pros and cons of a bootable BackTrack instance vs installed

Question

I've been wanting to mess around some with BackTrack to get a better understanding of some of the tools out there for penetration testing. I have a Linux box that isn't doing much right now that I was planning to install BackTrack 5.0 on. Recently though I was reading about booting BackTrack from DVD or USB key.

My question is, besides not having to dedicate an existing HD to the BackTrack installation, are there any pros or cons to running from a bootable DVD or USB key?

Is one easier to update? Is one faster? Do certain features work better or worse?

Answer 1

Generally depends what you are doing.

If you are planning on learning first, on a legal enviorment, I would recommend to install backtrack (dual boot, usb or virtually).

installing it:

1. Runs Faster

2. No need to do a large update over & over.

3. Allows you to add your own tools, and save files.

4. Allows you to save preferences.

At this point it seems that installed backtrack is the best option, but live backtrack gives you something that the installed backtrack dosn't. It will always be in a clean state.

Just the fact that it is in a clean state, might be more important than all of the other points for a pen-tester, esepcially for a black hat. That is why another option is customizing the the live version.

It all boils down to what exactly are you looking for (as well what you prefer)? Learning -> Installed, Work -> Installed/Modified Live, Black-Hat Pen-Test -> Live/Modified Live.

---

Further explanation:

1. Backtrack is built on ubuntu, updates are done the same way.

   sudo apt-get update & upgrade
   

   If you install it or use live cd you will have to update it, but take in account that with the live cd you will need to do a large update that may take from 15-25min, instead of small updates from the installed OS.

2. Running backtrack from harddrive/ssd is faster, than accessing the OS from a externall usb/cd. In my case performance difference has been minimum.
3. If you build your own tools, or have found some tools that are not included with Backtrack 5 can be added to the installed OS, if you use the live version you will have to reinstall them.

4. When you boot into backtrack, your user is root and the password is toor. You also have to start network by running

     $ /etc/init.d/networking start
   

   Some want their own password, wallpaper, have no need for stealthy boot, and so on. So they modify it on their installed OS.

Answer 2

Another option is to install it as a VM, this would give you the best of both worlds, it would be updatable, and you could take recoverable snapshots/backups of your VM instance if you're planning on doing anything that might break your installation.

Personally I have it installed as a VM along with other VMs like metasploitable so that I can experiment and learn how the tools work, and I have it installed on an old laptop (about 6-7 years old) and it works fine.

Answer 3

If you are learning, I would install bt only because you can keep notes and snap shots for reference. Bookmark good tutorials and save settings for tools. Of course adding tools is nice too. Pickup a solid book to get started and if things get too far out of whack, backup your home directory and start over. Running off the disk keeps you logged in as root where as the install let's you create multiple user accounts. Very important if you want to play with any of the crack or privilege escalation tools.

Answer 4

Many of the answers posted already cover your question largely, here our some additional points:

For pentesting I currently have two images: I have a vmware image which I keep up to date and a "golden image" which I can install on a disk to run live (this image can be flashed directly onto the disk with clonezilla). It's a clean install which is just kept up to date (especially metasploit) with my most commonly used tools which are not provided by default.

I've used live disks before, but it was too damn slow, VMware images seem to be the most flexible (you can just keep the host clean and use different images if you would like to run scanners like Nexpose aside the Backtrack image or if you like other OS like Windows to test from ass well), but sometimes you might not have a powerful enough laptop (we use laptops which hold at least an SSD and have 8 GB ram, but 4 GB and a 7200 RPM disk should suffice to do stress-less pentests ). If you can't afford something like that I'd go with a "golden image".

To make a golden image you just do a clean install for a certain type of laptop, computer or virtual machine and you keep it up to date including all your used tools. This way you can easily flash or copy it before a test and remove it afterwards. This ensures that you can do clean tests and do not start mixing up evidences or have junk floating around from previous tests. You also do not need to update every laptop every single time (it's okay if you only have one machine, but when you start having 4 machines or more it can become a real time-saver).

Answer 5

On higher end systems with decent strength virtual would be a good start with little risk or complication but later on if interested should be installed to made easier to interface with once you learned what to do and not to do on the OS and little less risk of damage