Original URL: http://www.theregister.co.uk/2005/05/07/live_cd_paradise/

Live CD paradise

Important security tools

By Scott Granneman

Posted in Security, 7th May 2005 10:36 GMT

Whether you need to sniff for wireless networks or carry Nessus, Nmap and the Metasploit Framework with you in your pocket, there's a security-based Live CD out there for you.

My grandfather, Edgar Scott, was known as a fix-it man around Marshall, Missouri, the small Midwestern town in which I grew up. Folks brought cracked chairs, damaged tables, broken bookcases, and just about everything else under the sun by his shop, located in his garage, and he would repair them all. If you just needed something built, he could do that too. He was a wizard with his hands and his tools.

As a small boy, it was a delight to walk into the workspace in his garage, to see all of the tools he had hanging in well-organized racks all over his walls. He didn't have one or two or even five screwdrivers; no, he had 50, and all did something different, or had some specific purpose. Hammers? 30. Nails? Dozens of different varieties, all with a particular use.

Best of all were the antique tools he had collected. Every weekend he went to a different estate sale somewhere in mid-Missouri, and he bought just about any interesting tool he could find. He had buffalo hide scales, and miniature tin snips, square nails one hundreds years old, and even tobaggons used by kids around 50 or 60 years ago. To a kid, these were fantastic toys; to my Grandpa, they were interesting items in his collection; to a long-dead craftsman, these were the tools of his trade.

Tools are important, there's no doubt about it. Really, it doesn't matter what profession you're in: your tools are your trade. In the work we do, computers and other hardware and software are the tools we use. Anything we can find that makes our jobs easier should be treasured. Today, I'm going to present some treasures to you.

I've been working on a book for Wiley & Sons titled Hacking Knoppix, and the chapter that's been occupying me for the last couple of weeks is on Knoppix-based Live CDs that focus on security. In other words, these are bootable Linux CDs (although many contain Windows tools, as you'll see) that give you a wealth of security tools in one convenient package.

There are lots of these security-focused Live CDs out there. You can find an excellent enumeration at The LiveCD List - just use the filter that interests you, and you'll find something. Although there are many excellent security distros out there, I want to direct your attention to five in particular:

Distro Web Info Distro Focus
Knoppix-STD Home page
Download (FTP, HTTP, BitTorrent)
Cramming as many security tools as possible onto one CD
Auditor Home page
Download (FTP, HTTP)
Security checking
Helix Home page
Download (FTP, HTTP, BitTorrent)
Incident response and forensics
INSERT Home page
Download (FTP, HTTP)
Security rescue and network analysis
Whoppix Home page
Download
Penetration testing


I encourage you to download and start playing with all of these. Keep in mind, however, that there is a lot of overlap on these CDs. Nmap is on virtually all of them, as is Nessus, and the list keeps going. But each distro is also very different in its goals, its software, and in its general "slickness."

For instance, Auditor amazes me with its beautifully organized menu structure. Press the "Start" button, navigate to the Auditor menu, and you'll see everything laid out for you, sorted by task and broken down into area. It really makes finding that exact software package you need incredibly easy.

Auditor menu screenshot

Another nice thing about Auditor -- and several of the other distros -- is that it comes with wireless sniffing tools like Kismet configured out of the box. I've manually installed Kismet on other Linux boxes before, and it can definitely be no fun, to put it nicely. With Auditor (and several other distros, to be fair), you just boot the CD, and if your wireless card is supported, you're ready to start scanning. Very nice.

Although all of these CDs are based on Knoppix, which is a Linux distro, several of them also contain really good tools for Windows as well. For instance, if you place the Helix CD into an already running Windows box, then (a) a program will open automatically if auto-run is turned on (Bad security pro! Bad!), or (b) you can open the same program by double-clicking on helix.exe, found in the CD's main folder. When helix.exe opens, you'll have access to several useful tools, including software that displays the passwords of every email and IM account on the machine, or other software that shows you every path and URL accessed by Internet and Windows Explorer, and much, much more. Ouch.

Whoppix also includes several good Windows binaries that you should check out. If you're a security person who focuses on Windows, you probably already have most of these tools, but it's nice to have them available in one place.

Whoppix also has several really well done Flash demos that explain how to use some of the software packages it includes, like Metasploit, Nessus, and Hydra. You can view them without getting the CD if you go to http://www.whoppix.net and click on the Demos tab (I can't give you an exact URL because the entire Whoppix web site is built using Flash. What the heck is up with that? Here's the canonical statement of Granneman's Law: "Real hard-core tech sites are not built with Flash." Blecch!). The demos are good and help to make complex software much easier to use.

If you've never used Linux before, you may want to start with Auditor. Knoppix-STD seems to have every security tool known to humankind on its 700 MB, but it uses the fluxbox window manager, which can be kind of weird to a committed Windows or Mac user. Here's a tip: right-click on the desktop to open the menus you can't find. Likewise, INSERT is a tiny distro, designed to fit on a credit card-sized CD, so it also uses fluxbox. Whoppix and Helix occupy the middle ground: they both use the Xfce window manager, which is much easier for Linux newbies to work with.

All of these Live CDs are great to use as learning tools, since everything is gathered together in one place and also since, by default, the host machine's hard drive isn't touched, protecting it from damage. If you already know what you're doing, then think of these discs as portable toolboxes, containing the things you need in order to do your work. Either way, they're great to have, and since they're free you have no excuse not to download all of them and try them out.

It's funny, my grandfather's tools were objects that have been around in one form or another for hundreds if not thousands of years, like hammers, drills, screwdrivers and nails. I've often thought that if had been born sixty years later, he would have had a different career and his tools of choice would have been the same things that all of my readers use everyday: bits and bytes and software. Even though I don't work as a fix-it man in the way Grandpa Scott would have understood, I like to think that his craftsman's gene got passed along to his grandson, and for that, I'm proud... and grateful. Thanks, Grandpa Scott.

Copyright © 2005, SecurityFocus logo

Scott Granneman is a senior consultant for Bryan Consulting Inc. in St. Louis. He specializes in Internet Services and developing Web applications for corporate, educational, and institutional clients.

Related stories

Americans are pants at password security
Users untouched by mobile viruses despite hype
Cisco preps Wi-Fi tracking kit