here are some screenshots, looks and acts pretty much the same. I like their graphics, graphic guy needs a Xmas bonus.
that being said, with the release of any new version of "hacking distro" comes the "how do I get metasploit autopwn to work" garbage from the person that didn't read the man page, didn't read the blog post(s) on autopwn, didnt search the list archives for how autopwn works, and now we get to field questions on why fasttrack.py doesn't work right, did you read (any of) the code? no... sigh. did you go thru dependency hell getting all those badass tools working so maybe you know a couple of things? no...double sigh. did you watch the hack videos on LSO using metasploit?...no...triple sigh.i said most of it in a previous post here.
Going through dependency hell at least gives you an opportunity to learn and figure stuff out, building your own distro with the tools YOU use is much more helpful from a learning what the F you are doing standpoint.
Don't get me wrong, i'm not belittling the people that made backtrack. its a badass tool and i don't have near the linux kung fu to make it myself, so kudos to them for making a badass tool, its just irritating that it allows people that shouldn't take shortcuts in learning to take them.
what's the solution? build your own attack distro, you'll thank yourself in the morning.
9 comments:
yes that is definitely true. easy to use tools such as backtrack have always bred the wrong sort of people.
that said - such tools provide an important role in security in that they make it easy to demonstrate security matters to people who might be less technically/security oriented people.
"that said - such tools provide an important role in security in that they make it easy to demonstrate security matters to people who might be less technically/security oriented people."
i'd be more impressed if the auditor booted up his own linux distro, in fact, if i see a pentester boot up backtrack for work i would be thinking about not inviting them back.
that is my own, very biased, opinion
Back for round 2 of this topic :)
CG said: "what's the solution? build your own attack distro, you'll thank yourself in the morning."
In the spirit of furthering the topic, I'd like to know what you use CG?
Do you build off another vanilla distro like Gentoo / Debian or do you go with something like Linux from Scratch?
Beyond platform choice, when choosing your arsenal it should force you to at least think about what tools you need, what they require (libs, includes, gems, whatever) and when you'll use them. Which should in turn make you think about your process and methodology, blah, blah, evaluation and improvement. Rather than unconsciously taking the whole 9-yards, sometimes leading to the mentality of just 'throw everything at it that you've got' which obviously isn't smart testing or the footprint of someone who knows what they're doing on-site.
my 0.02
i knew this post would get you back tebo! i'll have to do more rant type posts...
i have two "builds"; home laptop that email gets checked on is ubuntu (i probably asked for it on that one), I also have a FC4 build that we use in the labs that is slowly morphing into what i use more. i guess i could do something from linux from scratch but i'm not a total linux purist and i'm definitely pretty lazy.
in my life i've blown away more linux installs than i can count and i think that is more my point. i remember back in the day when getting wireless or any of these hack tools working on your laptop took recompiling the kernel and it wasnt that easy and it was REAL easy not to have a working box once it was done doing its thing. so thats really what i am getting at, i'm constantly going through dependency hell to get the newest tool working and i have to use google and some time reading to learn what the F i'm doing.
i guess if you want the output of my what i call "evil" directory i can paste it in here. its got alot of the same tools as BT, but i've installed them myself, they work, and 9/10 times i know how to use them and what they are for and i've probably at least read the readme.
from a methodology point of view, Joe and I have a set of "hack notes" for most situations that is constantly being updated as new tools and ways of doing things are discovered by us. i just landed a job doing more "pentesting" type work so i imagine it will evolve even more over the next year as i do more of this during the day.
your 0.02 and more is always appreciated and welcome!
For me a LiveCD is a useful toy, since I am forced to use Windows by my work. And every now and then I just need to do something Linuxy, so putting a CD into the drive is very good.
Ideally I'd like to have a nice Linuxy laptop, but it seems that I'm not allowed. So BT gives me a good substitute
that does hold some merit bro i can make my own os from a standpoint of a fresh linux install set it up and what have you and on the other hand it is nice to have an easy way out but you are right it has too much power and some script kiddie is probably able to hack something he shouldnt be able to thats why they get caught beacuse they have access to shit they have no clue how to use but kudos is in order
bt r0ck da netw0rk!
bt r0ck da netw0rk! ???
i stand corrected then :-/
[quote]some script kiddie is probably able to hack something he shouldnt be able to thats why they get caught beacuse they have access to shit they have no clue how to use.[/quote]
Indeed they do, Framework 3.2 now runs on MS Windows and OS-X...
So now we can all pwn and we dont need linux to do it! Rah, Rah, Rah, pWn da PlAnEt!
Post a Comment