Preferred Live-CD Toolkit?

I have been using Auditor for some time now (Thanks MsMittens! I can admit it when I'm wrong.) and am very happy with it...but I'm always wondering if the grass is greener on the other side of the fence. I've heard of Whoppix and Whax, but I have no experience with them, or any other live forensic-security toolkit images.

So tell me what you like, and why? What's hot these days? What are we all using?

If you want to add an option to the poll, just indicate it in the thread and we'll add them as we go!

No Helix? I was just playing with it this morning in a VM to see how it behaves there (installs nicely on GSX 3.2) as well as to see what tools it has. Not a huge selection but some.

I have grown to love PHLAK. It is very easy to use, and brings a large selection of security apps. There are a few minor ones I was looking for which I couldn't find on the CD, but that is to be expected. Auditor is also great, but I think I'd put both on a par - I can't really make my mind up between them! :D

I have heard quite a lot about Arudius lately, but I haven't had the time to try it. It's pretty small (IIRC it's under 250MB), but it claims to bring quite a lot of apps. Again, I haven't tried it, but you might like to give it a go. Whax I've heard is also the current 'bleeding-edge LiveCD toolkit', but I haven't tried it either.

Knoppix-StD was good, but it hasn't seen an update in a while so the apps are quite old.

My final choice? Probably PHLAK, although Auditor is also brilliant. Both are missing a few remote apps, but they're both good. Maybe I should build my own... ;)

Cheers,

-jk

[edit] These are more security LiveCDs than forensic ones, but I'm sure they all have some forensic apps. :)

I just tried Backtrack.. It's a merge of Whax and the Auditor..

Quote:

---

first of all, we wish everyone a happy new year and we are shure that your are awaiting a new version of the Auditor Security Collection. We have to regret, that there wont be a new version, but there will be a new version of the BackTrack, which is the replacement distro of Whax and Auditor Security Collection. the development team makes great progress and we getting more and more stable.

In addition to this we get closer with vmware and are 99% able to integrate vmplayer into BackTrack :-) hurray!

---

http://remote-exploit.org

No Nubuntu? I know it is still "new" and all, but I have used it a couple of times and it is clean and easy.

Quote:

---

The main goal of nUbuntu is to create a distribution which is derived from the Ubuntu distribution, and add packages related to security testing, and remove unneeded packages, such as Gnome, Openoffice.org, and Evolution. nUbuntu is the result of an idea two people had to create a new distribution for the learning experience. Many people ask, "What makes it better than X?", or "Why should I use this over Y". Our answer to this question is, we don't not think about whether people are using it or not. We are more concerned about the learning process. If you want to try something with a clean interface, fast, and an excellent range of programs please don't hesitate to download nUbuntu.

---

Quote:

---

Some of the main security packages:

* Aircrack
* