Does anyone know of any lightweight OSs that are great for Pen-testing? I would love to have a very lightweight live OS that I can boot off a USB and try some pen-testing against some of my Windows/Linux boxes. It would be nice if this OS had a toolset of different common attacks. I am sure this will be some Linux build but I am not sure whats popular out there for this.



6 Answers 6


BackTrack USB Live is probably your best bet.

BackTrack includes many well known security tools including:

Update Kali linux has replaced backtrack now. It's from the same people so the tools described should still be there.

  • Metasploit integration
  • RFMON Injection capable wireless drivers
  • Kismet
  • Nmap
  • Ophcrack
  • Ettercap
  • Wireshark (formerly known as Ethereal)
  • BeEF (Browser Exploitation Framework)
  • Hydra
  • Cisco OCS Mass Scanner A very reliable and fast scanner for Cisco routers with telnet/enable default password.
  • Quypt (Terminal Emulator) (which is private software by Crimson Hacking group, which has leaked to the Mainstream) Blackhat
  • A large collection of exploits as well as more commonplace software such as browsers.
  • Why the mention of Quypt? Has this been useful to you in the past for a particular purpose/reason? Just curious!
    – atdre
    Apr 9, 2011 at 20:53
  • 2
    Blackbuntu is like Backtrack but more focused around Ubuntu. It's worth a look.
    – WalterJ89
    Apr 24, 2011 at 4:36
  • I can't consider BackTrack to be lightweight which is what the OP is looking for. The minimum space required is 2gb's for a live usb and all the available BT5 distros are well over 1.5gbs -- that's bigger than a ubuntu livecd distro!
    – greatwolf
    Aug 6, 2011 at 22:35

I'm a fan of Arch Linux. This would be much more minimal than BackTrack.

I'd probably only add a few tools to it, such as socat, fierce-v2, 0trace, lft, afd, nmap, Metasploit, tellmeweb, WhatWeb, inspathx, host-extract.rb, StringEncoder, w3af, skipfish, wapiti, sqlmap, fimap, bsqlbf-v2, pyloris, hashkill, squid-imposter, Yokoso, and Chromium.

Probably use the awesome window manager, RVM, and a JVM (in case you have a license for Burp Suite Professional -- and if so, also add the sodapop utility).

About one-third of the tools I mentioned above are included in BackTrack. Plus, there's a ton of stuff in BackTrack that I simply do not need -- it's a distraction/annoyance to me.


I recently ran across two distros which are very interesting.

The first is GnackTrack, which appears to be a better BackTrack -- especially for users that prefer GNOME over KDE, a common scenario for advanced Linux users. It has a few tools that are not in BackTrack, but probably should be, as well. Fascinating.

The second is NetSecL, which is based on OpenSuse. This is a really interesting distro as it is compiled with GrSecurity kernel patches, but also has a secured GCC (with stack smashing protection) and binutils support of PT_PAX_FLAGS. Strangely, it includes many penetration-testing tools, but not so strange if you believe that the client-side is a major source of vulnerabilities.

  • Very nice! I will take a look at both of these distros.
    – Chadddada
    Apr 26, 2011 at 13:50
  • 1
    GnackTrack is deprecated. The author suggests using backtrack now. Nov 11, 2011 at 17:05

Though backtrack is the gold standard, there are others available. Another one to look at is SamuraiWTF (web testing framework). Also, there are websites that list off different options for live pen-testing distros (i.e. here ).


Recently saw that Pentoo is heavily updating -- https://code.google.com/p/pentoo/wiki/PentooUpdater


You can't go wrong with BackTrack 4 if you want slax based or BackTrack 5 for Ubuntu based. There is also Blackbuntu from http://www.blackbuntu.com

Try them all out on thumb drives and see which works best with your hardware. Blackbuntu worked better graphically than BT5 on my old laptop but BT4 was the lightest weight that I didn't have to patch stuff to get it to work right. My new laptop likes BT5R2 best, so it all depends on your configuration and application need.

Not the answer you're looking for? Browse other questions tagged or ask your own question.