Penetration Testing Linux distros are a group of special purpose Linux distros used for analyzing and evaluating security measures of a target. These kinds of distributions are usually live-cd or USB drive-based, but the newer ones have the ability to be installed as a standalone Linux distribution on your computer. The main users of pen-test distribution are network and computer security enthusiasts, security students, and audit firms who do security audits with the customer’s permission on their network.
Pen-testing distros have come a long way since I first used them about 10 years ago. They used to be unstable and almost always live-cd only. It wasn’t easy to have the packages updated with the latest binaries. We don’t have those problems anymore as nowadays it’s much easier to create a custom distro with custom repositories. Let’s look at some of the more widely used pen-test distros out there:
1. BackTrack:
Probably the most widely known pen-test distro out there and one of the oldest distro still being actively developed. There are thumb-drive and Live DVD version, plus the ability to do a full install in your hard-drive. The distribution is based on Ubuntu with custom packages that get updated on a regular basis.
2. Knoppix-STD:
Another old-timer live distro based on knoppix. STD stands for Security Tools Distro, to avoid any confusion. Contains 1000s of security tools but not advised to be installed as a stand-alone OS.
3. Backbox Linux:
Another Ubuntu based distro but uses XFCE as its window manager and relies on its own repo to constantly keep its tools updated.
4. Blackbuntu:
Built on Ubuntu 10.10 and Gnome, this distro was specifically designed to train students and researchers of information security
5. Samurai Web Testing Framework:
Based on Ubuntu and gnome based live CD. Designed specifically for information gathering and pen-testing web apps.
6. NodeZero Linux:
Yet another Ubuntu LTS based distro but the emphasis is on native install not a live distro. Currently work is being node to get its own package repository for regular updates.
7. WEAKERTH4N:
Based on Debian Squeeze and Fluxbox, its possible to have native HDD install. There is an emphasis on supporting more radios and Wireless pen-test tools out of the box.
8. CAINE :
Based on Ubuntu and MATE Desktop Environment, this is a highly customized pen-test distro that sets it apart from other distro with a useful forensic report generation tool.
9. Pentoo:
A livecd based on Gentoo and XFCE. Also available as an overlay for existing Gentoo installations. Has the ability to crack passwords using GPGPU out of the box.
10. Bugtraq:
Not to be confused with Bugtraq security mailing list. The current version Bugtraq 2 Black Widow available with XFCE, Gnome and KDE based on Ubuntu, Debian and OpenSuse. Unique scripts for SVN updates tools, delete tracks, backdoors, Spyder-sql.
11. Matriux :
“With Matriux, you can turn any system into a powerful penetration testing toolkit, without having to install any software into your harddisk. Matriux is designed to run from a Live environment like a CD / DVD or USB stick or it can easily be installed to your hard disk in a few steps. Matriux also includes a set of computer forensics and data recovery tools that can be used for forensic analysis and investigations and data retrieval.”
12. Matriux :
“DEFT 7 is based on the new Kernel 3 (Linux side) and the DART (Digital Advanced Response Toolkit) with the best freeware Windows Computer Forensic tools. It’s a new concept of Computer Forensic system that uses LXDE as desktop environment and WINE for execute Windows tools under Linux and mount manager as tool for device management.”
If there is any interesting pentest distro I might have missed, feel free to share in the comments.