3 ms·

>can I say which applications have access to my photos, email, location, microphone Kali distros are not meant to be run bare metal as your daily driver, but a

>can I say which applications have access to my photos, email, location, microphone Kali distros are not meant to be run bare metal as your daily driver, but as VMs. They usually have very lax security setting as to not interfere with all the networking and security related apps provided. This makes them quite insecure by design versus mainstream distro like Ubuntu/Fedora. So don't put any personal data on them. We always spin them up as disposable VMs in their own VLAN, and nuke them after every encounter is over.

wkat4242 4y ago
I don't but when it comes to pentests we only do them internally and not very often either. I like keeping custom scripts and installed apps/python scripts because we'll usually need them again next time. Of course if you do constant engagements to external clients cross contamination is a big risk but we don't have this concern.
- ChuckNorris89 4y ago
  >I like keeping custom scripts and installed apps/python scripts because we'll usually need them again next time. You can make custom Kali images with your own tools. Or you can just put those tools on git and pull them every time.
  - wkat4242 4y ago
    I know and if you're a full time red team pentester that would make total sense :) Our team is a little bit of everything which makes it harder to justify that overhead.
criddell 4y ago
Thanks for explaining. I misunderstood what Kali was for.
hitpointdrew 4y ago
If you are looking for a "pen testing distro" to use a daily driver check out Parrot Linux. https://parrotlinux.org/ https://parrotlinux.org/
- lucideer 4y ago
  Probably of less broad appeal but another option to add to the mix for anyone who happens to be running Gentoo is the Pentoo overlay https://github.com/pentoo/pentoo-overlay https://github.com/pentoo/pentoo-overlay The Github repo is also a nice browseable categorised directory tree of security tooling, including nice readable plaintext ebuild files listing the src urls for building each.
0x1f606 4y ago
> but as VMs Agreed on all points but this one; Occasionally I'll run it bare-metal on an SBC like a Raspberry Pi as a dropbox or similar, though the SD-Card gets nuked shortly afterwards so I guess it's treated in a very similar "disposable" way as VMs are. I know that's being pedantic about your wording, but I thought it worthwhile mentioning that there are use-cases for it running outside of a VM.
stirfish 4y ago
>Kali distros are not meant to be run bare metal as your daily driver, Oh. I was looking for something that had some radio stuff preconfigured, saw Kali was basically a xfce debian, and have been using it as a daily driver for years. Should I not do that?
- neodymiumphish 4y ago
  Kali devs know that people do this, so they've modified their processes to address it. If you know what you're doing with Linux, you're likely fine.

wkat4242 4y ago

I don't but when it comes to pentests we only do them internally and not very often either. I like keeping custom scripts and installed apps/python scripts because we'll usually need them again next time. Of course if you do constant engagements to external clients cross contamination is a big risk but we don't have this concern.

ChuckNorris89 4y ago
>I like keeping custom scripts and installed apps/python scripts because we'll usually need them again next time. You can make custom Kali images with your own tools. Or you can just put those tools on git and pull them every time.
- wkat4242 4y ago
  I know and if you're a full time red team pentester that would make total sense :) Our team is a little bit of everything which makes it harder to justify that overhead.

criddell 4y ago

Thanks for explaining. I misunderstood what Kali was for.

hitpointdrew 4y ago

If you are looking for a "pen testing distro" to use a daily driver check out Parrot Linux. https://parrotlinux.org/ https://parrotlinux.org/

lucideer 4y ago
Probably of less broad appeal but another option to add to the mix for anyone who happens to be running Gentoo is the Pentoo overlay https://github.com/pentoo/pentoo-overlay https://github.com/pentoo/pentoo-overlay The Github repo is also a nice browseable categorised directory tree of security tooling, including nice readable plaintext ebuild files listing the src urls for building each.

0x1f606 4y ago

> but as VMs Agreed on all points but this one; Occasionally I'll run it bare-metal on an SBC like a Raspberry Pi as a dropbox or similar, though the SD-Card gets nuked shortly afterwards so I guess it's treated in a very similar "disposable" way as VMs are. I know that's being pedantic about your wording, but I thought it worthwhile mentioning that there are use-cases for it running outside of a VM.

stirfish 4y ago

>Kali distros are not meant to be run bare metal as your daily driver, Oh. I was looking for something that had some radio stuff preconfigured, saw Kali was basically a xfce debian, and have been using it as a daily driver for years. Should I not do that?

neodymiumphish 4y ago
Kali devs know that people do this, so they've modified their processes to address it. If you know what you're doing with Linux, you're likely fine.