Does anyone know of any lightweight OSs that are great for Pen-testing? I would love to have a very lightweight live OS that I can boot off a USB and try some pen-testing against some of my Windows/Linux boxes. It would be nice if this OS had a toolset of different common attacks. I am sure this will be some Linux build but I am not sure whats popular out there for this.
Thanks
BackTrack USB Live is probably your best bet.
BackTrack includes many well known security tools including:
Update Kali linux has replaced backtrack now. It's from the same people so the tools described should still be there.
I'm a fan of Arch Linux. This would be much more minimal than BackTrack.
I'd probably only add a few tools to it, such as socat, fierce-v2, 0trace, lft, afd, nmap, Metasploit, tellmeweb, WhatWeb, inspathx, host-extract.rb, StringEncoder, w3af, skipfish, wapiti, sqlmap, fimap, bsqlbf-v2, pyloris, hashkill, squid-imposter, Yokoso, and Chromium.
Probably use the awesome window manager, RVM, and a JVM (in case you have a license for Burp Suite Professional -- and if so, also add the sodapop utility).
About one-third of the tools I mentioned above are included in BackTrack. Plus, there's a ton of stuff in BackTrack that I simply do not need -- it's a distraction/annoyance to me.
I recently ran across two distros which are very interesting.
The first is GnackTrack, which appears to be a better BackTrack -- especially for users that prefer GNOME over KDE, a common scenario for advanced Linux users. It has a few tools that are not in BackTrack, but probably should be, as well. Fascinating.
The second is NetSecL, which is based on OpenSuse. This is a really interesting distro as it is compiled with GrSecurity kernel patches, but also has a secured GCC (with stack smashing protection) and binutils support of PT_PAX_FLAGS. Strangely, it includes many penetration-testing tools, but not so strange if you believe that the client-side is a major source of vulnerabilities.
Though backtrack is the gold standard, there are others available. Another one to look at is SamuraiWTF (web testing framework). Also, there are websites that list off different options for live pen-testing distros (i.e. here ).
Recently saw that Pentoo is heavily updating -- https://code.google.com/p/pentoo/wiki/PentooUpdater
You can't go wrong with BackTrack 4 if you want slax based or BackTrack 5 for Ubuntu based. There is also Blackbuntu from http://www.blackbuntu.com
Try them all out on thumb drives and see which works best with your hardware. Blackbuntu worked better graphically than BT5 on my old laptop but BT4 was the lightest weight that I didn't have to patch stuff to get it to work right. My new laptop likes BT5R2 best, so it all depends on your configuration and application need.
