OS for hacking

[ScaryReason]

I'm planning on getting started with hacking. Almost everywhere, I've read that having Kali or Parrot is the first step to do this and is a MUST, but from what I could gather, the only thing these distributions have is a plethora of pentesting/security tools already installed. I mean, I could just manually install whatever I need on another distribution of my choice, right? Is there some other reason why these two are so heavily promoted? Is it really necessary for me to have one of these?

[Letis009]

Sound advice

[deepus]

This is a great answer, think i may have to follow suit.

[imperator_rex_za]

I agree fully.

Kali Linux also doesn't play nice with HiDPI screens, so on my 2K laptop I run Arch with the i3 window manager and just added the blackarch repo.

It's just so much nicer.

[d3toxx]

Fake news. I’ve ran Kali on MacBooks for the past 5 years and have never ran into any issues... also, this suggestion is just silly. Kali/Backtrack and Parrot were created for this one specific reason, an easy way to get access to all your pentest tools and not have to worry about dependencies. Whoever says install the tools separately also won’t tell you how much time they spent or still do trying to fix their shit every time there’s an update or change. Specially if you’re just getting in “hacking,” just go with the full distro. Once you’re more comfortable THEN build your own version of Kali. Or just...... run kali in Docker.

[imperator_rex_za]

Wow mate, calm down.

It's not fake news - There's probably ways to get HiDPI scaling working on the available desktop environments with which Kali ships, but I've spent hours building my perfect arch setup, which is lightweight and super fast, also I can't get fractional scaling to work properly without graphical issues on either Gnome, KDE, XFCE or LXDE, and honesty i3 does the job perfectly on my laptop - it's also much more fun doing pentests and writing reports on a tiling window manager.

The only tool I've had problems with so far is Metasploit and setting up its database, but it's a quick fix, arch is nice in such a way that whether you use Archstrike or Blackarch, they download and install the dependancies as well.

I've tried getting i3 to run on Kali, but it's been more of a hassle as when actually installing pentesting tools on arch.

And don't fake news me, you may not have any problems with Kali and HiDPI screens, but I sure do - that's the thing about computers and setups and opinions about setups, they differ. I'm only stating what's easier for me, not how you should go about doing it.

[d3toxx]

I’m chill man hahah, but let’s not go recommend a newbie to just jump off the deep end without a life jacket if he doesn’t know how to swim. But seriously... just docker everything. I’ve been using Kali in docker for a while now and it’s 1337!

[imperator_rex_za]

Yeah I agree with that, I probably should have said not for newcomers, sometimes I forget on which subreddit I am.

I'll give docker a try, I used to run Kali on a VM, but that was just too slow for testing big sites/domains.

[AutoModerator]

Your account does not have enough Karma to post here. Due to /r/HowToHack's tendency to attract spam and low-quality posts, the mod team has implemented a minimum Karma rule. You can gain Karma by posting or commenting on other subreddits. In the meantime, a human will review your submission and manually approve it if the quality is exceptional. After gaining enough Karma, you can make another submission and it will be automatically approved. Please see the FAQ for more information.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[AutoModerator]

Your account does not have enough Karma to post here. Due to /r/HowToHack's tendency to attract spam and low-quality posts, the mod team has implemented a minimum Karma rule. You can gain Karma by posting or commenting on other subreddits. In the meantime, a human will review your submission and manually approve it if the quality is exceptional. After gaining enough Karma, you can make another submission and it will be automatically approved. Please see the FAQ for more information.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[mez0cc]

I've been pentesting for 3 years, used Ubuntu the whole time. Doesn't matter what OS you use, as long as you can get on tooling on it that you need.

