7 Linux Distros for Security Testing
Linux is often talked about when it comes to security. With this OS, you can choose from a multitude of distributions (distros) to lock down your computer or device, but that’s just for starters. Many Linux distros come with tools to help you perform penetration tests and security audits.
The following article lists just a few Linux distros for security testing. Many are based on Debian or Ubuntu with some added built-in custom tools.
Just a short disclaimer:
This article is in no way the be-all, end-all list of Linux security testing distros. It simply aims to point you in the right direction.
Backbox
Backbox is an Ubuntu-based OS. It comes with a variety of pentesting and security assessment tools for network and systems analysis. These tools can perform such tasks as web application or network analysis, stress tests, sniffing, vulnerability assessment, computer forensic analysis or exploitation.
Backbox comes with an appropriately configured XFCE desktop manager and its main menu grants easy access to your tools. You can also create your own Launchpad PPA, send your package to the dev team and contribute to its evolution.
This distro is quick and highly customizable. It’s also compatible with old hardware and has a regularly updated software repository. It also enjoys support from a large community.
BlackArch
BlackArch is an Arch Linux-based OS for penetration testers and security researchers. It has a tool repository of more than 2,000 tools for security testing and ethical hacking. It’s also compatible with existing Arch installs.
You can customize this distro by installing BlackArch components individually or in groups (by category) directly on top of it. It’s being updated constantly and offers the latest packages on GitHub. The team releases a new ISO four times a year (quarterly).
BlackArch is, however, useful only if you’re already familiar with Arch Linux or Linux in general. The team even suggests avoiding this distro if you’re a new user because of its learning curve.
DEFT
DEFT (Digital Evidence and Forensic Toolkit) is an Ubuntu-based distribution. It’s made up of GNU/Linux and DART (Digital Advanced Response Toolkit). It focuses on forensics as its name suggests.
This distro comes with two different modes: text mode and GUI mode. Depending on your choice, it uses either a command line or an LXDE desktop environment
The DART suite contains Windows applications (open and closed-source). It organizes, collects and runs software in safe mode for live forensic analysis and incident response, and launches integrity checks each time programs are run in safe mode.
DEFT also has tools for mobile device analysis.
Kali Linux
Kali Linux is a Debian-based distribution that focuses on advanced penetration testing and security audits. It contains more than 600 information security tools for pentesting, security research, computer forensics and reverse-engineering. It was released March 13, 2013, to overhaul BackTrack Linux to adhere to Debian development standards.
This distro is completely free of charge and is committed to the open source development model.
It can run either as a virtual machine or as a live boot and is fully customizable (even down to the kernel). It also has ARMEL and ARMHF support, making it compatible with a wide range of ARM devices.
Parrot Security
Parrot Security is a GNU/Linux Debian-based distribution that uses Kali repositories for tool updates. It’s primarily designed for cryptography, penetration and vulnerability testing, as well as digital forensics. Parrot is lightweight, cloud-friendly, effective and highly customizable and enjoys reliable community support.
This distro comes pre-installed with the MATE desktop environment and enough options to suit your needs. Parrot is free and open source and is useful whether you’re a novice or a pro in security testing.
Pentoo Linux
Pentoo is a security-focused live CD based on Gentoo. If you’re familiar with the latter, Pentoo is Gentoo with the Pentoo overlay. They’re basically identical save for Pentoo’s customized tools, kernels and more.
This distro comes with several security testing tools that, among others, can be used for scanning, web application testing, analyzing or exploitation. It’s also based on XFCE and includes lots of kernel features that are constantly updated by several developers.
Pentoo also includes features such as available binary packages, module loading support, changes saving on USB stick, OPENCL cracking support and a custom-written “Pentoo Updater” tool.
Samurai Web Testing Framework
Samurai Web Testing Framework is an Ubuntu-based framework built specifically with pen testing in mind. It can be used either as a pre-configured live Linux environment or a virtual machine supported by VirtualBox and VMWare.
The CD comes with free and open source pentesting tools including the Fierce domain scanner, Maltego, WebScarab, ratproxy, w3af, Burp, BeEF and AJAXShell. It also comes with a pre-configured wiki that acts as the main source of information while pentesting.
