Category Archives: Tips

Article, Knowledge, Tips

Privilege Escalation

Deep Dive: How it works and how to stop it

Privilege escalation (often shortened to priv-esc) is one of the most critical steps in an attack chain. It allows an attacker to gain higher privileges after compromising a low-level account — ultimately leading to root or SYSTEM access. In this article, we’ll explore how it works, real-world examples, and how to protect your systems.

Types of Privilege Escalation

  • Vertical: Gaining higher-level privileges (e.g., from user to root).
  • Horizontal: Gaining access to another user’s data or processes at the same privilege level.

Common Linux Techniques

  1. Sudo misconfigurations: E.g., sudo vim → :!bash for root shell.
  2. SUID binaries: Exploiting binaries like /usr/bin/python with setuid bit.
  3. Kernel exploits: DirtyCow (CVE-2016-5195), OverlayFS, etc.
  4. Writable /etc/passwd: Injecting a fake root user.

Common Windows Techniques

  1. Unquoted service paths: Abuse poor service path handling.
  2. AlwaysInstallElevated: MSI abuse to gain SYSTEM access.
  3. Token impersonation: Tools like Juicy Potato or PrintSpoofer.

Tools for Enumeration

  • Linux: LinPEAS, LES.sh, pspy, GTFOBins
  • Windows: WinPEAS, Seatbelt, PowerUp.ps1

Defense Strategies

  • Enforce the Principle of Least Privilege (PoLP).
  • Audit sudoers and SUID binaries regularly.
  • Monitor for suspicious cron jobs and startup tasks.
  • Apply patches early to reduce kernel and service exploits.
  • Use Sysmon, auditd, and log management for detection.

Final Thoughts

Privilege escalation is powerful — and dangerous. Whether you’re a penetration tester or a system administrator, understanding both attack and defense is critical for keeping systems secure. Always think like an attacker… before they do.

Article, Knowledge, Thoughts, Tips

Pentest / Hacking OS – not just Kali…

Exploring the Best Operating Systems for Pentesting & Security: Beyond Kali and Parrot

By Jull3Haxor | jull3.net

When it comes to penetration testing, red teaming, and security research, your choice of operating system is more than just personal preference—it shapes your daily workflow, the tools you have on hand, and even your security posture. While everyone knows about Kali Linux and Parrot OS, the landscape is much broader and more nuanced. In this article, I’ll break down popular, niche, and advanced options—plus share why I personally choose Arch with BlackArch tools for ultimate flexibility.

1. Kali Linux

  • What it is: The gold standard for many pentesters, Kali is based on Debian and comes preloaded with hundreds of security tools.
  • Pros:
    • Massive toolset out of the box—almost everything you need is preinstalled.
    • Huge community, lots of documentation and tutorials.
    • Available for ARM, Docker, VM, WSL, and even Android (Nethunter).
    • Frequent updates, maintained by Offensive Security.
  • Cons:
    • Can feel bloated if you only use a handful of tools.
    • Not ideal for daily-driver use (security first, convenience second).
    • Everyone uses it—malware often targets default Kali environments.
  • Best for: Fast deployment, learning, CTFs, labs, when you want “everything” ready.

2. Parrot Security OS

  • What it is: Debian-based, privacy-focused alternative to Kali, with additional features for forensics and anonymity.
  • Pros:
    • Lightweight compared to Kali; more privacy tools (Tor, Anonsurf, etc.).
    • Offers “Home” edition for regular use and “Security” edition for pentesting.
    • Sandbox support, secure browser options.
    • Active community and attractive UI (MATE by default).
  • Cons:
    • Slightly smaller tool selection than Kali, but most popular tools included.
    • Can be buggy after big updates.
  • Best for: Those who value anonymity, privacy, and want a lighter pentesting distro.

3. BlackArch

  • What it is: An Arch Linux-based penetration testing distribution/repo with 2,800+ tools.
  • Pros:
    • Ultra-flexible—use as a full distro or just add BlackArch repo to your existing Arch setup.
    • Rolling release model—always up-to-date.
    • Install only what you need (not a “kitchen sink” like Kali).
    • Hardcore minimalist design for those who like to customize.
  • Cons:
    • Steeper learning curve (it’s Arch!).
    • Fewer “hand-holding” scripts; expect to configure things yourself.
    • Not ideal for total beginners.
  • Best for: Advanced users who want granular control and minimal bloat.