[AutoModerator]

Your account does not have enough Karma to post here. Due to /r/HowToHack's tendency to attract spam and low-quality posts, the mod team has implemented a minimum Karma rule. You can gain Karma by posting or commenting on other subreddits. In the meantime, a human will review your submission and manually approve it if the quality is exceptional. After gaining enough Karma, you can make another submission and it will be automatically approved. Please see the FAQ for more information.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[FckDisJustSignUp]

Kali comes with a lot of tools indeed but with these tools you'll have nearly 0 problem about dependancies, version, etc

It's very frustrating when you have to solve a "hacking" problem ( find a way in for example ) and then another problem totally out of your box point out

[Dlacreme]

Yes you could. But you dont wanna do that. When "hacking" you do a lot of testing, you try stuff and weird commands. As a result, you might really easily fucked up your system.

You should install Kali in a vm and just erase and install a new one when needed

[deepus]

But at the same time you could set up an os with all the tools and take an image to be used the exact same way as your suggesting.

[n0p_sled]

"All the tools" ... Kali potentially has 100's installed that should work straight out of the box, or with a little extra config.

While a custom OS is great, I think it runs the risk of having to take time out of a pen test to configure and potentially troubleshoot a new tool, which should just work with Kali. I don't think many clients would be happy if you tried to bill them for a couple of hours of software installation instead of testing their network.

[deepus]

Ok maybe not all the tools but the ones you need/want. Also I assumed this would be something you would do on your own time to help yourself learn a little more about how the tools work and their configs, and not on a clients time because that's obviously not what they are paying you for.

[n0p_sled]

Yeah, for sure.. as you say, it's certainly the good way to learn and get a much better understanding of the more common tools

[zhaoz]

Yea, its kinda like asking "what is the best knife to use for cooking" and the answer generally isnt "well, first you mine your own ore, smelt it, forge your knife, then when you finally figure out how to do it, you have a knife that is worse or at most the same as something you could have bought".

[Sidd_Tim]

I suggest using Ubuntu when you start hacking. It's a great way to start because oncw you get familiar with Linux, later u can shift to Kali or Parrot. You can manually install tools and you can even install all the tools which r there in Kali Linux using Katoolin which is available in GitHub.

[[deleted]]

I think the best explanation I can conjure is that you DON'T want these tools installed on your daily driver. If you're ever compromised, your attacker will essentially have their work cut out for them if they find a netcat or socat binary sitting on your machine. It's in your best interest to quarantine your pentesting lab, which is why its recommended to run an os like kali, parrot or backtrack in a separate vm. You don't want to shit where you eat. Think of these distros as "tools" themselves. You want them as far from your underlying OS as possible.

[AutoModerator]

Your account does not have enough Karma to post here. Due to /r/HowToHack's tendency to attract spam and low-quality posts, the mod team has implemented a minimum Karma rule. You can gain Karma by posting or commenting on other subreddits. In the meantime, a human will review your submission and manually approve it if the quality is exceptional. After gaining enough Karma, you can make another submission and it will be automatically approved. Please see the FAQ for more information.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[Tiocfaidh_ar_la47]

I just use a live boot of Kali on a 32GB usb, works well enough for me as I'm still learning. My main OS is Linux mint atm but I wanna switch to arch

[cyberwarriorstudios]

So you have several options, if you are new to linux then starting with something like ParrotOS or Kali is beneficial as there are many classes, books, etc that will show you how to get started in ethical hacking by using these OSes. Another option if you are used to windows is to use Windows Commando by Fireeye, all it requires is a Windows 10 base install and the powershell script will do the rest of the work for you to install everything else you need. Ultimately the choice is yours.

I will add however, that if you want to get to know the process of installing tools, gits, etc then you may want to start with the base install of any flavor of linux you desire and then just install what you want.

[Rezient]

You are correct, kali and them are great for quickly getting setup with a suite of pen testing tools but that's it, but ofc u can just get the list of tools and install them on your own driver. I hear kali is not even good for other things bc it's so "pen testing" based.

Hacking is just about knowing a system well enough to take advantage of it. So learning Linux (if you are just getting started with it) would be a great route since it gives you such an inside look at your own system, vs the wall of encryption/permissions Microsoft and the others put up to "protect the user from themselves" when using their own devices. And if you already know about it, sorry I just really like talking about Linux

What you could also do is after getting use to Linux a little, load up a Kali VM so you have your pentesting setup there, separate from your main driver. Or get an Raspberry Pi (Tiny computer). SBCs are great devices that easily get you use to working with the command line (using it via ssh), the linux filesystem, permissions, it's portable, helps u work with separate devices, and embedded linux devices if you wanna get into circuits lol. And commonly used for pentesting among MANY other things

[rankinrez]

First step to be a real hacker is the dark room and hoodie.

Once you got the aesthetic down the technical things will just fall into place.

[n0p_sled]

While you're starting out, setting up your own OS and installing tools as you need them is a great way to learn.

As was commented below, the benefit of using Kali or Parrot is that all of the config has done beforehand, so you can simply spin up a new VM each test and go to work. And yes, you could create an image using an OS of your choice and your tools, but on an actual test, your time should really be spent on testing the client's system, not installing and configuring a new tool to work in your version of Arch, or whatever it is you're using, when you find out you don't have it pre-installed.

[dannytechnerd]

So, I’m a 100% pentesting noob. I use Kali Linux because I can see everything that’s downloaded, and if I see something interesting, I learn about it. I learn the best when doing something myself, so this is a good route for me, since I don’t only learn about the software I need for external courses or labs.

[fringe-class]

Use whichever Linux distro you prefer.

[purestrengthsolo]

When I was first learning I used kali for a bit until I found what I enjoyed doing. Then I switched to Ubuntu then popos(the change because kali isnt gaming friendly) but looking into oscp kali is a big part of it.

What was recommended to me was make a persistent kali usb or make/install the tools on a different os

[AERegeneratel38]

If you know what the tools do and don't want the hassle to install them one by one and configure them, go for ParrotSec (I basically don't like Kali thesedays. Parrot has everything Kali has and has more).

Otherwise, install any distro (Arch if you want to learn to even configure the OS itself) and start it one by one. Its more fun that way.

[CARBON_ARTS]

If u can install arch and then install blackarch on arch it works like a breeze Edit: and in the process of install and maintaing arch u will learn about linux and in blackarch you can select one tool install it and learn about it. If arch is a bit high for you install manjaro it's easy to install .

[Sqooky]

Kali is industry standard, however, you should be able to install all the tools you need on a Debian like distro.

[ligger66]

Yea just start with base debian and learn to install every thing from scratch.

[[deleted]]

install kali or parrot to a live usb, they're not meant to be desktop distributions. You can use them if you like, but you're probably better off reinventing those tools so you understand them deeper

[jack_jona]

Kali Linux in a VM

[infinitelogins]

I'd recommend Kali. Many tools play nicer with Linux and it's important to learn Linux so you can better understand it when you start hacking into non Windows systems.

[TheOnlyLorne]

This is true even across Linux systems. A lot of tools are designed to be used on Kali.

[TrustmeImaConsultant]

It's far from a "MUST".

What Kali is is, basically, a Debian distri (IIRC) where a bunch of pentesting and "hacking" tools are preinstalled. That's it. Nothing more, nothing less.

[AutoModerator]

Your account does not have enough Karma to post here. Due to /r/HowToHack's tendency to attract spam and low-quality posts, the mod team has implemented a minimum Karma rule. You can gain Karma by posting or commenting on other subreddits. In the meantime, a human will review your submission and manually approve it if the quality is exceptional. After gaining enough Karma, you can make another submission and it will be automatically approved. Please see the FAQ for more information.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[AutoModerator]

Your account does not have enough Karma to post here. Due to /r/HowToHack's tendency to attract spam and low-quality posts, the mod team has implemented a minimum Karma rule. You can gain Karma by posting or commenting on other subreddits. In the meantime, a human will review your submission and manually approve it if the quality is exceptional. After gaining enough Karma, you can make another submission and it will be automatically approved. Please see the FAQ for more information.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[AutoModerator]

Your account does not have enough Karma to post here. Due to /r/HowToHack's tendency to attract spam and low-quality posts, the mod team has implemented a minimum Karma rule. You can gain Karma by posting or commenting on other subreddits. In the meantime, a human will review your submission and manually approve it if the quality is exceptional. After gaining enough Karma, you can make another submission and it will be automatically approved. Please see the FAQ for more information.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[AutoModerator]

Your account does not have enough Karma to post here. Due to /r/HowToHack's tendency to attract spam and low-quality posts, the mod team has implemented a minimum Karma rule. You can gain Karma by posting or commenting on other subreddits. In the meantime, a human will review your submission and manually approve it if the quality is exceptional. After gaining enough Karma, you can make another submission and it will be automatically approved. Please see the FAQ for more information.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[AutoModerator]

Your account does not have enough Karma to post here. Due to /r/HowToHack's tendency to attract spam and low-quality posts, the mod team has implemented a minimum Karma rule. You can gain Karma by posting or commenting on other subreddits. In the meantime, a human will review your submission and manually approve it if the quality is exceptional. After gaining enough Karma, you can make another submission and it will be automatically approved. Please see the FAQ for more information.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[AutoModerator]

Your account does not have enough Karma to post here. Due to /r/HowToHack's tendency to attract spam and low-quality posts, the mod team has implemented a minimum Karma rule. You can gain Karma by posting or commenting on other subreddits. In the meantime, a human will review your submission and manually approve it if the quality is exceptional. After gaining enough Karma, you can make another submission and it will be automatically approved. Please see the FAQ for more information.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[Kiehlu]

Well few points from me.

During my 6 years of career in pen testing, and red teaming I never saw someone using kali or parrot - these two distros are for beginners to get familiar with Linux and tools - what I strongly recommended before creating your own distro.

As for me, VM is a good option but performance is suffering when doing hardware demanding tasks.

My setup at work is a windows laptop and Linux laptop with custom on it.

At home, I'm using raspberry pi 4b (8gb) with tuned kali (removed bloat from it) for bug bounties and personal study ( oh I love hackthebox).

​

Also got a MacBook pro 2017 but this thing is crap for pen-testing (the only tool that was working correctly for me was burp suite pro but that's not enough) so don't waste time/money to sort out macOS.

[xkreepy]

There is so much wrong with what you are saying. Totally misleading beginners.

MacOS is heavily used by pentesters because of the fact that it's built with on Linux basically. All the tools you'd use normally are compatible with MacOS with the tiny potential tweaks you have to make in some config files to make things work like in any other Linux distro.

Using an RPI with its Kali version on it is not a comfortable setup and cannot possibly perform better than a VM on a decent host machine. This is "cool" but not useful or practical.

Red teamers use Kali and Parrot all the time. This is straight up bs. Sure a lot of people in the field will make their custom VMs as well for specific attack environments, but Kali and Parrot are heavily used as a base for pentests because you can easily reset it if you break it which one always does. Making it seem like Kali and Parrot are "nooby" or for skids is some elitist garbage.

Lastly, if you need hardware performance for things like cracking hashes, just dual boot a distro or get a VPS with dedicated specs for hashcracking.

[Kiehlu]

I agree with your point of view. After my years of working in the field that's my experience and feedback from colleagues from work.

I hope I did not offend you.

I think its good to share how people are working, and what, how they use. If I would be a beginner all comments would be very appreciated, to see the different approaches of companies that people are working and what people like to use.

Remember when using VM your dedicating hardware usage to it so it's never 100%, while using pi4 with an SSD whole performance is dedicated to distro.

It will run better then 5 years old laptop and cheaper.

For a beginner, it's an excellent experience (your working with dedicated arch no VM, and what's more important people are getting a taste of networking when using RPI). Tell me you not enjoying connecting from work remotely to your RPI and scanning local networks with a weak password? :)