I use my Ubuntu for private and business purposes. Can I also install tools on my computer that are actually there to perform penetration tests? Or is it harmless?
3 Answers
That really depends on the programs.
As with any program you install, you ideally:
- trust the publisher not to perform malicious actions
- trust the publisher to develop secure software
The same trust must be given to any dependencies of the program.
What makes some pentest tools special is that they provide a larger attack surface than many other programs and the people using them are more interesting targets than the users of many other programs.
Wireshark for example specifically warns against running as root, because of the high number of vulnerabilities (because of a high attack surface, insecure language (C), novice contributors, etc). Of course, you may not be happy with having your user account compromised either.
As a general guideline, I would use these rules:
- run pentest programs on a dedicated computer or at least dedicated VM if possible.
- the larger the attack surface of the program, and the higher the amount of known vulnerabilities / the less secure the code is, the more important rule 1 becomes.
- The less reputable the source of the program is, the more you want to follow rule 1. Ubuntu repositories eg can generally be trusted more than a random github repository from an unknown entity or a nodejs program with dozens of npm dependencies.
Kali linux tools are hacking tools that are neither safe nor harmless. Installing Kali linux tools in Ubuntu by Katoolin or other means can turn Ubuntu into a hybrid Ubuntu/Kali Linux OS that is made possible by the fact that both OSs are Debian-based.
The only secure way to install Kali linux tools is to install Kali Linux in a virtual machine.
-
10Where, other than in this answer of yours, does this question discuss Kali Linux? I don't see it.– userApr 20, 2019 at 12:59
-
2Kali linux tools is what Katoolin refers to as hacking tools from the Kali Linux distribution. Kali Linux Tools can also be a synonym for Katoolin. Katoolin is a script that helps to install Kali Linux tools on Ubuntu and other Linux distributions. I didn't want to answer this question because I know from experience that a lot of people want to be fed a pack of lies that Kali Linux tools in Ubuntu are safe, however since I'm the top upvoted answerer on the katoolin tag I feel that I have a responsibility to tell the truth about this topic.– karelApr 20, 2019 at 13:13
-
5I'm not arguing against that installing binaries built for other distributions can be, at the best of times, risky from a compatibility point of view. (Usually, though, my experience is that the worst that will happen is that whatever binary you installed will refuse to run due to missing or mismatched libraries.) But I don't see anywhere that this question discusses Kali. All I'm seeing is a question about installing pentesting tools, and whether that carries (any special) risk. I would expect an answer to such a question to discuss such tools in general (as tim's answer does), not Kali.– userApr 20, 2019 at 13:46
-
5
in my opinion install kali Linux in place of Ubuntu. but if you work with thi last one you can find the kali linux hacking tools in this link https://tools.kali.org/tools-listing some script can be found in GitHub. and before to download anything from the web check the comments of in the section and also the website if is official or not. and virtual machine its virtual
nmapscanning tool. They are installed on business computers as well. Debugging and tracing tools are used by developers and engineers. Those tools in general are perfectly OK to install. Python, Perl, netcat, nmap - all those are used for pentesting, but they are not exclusively used for that, so there's no reason not to have them installed. Vulnerability injection tools - those are specifically used to attack, so there's no reason to have them unless you're a professional pentester.