4. Arch Linux (with BlackArch or custom tools)

  • What it is: Vanilla Arch Linux with just the tools you want (e.g., via BlackArch repo or manual install).
  • Pros:
    • Absolute minimalism—install only what you’ll actually use.
    • Extreme customization, ultra-modern package management (Pacman).
    • Rolling release: bleeding-edge kernel, drivers, and software.
    • Faster and lighter than most “out-of-the-box” pentesting distros.
  • Cons:
    • Requires time and willingness to maintain and troubleshoot.
    • Initial setup can be intimidating.
  • Best for: Power users, people who want their OS “their way,” and want to avoid bloat.

5. BackBox Linux

  • What it is: Ubuntu-based distro tailored for security assessment, penetration tests, and analysis.
  • Pros:
    • Lighter than Kali or Parrot.
    • XFCE desktop—fast and resource-efficient.
    • Good set of preinstalled tools.
    • Familiar Ubuntu ecosystem—great for those coming from Ubuntu.
  • Cons:
    • Smaller community.
    • Fewer updates/tools than Kali/Parrot/BlackArch.
  • Best for: Users who want a familiar, lightweight, and stable pentesting environment.

6. Pentoo

  • What it is: A Gentoo-based live CD for pentesting and security assessment.
  • Pros:
    • All the power of Gentoo (highly customizable, optimized).
    • Hardened kernel, advanced kernel features for pentesting.
    • Perfect for “live” operations and advanced hardware configs.
  • Cons:
    • Gentoo learning curve—steep!
    • Fewer tools than Kali/Parrot unless you build them.
  • Best for: Advanced users, those who want Gentoo’s flexibility and optimization.

7. CAINE (Computer Aided INvestigative Environment)

  • What it is: Ubuntu-based, focused on digital forensics.
  • Pros:
    • Tailored for evidence collection, chain-of-custody, disk analysis.
    • Useful forensic tools out of the box (Autopsy, The Sleuth Kit, etc.).
  • Cons:
    • Not a general-purpose pentesting distro.
    • Limited pentesting tools.
  • Best for: Incident response, forensics, digital investigations.

8. Fedora Security Spin

  • What it is: Fedora-based live distro with a security toolset.
  • Pros:
    • Updated, secure Fedora base.
    • Gnome environment; familiar for Fedora users.
    • Good mix of tools for network analysis, forensics, web app testing.
  • Cons:
    • Not as tool-rich as Kali/BlackArch.
    • Smaller security community.
  • Best for: Fedora fans, Red Hat ecosystem users.

9. REMnux

  • What it is: Ubuntu-based distro for reverse engineering and malware analysis.
  • Pros:
    • Specialized tools for analyzing malware, binaries, memory dumps, network traffic.
    • Well-documented and actively maintained.
  • Cons:
    • Not a general pentesting OS; focused on malware/reverse engineering.
  • Best for: Blue team, malware analysts, researchers.

10. Tails / Whonix

  • What it is: Security-focused live OS with strong anonymity features.
  • Pros:
    • Leaves no trace on host hardware.
    • Designed for privacy, with Tor routing, strong anti-forensics.
  • Cons:
    • Not built for pentesting per se—lacks pentesting tools out of the box.
  • Best for: Private browsing, whistleblowing, research, safe anonymous comms.

11. Qubes OS

  • What it is: Security-focused desktop OS that compartmentalizes applications into isolated VMs (qubes).
  • Pros:
    • Top-tier isolation: each VM runs its own instance for apps/tasks/networks.
    • Supports disposable VMs for risky operations.
    • Backed by serious security research and trusted by pros.
  • Cons:
    • Hardware compatibility can be tricky.
    • Steeper learning curve, resource-intensive.
  • Best for: Advanced security researchers, those needing strict compartmentalization.

