Re: Security Toolkit?
BT4 is very nice to work with, like Thorn said, the De-ICE stuff is amazing. I'm going through the first disc right now.
I'll add Foundstone into the mix as well: http://www.foundstone.com/us/resources-free-tools.asp They have a bunch of nice objectives to hack (Hackme Travel, Books, etc)
-
Re: Security Toolkit?
As far as using BTx for pentesting, I truly could not agree more. That being said, it often does take some modification, be it to the live cd, or to your hardware to get it as close to perfect for an individual's needs. It is the broadsword of utility collections. On that same note, no one has brought up the issue of hardware. Sure these days with drivers, a laptop is a laptop and a netbook is a netbook, but depending on the setting in which you plan to explore your horizons, the gear can make a huge difference. A stock wifi card in your Macbook vs an amplified USB card with a nearly unlimited combination of N-type or RP-SMA antennae, or a router targeted towards home use vs what you would find in a corporate environment just as a couple of examples.
Sir, I must protest. For my distro surely must be the superior of those in question.Leave a comment:
-
Re: Security Toolkit?
For penetration testing Back Track is the Linux distro of choice. That said, the best stance you can take when it come to OSS, is to be above the politics; because there is quite a lot. OSS is a lot like the Democratic Party, yes they are all democrats, but there is a lot of disagreement about the issues.
An OS is a tool, nothing more. Linux is free, but try playing a blueray movie with it. Opensuse plays well with Windows, and apparently that is a fault. If you are in Europe Opensuse is cool, in American Ubuntu is cool; go figure.
Some people are just so zealous about OSS, it is like another poster mentioned, almost religious. It's best to stay objective, and use the right tool for the job. Whatever that tool might be.
xor
Ps My distro is better than yours
Leave a comment:
-
Re: Security Toolkit?
I think the distribution choice depends on why you are making the move to Linux. Everyone has their favorite distro (and to some it's like a religion). It's hard to say what is the "best" distro. The best distro is the one that meets your needs. I will suggest a few, but there are plenty of really great Linux distros.
If it is a second machine and you really want to learn the ins-and-outs of a Linux operating system I would suggest Gentoo. Gentoo is difficult, and even the well versed Linux users can pull their hair out trying to get it to work. However, when you are done you can truly say you understand the software.
If you want an operating system that just works out of the box, I really think Mandriva is a great distribution for Linux newbies and old-timers alike. There is a little blasphemy in Mandriva One to the free software "elite", but they'll still respect you more than if you were using Ubuntu.
Mandriva One has proprietary drivers and windows drivers that work on installation. With Mac hardware, there may be no open source alternative. It has an option to partition the hard drive and install Grub on its own if you prefer to dual boot with two operating systems.
It just works out of the box. There is something to be said for that.
It is based off of the old Mandrake software (that was based off of Red Hat), so you have the rpm package manager. There are better out there (Gentoo's Portage is my favorite), but the Mandriva package manager just works out of the box too. You can go in the settings and open up more repositories (which I suggest), and there is a bunch of software to choose from. (FYI, the Tor onion router is a wise choice)
The firewall catches things like possible click-jacking and port scanning. You can set it to automatically blacklist anyone that scans your ports. (If you renumber away from standard ports first, it helps with security). It isn't on the radar too heavily, being a French owned
operating system, and you will be less likely to be exploited than a more common OS like Ubuntu.
So to sum up, my suggestion would be:
Gentoo - If you dedicate a system to it and want to play around.
Mandriva - If you want it to be your main computer.Leave a comment:
-
Re: Security Toolkit?
Thanks guys, awesome info so far! I definitely did not know about the De-ICE stuff, and although I'd heard of BackTrack I had totally forgotten about it. I think someone in my class had mentioned Nessus. I will have to check all of this stuff out!Leave a comment:
-
Re: Security Toolkit?
Get BackTrack 4 like streaker suggested.Like I mentioned before, I am still learning about computer security and therefore do not claim to know a lot. So please don't think I'm a moron when I ask for guidance... In my Risk Management class, we are reading Hacking Exposed and learning about the tools available for security toolkits. I was wondering what you guys recommend as far as open source tools and other free tools that can be used on Linux and/or ported to OS X. I know about the obvious built-in stuff like ping, traceroute, netstat, whois, finger, etc. and about the Network Utility in OS X. Some of the other tools I have used or want to use are hping2, Wireshark, Snort, Nmap, Netcat or Ncat, John the Ripper, Metasploit, Kismet or KisMac, TiNGLE, VMware (once I get a faster machine), Ettercap, Aircrack, MacPork, Ike-scan, Rootkit Hunter, TOR, SATAN or SARA, Radmind or Tripwire, BurpSuite, OpenSSH, and Cyberduck. If anyone recommends these, hates these, or has other suggestions, please add to the discussion. I know there are some Kismet experts around here and I'm sure some of you are experts on things that I am yet unaware of.
I was also wondering what version of Linux you guys would recommend for someone new to Linux. I plan to install it on a MacBook as a secondary OS rather than virtualizing.
Discussion of security tools and their various advantages and disadvantages is fine. The "teach me to hack" posts that we specifically exclude are the skriddie posts of "Teach me to hax0r the local bank!"
One thing you might want to consider doing is setting up an isolated test LAN, and using the De-ICE sets. The De-ICE sets are designed to be broken into, using BackTrack.
http://heorot.net/livecds/
http://forums.heorot.net/Leave a comment:
-
-
-
-
-
-
Re: Security Toolkit?
Did you download BackTrack4 yet? I believe it contains most of the stuff you've mentioned. May also want to get the Helix Live disk too.
Nessus is a good one to have as well, you can get a home license for free, otherwise it costs $1200/year.Leave a comment:
-
-
Leave a comment:
-
Security Toolkit?
Like I mentioned before, I am still learning about computer security and therefore do not claim to know a lot. So please don't think I'm a moron when I ask for guidance... In my Risk Management class, we are reading Hacking Exposed and learning about the tools available for security toolkits. I was wondering what you guys recommend as far as open source tools and other free tools that can be used on Linux and/or ported to OS X. I know about the obvious built-in stuff like ping, traceroute, netstat, whois, finger, etc. and about the Network Utility in OS X. Some of the other tools I have used or want to use are hping2, Wireshark, Snort, Nmap, Netcat or Ncat, John the Ripper, Metasploit, Kismet or KisMac, TiNGLE, VMware (once I get a faster machine), Ettercap, Aircrack, MacPork, Ike-scan, Rootkit Hunter, TOR, SATAN or SARA, Radmind or Tripwire, BurpSuite, OpenSSH, and Cyberduck. If anyone recommends these, hates these, or has other suggestions, please add to the discussion. I know there are some Kismet experts around here and I'm sure some of you are experts on things that I am yet unaware of.
I was also wondering what version of Linux you guys would recommend for someone new to Linux. I plan to install it on a MacBook as a secondary OS rather than virtualizing.
I hope nobody takes this as a "how to hack?" post because that is not what is intended. I know sometimes there is a fine line, but I honestly want to learn how to use these tools for security purposes. Since I go to an online school, I do not have access to a computer security lab to practice some of the exercises in our text book, so I was going to start messing with stuff on my own home network for practice.
Leave a comment: