I currently use very much Ubuntu and Kali from the Debian family for penetration testing (Network and Apps) and I want to know if anybody has tested arch Linux or other distros for penetration testing. If so where you able to download all the packages from kali into arch ?

  • 1
    See this question - you can do it, but if you're doing it, why are you using Arch in the first place? – gowenfawr Dec 29 '19 at 14:50
  • 3
    You can use any OS for pentesting. The OS makes no difference. How to download tools is beyond the scope of this site. – schroeder Dec 29 '19 at 15:31
  • Why not turn this into a "Does it matter what OS I use to start learning penetration testing?" – Arminius Dec 29 '19 at 19:46
  • @Arminius why? I'm not sure that's on-topic either. – schroeder Dec 29 '19 at 21:05

Arch Linux can be used for pentesting, just as with Debian or Ubuntu. I'm not super familiar with Arch (only used it a bit) but the package manager is different from Debian-based distros like Ubuntu. The learning curve, from what I've heard, read, and experienced, can be quite steep.

There's actually an Arch distro made specifically for pentesting: Black Arch. It's like Arch's equivalent of Debian's Kali and Parrot. It has a good arsenal of hacking tools in its own repository (different from Arch's AUR).

(It's still usually a good idea to do most of your hacking/pentesting inside a VM but you can also use your main machine with Arch and pentest directly from it, though the security of that is for another question/answer...)


Arch Linux is a very convenient operating system for penetration testing, since it is stripped down to only the basic packages (to maintain performance) and is a rolling bleeding edge distribution as well, which means that Arch constantly receives updates that contain the newest versions of packages available. This way you're also running the latest kernel with the most recent drivers, which is important in tests that require speed and efficiency.

However, barebones Arch with its default repositories does not provide the proper tools, even with the support of AUR (Arch User Repository), unlike other penetration testing distributions like Kali Linux or Parrot OS. However, most people with any significant experience in the penetration testing field would deem those distributions as bloated, which affects our most important key feature of a penetration testing operating system - performance.

To go around this problem, we're fortunate enough to have ArchStrike. It is an Arch Linux repository made specifically for penetration testing, so it by design is not some bloated Linux distribution preloaded with tools that are outdated by almost a decade. To setup ArchStrike on an Arch Linux machine, all you have to do is just add the repository to the pacman config. That's right - it is integrated with Arch Linux default package manager - pacman, hence installing new packages is as easy as installing anything else. Moreover, ArchStrike is actively maintained and follows the bleeding edge guideline of Arch Linux.

On top of that, BlackArch is out there too, following the same principles as ArchStrike and acting as an unofficial repository.

Not the answer you're looking for? Browse other questions tagged or ask your own question.