12. Windows + WSL (Windows Subsystem for Linux)

  • What it is: Windows environment with Linux integration via WSL/WSL2.
  • Pros:
    • Great for mixed environments (use Linux tools natively on Windows).
    • Supports most pentesting tools (with some limitations).
  • Cons:
    • Not as “stealthy” or flexible as pure Linux.
    • Some hardware/networking limitations.
  • Best for: Professionals who need both Windows and Linux tools simultaneously.

13. Other Notables

  • Alpine Linux: Ultra-light, good for custom builds, Docker pentest containers.
  • Buscador: OSINT investigation distro (OSINT tools preinstalled).
  • Kali Nethunter: Android-based, mobile pentesting.
  • Samurai Web Testing Framework: Web app pentest distro.
  • Cyborg Hawk, Dracos Linux, Network Security Toolkit, RedHawk, Matriux: Specialized/experimental, often for CTFs, learning or specific domains.

Rolling vs. Fixed Releases

  • Rolling (Arch, BlackArch, Parrot, etc.): Always up-to-date, but potentially less stable. Great for latest tools and kernel features.
  • Fixed (Kali, Ubuntu-based, Fedora Security): More predictable, tested environments. Good for enterprise or when stability is critical.

Personal Workflow: Arch + BlackArch Tools + Proxmox

Personally, I run Arch Linux as my daily driver and pull in only the tools I actually use (from the BlackArch repo or the AUR). This gives me a lean, blazing-fast system—no bloat, just exactly what I need. If I ever require the “full Kali/Parrot experience” (for example, when tackling a CTF box or running a full red team engagement), I simply SSH into my Proxmox server and spin up a dedicated VM with Kali or Parrot. This setup lets me sandbox my activities, test exploits safely, and avoid polluting my main environment with tools or configs I rarely touch.

Why this workflow rocks:

  • Ultimate flexibility: My host system stays clean, minimal, and stable.
  • On-demand power: I get access to the full toolset when needed—without having to dual boot or clutter my laptop.
  • Safe testing: Anything risky stays isolated on its own VM, snapshot-ready.
  • Resource efficiency: My main system isn’t running hundreds of pentest tools I’ll never use.

Choosing the Right Distro: What Matters Most

  • Experience level: New to pentesting? Kali or Parrot gets you started quick. Power user? Build your own from Arch or Gentoo.
  • Preferred tools and workflow: Do you want everything out-of-the-box, or do you prefer building your own toolkit?
  • Stability vs. bleeding edge: Need latest exploits or rock-solid reliability?
  • Hardware support: Some distros (Qubes, Pentoo) are pickier about hardware.
  • Anonymity/forensics needs: Some are better for red teaming, others for forensics, blue teaming, or OSINT.

Summary Table

DistroBaseUse CaseProsCons
Kali LinuxDebianPentest, CTFHuge toolset, docsBloated, targeted, not daily
Parrot SecurityDebianPrivacy, PentestLighter, privacy toolsFewer tools, bugs
BlackArchArchCustom, Power userModular, latest toolsArch learning curve
Arch + BlackArchArchCustom daily driverMinimal, blazing fastSetup/time investment
BackBoxUbuntuLightweight pentestXFCE, familiar, stableSmaller, less active
PentooGentooAdvanced, live useHardened, optimizedGentoo curve, fewer tools
Fedora Sec SpinFedoraRedHat ecosystemSecure, modernFewer tools, small community
CAINE, REMnux, etc.VariesForensics/MalwareSpecializedNiche only
Qubes OSFedoraIsolation, researchCompartmentalizationResource heavy, tricky HW
Windows + WSLWindowsHybrid workflowWin+Linux togetherNot pure, limited tools

Final Thoughts

There’s no “one size fits all” in the world of pentesting OSes. Kali is not the only way—and for many, it’s not even the best. Try a few, experiment with minimalism, and don’t be afraid to build a workflow that fits your needs, not the marketing hype.

What’s your favorite setup? Want to know more about BlackArch, Proxmox labs, or building your own security toolkit? Drop a comment or connect at jull3.net or Facebook!

Stay safe—and hack the planet!