't need to fix your tools first.
BlackArch
- First release: unknown
- Based on: Arch
- Platforms: x64
- Graphical shell: missing, there are several desktop managers
BlackArch is the largest distribution package in terms of image size. The current version takes up more than 14 GB! By the way, you can download it via torrent if you want, and there are always a lot of seeds.
Appreciate the friendliness of the interface: if you managed to pump out this monster and launch it, you need to enter your username and password, which you should read about on the site in the installation instructions (this is root/blackarch, if anything). Apparently, they forgot about live users.
Next: after the login, you can't see any hints about the menu or anything like that. Before us is almost naked Fluxbox, so it is called by right-clicking anywhere on the desktop.
BlackArch app groups
All applications are conveniently categorized in the blackarch submenu of the main menu. There are 49 categories that have tools for every occasion. Navigate through menus with the mouse, as in Windows? Oh no, you can safely forget about the mouse in this distribution. Only the keyboard, only hardcore! On the other hand, once you've decided to get involved with *nix systems and hacking, it's silly to count on something else.
As for the tools themselves, here are all the popular and not so popular hacking tools, including, of course, such iconic ones as Metasploit and BeEF XSS. Reviewing all the tools in this truly huge Suite is even more hopeless than in the case of Kali and Parrot. So I'll go over the top of it, and if you're interested, you can go as far into the documentation as you want.
Wine attacks!
BlackArch isn't shy about using Wine to run some "non-native" apps. As an example - mft2csv (in the screenshot above), which parses the MFT of the NTFS file system for further analysis. Java is also available (OpenJDK 14.0.1).
MSF is also in place
The terminal, as well as the entire graphical shell of the system, looks dull, but the software versions are up-to-date. On the one hand, it seems that they wanted to make it like in a movie about hackers, on the other hand, the system is still quite usable, although it requires serious skills.
In General, if you are not ready to Wade through the minefield of configs, arguments when launching software, googling for every sneeze and other charms of this multitool-look in the direction of Kali and Parrot, there is at least something you can do without a desktop directory. Blackarch is more than unfriendly to newcomers. And, clear stump, do not think to put it as the main one.
BackBox
- First release: 2010
- Based on: Ubuntu
- Platforms: x64
- Graphical shell: Xfce
And in the end — another distribution that stands apart from the rest. BackBox does not claim to be the best hacker multitool, but it is perfectly suitable for everyday use. The graphical shell here is Xfce, which minimizes the consumption of system resources. Two versions are available for download from the site — ISO and Torrent. There is no image for VMS.
BackBox is based on Ubuntu (more precisely, Xubuntu), which makes it convenient to use it as a home OS, and there is also a lot of documentation and forums available for Ubuntu with answers to common questions. There are no kernel tweaks, so no amount of fraud will spoil anything. Such features make this distr an excellent choice for a novice pentester.
Backbox Linux 7 Menu
There are not so many tools out of the box, only about 200 pieces, but it is quite enough for the first steps in information security. In the rest of the BackBox is just Xubuntu with all its bugs, features and function.
An important plus that I can't help but pay attention to is that all the tools are very conveniently grouped in the menu. Even if you don't know any tools, for example, for attacks on Wi-Fi, you can easily find them.
There's not much else to say, just use it for your health.
Pivot table
Conclusions
There was supposed to be a lecture that it is unacceptable to use most of these distributions as the main OS, but it will not be. Try different genres, choose the one that is closer to your heart, and we wish you good luck.
