It is really like Russian Roulette, once any company is seriously targeted for the first time, it's very hard to get rid of all backdoors, like it's not impossible, but may take plenty of work and few weekends regardless scale to clean everything from firewalls to desktops
However such attacks are pretty much rare and are mostly true for bigger organizations or small organizations with political or economic importance
But even these usually fail within 5 minutes whatever it is their corporate network or website, and everyone thinks they are unhackable and secure, it's just that no script-kiddie can't make it undetected because these types today are mainly stealing money, the hacks I mean are to steal data which can be then used against corporation
Hi! I was reading the Debian Security How-To Docs and I found that the security team used Bugtraq to find bugs in Debian. I never heard of this operating system, but it is a pentesting-operating system like Kali. But I was wondering if anyone here already has experience with Bugtraq, and what the main difference with Kali is?
Which is better? I guessed that Bugtraq is more for white-box testing (with source-code) while Kali is more for black-box testing (without source-code)... Anyway, does anyone have a clue on this?
Well, I do pen-testing of whatever I need every 6 months and usually I have been using Kali with very good success, it allows to test not only security issues but also the resilience of the network and also hack some web apps as well and even wifi
I havent been using bugtraq sorry but I think it's going to be very similar
Most of time I spent on scripting using Fedora and most of the scripts I have to do myself are security related, from brute-forcing the network, load testing, DDoS procedures, monitoring, and other IDS components
...to automated updates, software releases and testing, which are also somewhat security related
And I also recommend OpenVAS or Nessus, when the full report is resolved then the number of incidents is significantly lowered, plus standard network segmentation
Most of the research currently focuses on automated software analysis, which are source code and binaries, the rest of security issues is now well automated maybe except the network testing which is shame but Cisco goes in good direction
Okay thanks a lot for your response. IMHO it'd also be better to use Kali cause it having more documentation etc. Anyway, Thanks! Btw: Does Kali also have frameworks/tools for smartphone-security?
You can install Kali on Android Smartphone as it's built for Arm however I am not sure if there's advantage over laptop (e.g. if it can use GSM etc), and also on Kali linux there are tools for pentesting smartphones.
Smartphones are serious target because they run outdated kernels so any rouge app can exploit it and root the phone the way it will run monitoring 24/7
Recently I took everyones phones, unlocked bootloaders and installed latest android which is very small and has only safe trusted apps on them
I did it shortly after I managed to root all of them :)
New phones had already android 6 on them and autoupdate google put in place recently as well
Thanks! Yeah, smartphone security and especially smartphone-forensics are growing. Loads of people for example accidentally delete pictures. Does Kali include Smartphone-forensic tools? They don't mention it in the tool-list.
For Android phones, it works mainly with Android SDK which is quite big if you download everything with emulators, and then on top of that there are tools which automate things so it's easier, the Android SDK is not distributed with linux distros but will work as long as OpenJDK or Oracle Java works
Though most utils should be there already I think but the Android SDK is separate download
Once launched it will download everything
So I think yes, everything should be there however for this bit I am using standard Fedora
It's better development environment
And in the end, it's always about programming and every tool will work on any linux, I use Kali because all these "haackish" tools I dont install from various sources on my laptop so I just boot usb stick on dedicated laptop and that's it, it's safer this way
I am not sure how about encrypted phones - it is easy to download image from the phone but if it's encrypted than it's a bit of issue
Once image is downloaded it's easy to undelete files
Background
My Android phone is rather old. It's running stock Android 4.1.2. Unfortunately, this is the latest firmware which T-Mobile offers for this phone. Still, I'm fairly happy with Android 4.1.2.
I plan to upgrade to a newer phone in the future. Maybe a BlackBerry Priv, in a year or so, o...
Background
My Android phone is rather old. It's running stock Android 4.1.2. Unfortunately, this is the latest firmware which T-Mobile offers for this phone. Still, I'm fairly happy with Android 4.1.2.
I plan to upgrade to a newer phone in the future. Maybe a BlackBerry Priv, in a year or so, o...
