Welcome hi! I'm writing today about the question which OS to take for penetration testing as well as hacking stuff.
The question is really justified, because there are many distributions. I have broken down the agony of choice to a total of 3 Linux distributions.
- Kali Linux
- Parrot Security OS
- Blackarch
Why exactly these 3?
Kali Linux formerly BackTrack is pretty much the number 1 when it comes to penetration testing and hacking stuff. You have a lot of tools like Metasploit. This OS is also OSCP-ready and is used for OSCP exams. What sets Kali Linux apart from the others is that this system has many services already installed where you can e.g. make remote access via SSH to work with the system. The tools and the packages are very well coordinated, which means that nothing breaks when updating.
Parrot Security OS is similar to Kali Linux, only here you have features like Firejail and sandboxing which restricts permissions and everything else, which is interesting if the case could arise that a program is running shabernak. Parrot also has more tools in some areas that Kali does not. Ok, here you have to say sometimes here is a bit of superfluous stuff included as this system tries to be an all-rounder in the field of penetration testing.
Blackarch is also quite a nice OS, it is the number 1 Arch based Linux system for penetration testing and hacking. Blackarch has a wide range of tools in various areas. It is kept simple as Fluxbox is at work here. This makes it a bit trickier to use if you are used to Gnome, KDE or Mate, but after a short while it becomes relatively easy to use.
Ok after I have presented the three so roughly, I'll go into more detail.
Kali Linux
Download: https://kali.org
| Pros | Cons |
|---|---|
| Widely used and established | Root login |
| User friendly | Some tools are no longer available |
| Many frequently used tools | Not suitable as a daily driver |
| Icognito mode (Windows style) | Sometimes old packages than others |
| Stably built | |
| Good documentation | |
| Large package repository | |
| Many things can be installed later | |
| Many customization options | |
| Suitable for forensics |
So in the pros & cons you can see what the strengths and weaknesses are. The system is quite widespread and has become the de facto standard in penetration testing. There are many tutorials and workshops to learn Kali Linux and to get along with its toolset. The disadvantage is that it is not a daily driver. That means, only run it in a VM or on a notebook which is not intended for other purposes. A great strength of the system is e.g. the customizability. Because here you have the possibility, even if some tools are not included, to install them via "apt install". The disadvantage here is sometimes that you get outdated packages installed and you have to reload the tools via Git and Co and build them yourself. A further disadvantage has the system nevertheless, because Kali Linux is delivered per default with the Root account, which is to be changed however in the 2020.3 or higher. The disadvantage is that the root account is not meant for small things and even offers a big security hole if someone gets access. But you can avoid this in advance if you simply create a new user. With Kali you have many areas in IT security covered e.g. wifi attacks, exploitation of systems and software, enumerations, forensics, networks and even cryptography.
Parrot Security OS
Download: https://parrotlinux.org/
| Pros | Cons |
|---|---|
| Beginner-friendly | Sandboxing sometimes makes things more complicated |
| Daily-Driver ready(Office & co. installed) | Outdated tools included so update manually |
| Sandbox environments with each program | Not as established as Kali Linux |
| Good documentations & tutorials | |
| Much more tools | |
| Stably built | |
| Suitable for forensics | |
| Fast and lightweight desktop | |
| Anonymization tools are pre-installed and straight forward |
With Parrot Security OS, you can see that a large toolset is also included here. The advantage here is that the developers of the distribution also value anonymization, since tools and programs like Tor and Anonsurf are included. The whole thing is also quite simple, so you can surf anonymously with a few clicks. Also interesting is the fact that Parrot Security also provides sandbox environments, which are activated by default. This has the advantage that, for example, the system is additionally protected during reverse engineering and malware forensics. This is not a guarantee but still a nice feature. Also this distribution is quite well spread, not like Kali but it is so seen the number 2. So also here you have a lot of documentation and also many tutorials and workshops on Youtube. Because it is Debian based and also compatible with Debian packages, it is easy to install programs and packages for everyday use. But this is again a small weakness of the distribution, because here you have unfortunately also outdated software & and packages with. Here it is said that mances should be updated manually. The sandboxing itself, as mentioned, is a really good feature, but even here there are a few downsides, because the sandboxing can also ensure that workflows can become more complex.
Blackarch
Download: https://blackarch.org/index.html
| Pros | Cons |
|---|---|
| Large repository | Few documentation |
| Huge amount of tools | Not beginner friendly |
| Covers more than Kali Linux or Parrot Security OS | Much has to be configured and requires advanced Linux knowledge |
| Designed for professionals | |
| Very minimalist design. |
Blackarch is a system based on Archlinux. The whole thing is built very performant and also very lightweight, which makes it usable even on older devices. The system comes with tons of tools, which cover even more areas of use than Kali or Parrot. You can tell by the very well structured menus that it is meant for professionals who want to do more than what Kali Linux or Parrot Security OS offer. The whole appearance of the interface is very minimalistic and also very clean. This all sounds quite good, but the system is not suitable for beginners, it is as said for Pofessionals, which you will notice when you want to do something. This starts with the fact that many things have to be configured manually, e.g. user, network and so on. Some configurations also require advanced knowledge of Linux, which can complicate the use.
And which OS should you use now? I would make it dependent on the situation, because Kali Linux or Parrot Security OS is usually sufficient. I would recommend these two to anyone who deals with IT security or CTFs.
I hope I could help someone a little further and see you 😄