Hackim Si Penggodam - Episod 6 (Operating System For PenTest)

Assalamu’alaikum Dan Selamat Sejahtera Para Pembaca OMG! Hackers?

EPISOD KEENAM

Setelah Cik Arif menceritakan pengalamannya kepada Hackim. Kemudian dia pun tanya kepada Hackim :

“Hackim, ada tak sistem operasi lain yang sama fungsinya dengan BackTrack kat dunia ni?”

Hackim pun menjawab :

“Entahlah Cik Arif. Saya rasa mungkin ada kot. Lagipun saya ni baru lagi dalam dunia komputer ni. Jadi saya tak explore lagi pasal sistem operasi ni.”

Cik Arif pun membalas :

“Ohh. Kau tak tahulah ni. Okay aku ceritakan serba sedikit mengenai sistem operasi yang mempunyai sama fungsi dengan BackTrack ni. Dalam Bahasa Inggeris. Hehe.”

INSERT Rescue Security Toolkit

A strong all around contender with no particular focus on any area (has network analysis, disaster recovery, antivirus, forensics and so-on).

INSERT is a complete, bootable linux system. It comes with a graphical user interface running the fluxbox window manager while still being sufficiently small to fit on a credit card-sized CD-ROM.

INSERT contains a multitude of useful tools to be at your hand in a variety of situations:

full read-write support for NTFS-partitions using ntfs-3g

support for various file system types:

locally: EXT2,EXT3,REISERFS,REISER4,JFS,XFS,NTFS,FAT,MSDOS,MINIX,UDF,HFS,
HFS+,HPFS,UFS,UNIONFS,SQUASHFS

net based: NFS,SMBFS,CIFS,NCPFS,SSHFS,AFS

support for linux software RAID and LVM2

support for WLAN adapters

network analysis (e.g. nmap, tcpdump)

disaster recovery (e.g. gparted, gpart, partimage, testdisk, recover)

virus scanning (Clam Antivirus, the GUI xfprot for F-Prot)

computer forensics (e.g. chkrootkit, foremost, rootkit hunter)

surf the internet (e.g. the web browser dillo [enhanced version], the graphical FTP client gFTP)

network boot server to boot network boot enabled clients that cannot boot from the CD (insert-remote)

installation on a USB memory stick (usb-install)

based on Linux kernel 2.6.18.6 and Knoppix 5.1.1

http://www.inside-security.de

BlackBuntu

Blackbuntu is distribution for penetration testing which was specially designed for security training students and practitioners of information security.

Blackbuntu is Ubuntu base distro for Penetration Testing with GNOME Desktop Environment. It’s currently being built using the Ubuntu 10.10.

Security and Penetration Testing tools available in Blackbuntu:

Information Gathering

Network Mapping

Vulnerability Identification

Penetration

Privilege Escalation

Maintaining Access

Radio Network Analysis

VoIP Analysis

Digital Forensic

Reverse Engineering

Miscellanious

http://www.blackbuntu.com/

BackBox

BackBox is an Ubuntu based Linux distribution penetration tests and security assessments oriented providing a networks and informatic systems analysis toolkit. BackBox desktop environment include a minimal yet complete set of tools required for ethical hacking and security testing.

BackBox Linux categories listed as follow:

Information Gathering

Vulnerability Assessment

Exploitation

Privilege Escalation

Maintaining Access

Documentation & Reporting

Reverse Engineering

Social Engineering

Forensic Analysis

VoIP Analysis

Wireless Analysis

Miscellaneous

http://www.backbox.org

Operator

Operator is a complete Linux (Debian) distribution that runs from a single bootable CD and runs entirely in RAM. The Operator contains an extensive set of Open Source network security tools that can be used for monitoring and discovering networks. This virtually can turn any PC into a network security pen-testing device without having to install any software. Operator also contains a set of computer forensic and data recovery tools that can be used to assist you in data retrieval on the local system.

http://www.ussysadmin.com/operator/

Bugtraq

Bugtraq offers the most comprehensive distribution, optimal, stable and automatic security to date. Bugtraq is a distribution based on the 2.6.38 kernel has a wide range of penetration and forensic tools. Bugtraq can install from a Live DVD or USB drive, the distribution is customized to the last package, configured and updated the kernel and the kernel has been patched for better performance and to recognize a variety of hardware, including wireless injection patches pentesting other distributions do not recognize.

