Kali linux: BareMetal, Virtualized or USB Stick
Autor: Crash | Publicado: 2016-05-18T11:51:00-07:00










Few days
ago, we had a discussion about what is the best approach for Kali Linux
installation. 

A lot of
guys complain about the performance in virtualized installations - I have one
word for that: BULLSHIT!

I have almost 10 years of pentesting/security
experience and I have never problems with virtualized installation, except for
some years ago with Wi-Fi dongles (We will discuss it later).

Based in my
observations to where and when to install, here are few ideas to follow:

- New in
Linux: 

If you are
new, you should not start with Kali, go back and read this article first:
http://blog.dclabs.com.br/2016/05/wanna-be-pentester.html and related links. 

From this
point I will assume that you have Linux and security skills. 

As was
described in the link above, Kali is not for general purpose or day by day
distro, so, here is the first point:

- As Kali
is not a day by day distro, some applications like Skype, Flash player and
others are not supported by Kali Team, in other words, non-official/external
repositories can be added in your Kali in order to install tools/packets.

Also, in
Kali there are tools like calendars, agenda and stuff, but these tools are not
priority.
In case of problems with this kind of application, for sure you have to wait a
long time to get it fixed. Obliviously,
the best approach is to use Kali virtualized in your daily distro or Windows.

But before
installing it, please RTFM (Read the Fucking Manual)! Is very common for people
to complain about errors during the installation and performance. Of course,
they are not following the basic recommendations.
http://docs.kali.org/installation/kali-linux-hard-disk-install - Check all
requirements before starting! 

If you are
planning to use Gnome as your default desktop environment, you need more RAM
memory. 

I recommend
XFCE, because you are a Pentester and not a Designer.
If you want something cute, forget Kali and install HannaMontana Linux.
http://hannahmontana.sourceforge.net/ -&gt; Just to help you! (:

-
Performance: 

If you
follow the requirements, the likelihood of facing problems is very low.
Nowadays, machines have a very powerful processors, very good memory and disk
size, so it is easy to allocate some of these resources to a VM. However, if
your machine does not have good hardware specifications (maybe it is time to
throw it away and buy a new one) I recommend the bare metal installation. This
way kali is able to use the complete machine hardware resources and it will not
be shared with another OS. 

- System
restoring and backup

If you have
minimum skills regarding virtualization, you know that making virtual machines
backup/restore is easier than a bare metal installation - you only need to copy
a couple of files and that´s it. Also, you can revert to the last snapshot, the
system will be up in few minutes or less.

For bare
metal breaking, you need to check logs, files, disk healthy and stuff. Or, in
the worst case, install the system again. It’s really not a good thing if you
are inside a customer for example. 

-Mobility

If you have
a dedicated hardware to perform pestest for customers, is a good idea to have it
bare metal. However, is possible to face some hardware compatibility problems, it will be discussed in the next topic.

Nevertheless,
if you don’t have a dedicated hardware and carrying a notebook is not an
option, you can use OVF format (https://en.wikipedia.org/wiki/Open_Virtualization_Format). Just put the file in a
pendrive and load it in the Vbox or Vmware for example.&nbsp;

Another
option is to create a bootable pendrive, also, &nbsp;the mobility in this
case is easier than carrying a notebook in the bag all the time.

Following
the links related to USB install:

http://docs.kali.org/downloading/kali-linux-live-usb-install
http://docs.kali.org/downloading/kali-linux-live-usb-persistence

One more, but not powerful option is to install Kali in your mobile device,
there is a especial Kali edition called NetHunter
(https://www.kali.org/kali-linux-nethunter/) for this purpose.Also, you can
proceed with a chroot installation
(https://www.kali.org/tutorials/kali-linux-android-linux-deploy/)

This last
two cases are very useful when you are performing a pentest with very restrict
devices access. I mean, when the customer does not allow you to go inside the
company with your notebook. Normally mobiles devices are allowed and pendrives are very
easy to hide. 

-Hardware
compatibility
If you dont wanna face  hardware problems, the best way is to use virtual system.&nbsp;
Only one
problem in my point of view (and it not is that problem): You are not
able to use your GPU to crack passwords.&nbsp;

You still able to use virtualized to
crack, but for sure not the same speed. However, the passwords
can be cracked in your normal Linux/windows installation, don’t try to use this
"problem" as excuse to have Kali bare metal installed and look cool
for your friends.

For Wi-Fi
penetration tests, some years ago I had some problems because VMware and Vbox
didn’t have a nice USB management, nowadays, it already fixed. Basically 99% of
the problems with Wi-Fi pentesting are because the Wi-Fi card does not support
packet injection, so, check it before buying the Wi-Fi adapter.



Conclusion:


A virtualized Kali will work pretty nice for you, covering almost all the cases.If it is not
working with satisfactory performance, maybe you did something wrong.


Probably I
didn’t cover all possibilities ins the article, but I hope it helps you to choose the best way
to install your Kali.