Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm considering investing in an android tablet for pen testing. Does anyone know how capable they are with pen testing? Can they compile code or forward packets? Are any applications that work on linux going to work on them?

share|improve this question
1  
Why would you pentest from a tablet, rather than a netbook or laptop that can easily run Linux? It just seems like an exercise in futility. –  Polynomial Oct 3 '12 at 18:50
    
Portability / Social engineering -- a lot more suspicious to be typing away at a laptop –  November Oct 3 '12 at 22:41
    
Android is actually great for pen-testing and usability in general. Having keyboard, mouse, and touch-screen can really add to the user interface a lot –  atdre Oct 5 '12 at 14:37
    
Has anyone done this successfully? I'm trying to get an Android tablet (ANYTHING) that would let me set its internal wifi interface into monitor mode, but so far, unsuccessfully: I even put Ubuntu Touch in a Nexus 7... nothing. With a rooted Galaxy Tab 3 (model SM-T210R), nothing. Is there any working thing out there? –  BorrajaX Apr 17 at 20:43

5 Answers 5

Pwniexpress is launching the Pwn Pad in april, a penetration testing tablet based on the nexus 7. So yes I think the Nexus 7 is a good choice.

The Pwn Pad - a commercial grade penetration testing tablet which provides professionals an unprecedented ease of use in evaluating wired and wireless networks. The sleek form factor of the Pwn Pad makes it an ideal product choice when on the road or conducting a company or agency walk-through. This highspeed, lightweight device, featuring extended battery life and 7” of screen real estate offers pentesters an alternative never known before.

share|improve this answer

The Nexus 7 runs Linux. And if you root it, you can add whatever utilities you want. Just bear in mind that they have to be compiled for ARM. You can also install your own toolchain (compiler et.al.).

However, it doesn't have a keyboard, which does somewhat limit its usefulness as a pen testing device. Obviously you can work around this, but it does raise the question of why you're not just bringing along laptop, since you can now find very thin, light, and yet very useful ones at around the $500 price point.

share|improve this answer

Because of the support for recompilation of drivers that are known to support monitor-mode and/or frame injection, it appears that testers are sticking to the Broadcom chipsets (BCM). bcm4xxx are especially popular on Android devices, especially and notably Samsung.

Working out of the box, you have the Samsung Galaxy S II and the Nexus One. Recently added out of the box support for the HTC EVO 4G is also currently available. Using CMC or similar technique (AOSP would just be too annoying), one could add in the drivers to other devices with similar BCM chipset WiFi boards.

Ideally, you'd use a Samsung Galaxy Note for the CMC conversion of the driver over to at least monitor-mode standards. Theoretically, wash(1) should work in both passive and active modes, but the active WPS attack in reaver would likely require some additional driver modifications.

However, with Complete Linux Installer (on a rooted device) or Ubuntu noroot, one could install BackTrack 5r3 with aircrack-gui-m4 and Johnny (or additionally, even Reaver Pro if the reaver bits are working) for excellent X11 GUIs to control attacks.

Outside of WiFi Analyzer, Fing, Shark, and zAnti -- I would definitely add in X-plore and androidVNC. Some apps are better done without X11, and some GUIs from X11 simply are not yet replaceable via the Android SDK, Play Store, or alternate app market.

My suggestion would be to wait for the Samsung Galaxy Note 2 to arrive to your US carrier (note that there is an international version already available, certainly preferred over the US versions for a variety of reasons) and purchase then, helping along with the development of that platform for penetration-testing specifications.

I have personally added the vulscan NSE script to zAnti to make it that much more powerful. Along with a BackTrack 5r3 install via Complete Linux Installer, it would be possible to run Metasploit (any web edition such as Community or Express) on the web ports and access it via an Android browser, in addition to running Nessus and accessing it with the Android SDK app.

share|improve this answer

Pen-testing is largely command line, only a few tools have GUIs and with the ones that do have them you're often better using the command line as you can then use bash to pipe the output into other tools. Tablets are great for media consumption but not content creation or development.

Just get a business sub-notebook and cover it with as many extra batteries and Alpha wifi dongles you can (keep RFID, ubertooth ect on the side).

share|improve this answer
    
I add keyboard cases to my tablets for use in development and testing. Some tablets such as the Asus line have their own custom keyboards. –  atdre Oct 5 '12 at 14:34
    
The batter lifetime on most tablets is much longer than most netbooks. –  atdre Oct 5 '12 at 14:35
    
@atdre That's why I said business sub-notebook have a much longer battery life than any tablet or netbook if you add all the extra batteries and they have more processing power. –  Inverted Llama Oct 8 '12 at 9:23
    
My Padfone's batteries last for 3-4 days. No netbook or sub-notebook comes anywhere close. The iPad 2 and 3 are notorious for their long-lifetime batteries. Tablets have better batteries that last longer –  atdre Oct 8 '12 at 15:42

I know you can run Linux on these devices. There is an app http://zantiapp.com/anti.html

See also http://forum.xda-developers.com/showthread.php?t=967064 and http://www.androidauthority.com/android-hacking-apps-pentesting-57063/

share|improve this answer
    
Thanks, via that second link I found out about the nmap front-end for Android. zAnti seems better, but I like to have options ;> –  atdre Oct 5 '12 at 14:36
    
Glad we can be of support. –  Tek'eek Apr 15 '13 at 4:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.