Some of the special features that you can appreciate are:

Administrative improvements of the system for better management of services.

Expanded the range of recognition for injection wireless drivers.

Patching the kernel 2.6.38 to recognize 4 gigs of RAM in 32-bit.

Tools perfectly configured, automated installation scripts and tools like Nessus, OpenVAS, Greenbone, Nod32, Hashcat, Avira, BitDefender, ClamAV, Avast, AVG, etc…

Unique Scripts from Bugtraq-Team (SVN updates tools, delete tracks, backdoors, Spyder-sql, etc.)

Stability and performance optimized: Enhanced performance flash and java and start purging unnecessary services. So that the user can use only the services you really want.

It has incorporated the creation of the user in the installation, which is created with all system configurations.

We are the distribution and Forensic Pentesting with more tools built and functional, well organized menu without repetition of the same to avoid overwhelming the user.

http://www.bugtraq-team.com/

“Hm. Itulah serba sedikit tentang sistem operasi yang berkaitan dengan penetration testing. Sebenarnya ada banyak, tapi itu kau explore sendirilah. Eh. Berbalik kepada misi kau yang kedua tu. Aku nak kau jalankan misi ni dengan orang yang kau paling rapat dulu. Sebagai contoh ahli keluarga kau. Kau cuba cari segala maklumat yang berkaitan dengan ahli keluarga kau. Kemudian kau cuba cantumkan segala maklumat menjadi satu password. Caranya ada banyak. Jadi kau pandai-pandailah kena cari peluang macam mana nak dapatkan maklumat. Kemudian kau godam email diorang dengan menggunakan password yang kau ada tu. Tapi yang paling penting sekali, kau kena ada email diorang dulu. Kalau tak ada email, macam mana nak masuk akaun diorangkan? Kalau berjaya, jangan ubah apa-apa pada akaun diorang. AKU SENTIASA TAHU APA YANG KAU BUAT. Jadi jangan buat benda yang tak patut.”

Hackim membalas :

“Oh. Dengan orang yang rapat ya. Mungkin saya akan buat misi kedua ni pada kawan sayalah. Sebab ahli keluarga saya rasanya tak minat komputer-komputer ni. Jadi email pun mungkin diorang tak ada. Baik Cik Arif. Jangan risau, jika saya berjaya, saya akan terus logout balik. Saya tak akan apa-apakan akaun diorang.”

Cik Arif membalas :

“Kalau macam tu baguslah. Dan ingat, jangan kau dedahkan pada orang lain apa yang kau buat. Ini adalah rahsia. Dan kalau kau tak berjaya ke, kau cuba cari maklumat kat google. Kat situ ada banyak informasi yang boleh kau dapat. Dan aku bagi kau masa sebulan untuk kau mahirkan social engineering ni. Dan bagitahu aku setiap perkembangan yang kau dapat dalam misi ni. Anggap benda yang kau buat ni satu keseronokkan. Tetapi bukan keseronokkan yang boleh memudaratkan. Itu saja aku nak cakap. Okay aku kena pergi ni. Ada urusan yang lain yang perlu diuruskan.”

Hackim membalas :

“Ohh. Saya akan cuba mahirkannya dalam sebulan ni. Jangan risau. Saya akan buat misi ini dengan berhati-hati dan serius. Tapi sebelum tu, tak ada ganjaran ke untuk misi pertama? Heee.”

Cik Arif menjawab :

“Haha. Ganjaran? Nanti tiba masa aku bagi kau ganjaran. Buat masa sekarang ni tak perlu aku rasa untuk bagi ganjaran kat kau. Lagipun misi pertama tu senang sangat. Haha.”

Cik Arif pun beredar meninggalkan Hackim. Hackim yang masih duduk disitu, berkata dalam hatinya :

“Emmm. Aku nak buat kat siapa ni? Ramai kawan yang rapat dengan aku. Tak apalah. Nantilah aku fikir. Aku kena buat kajian lagi pasal social engineering ni. Sebab kalau tersilap langkah, habis aku.”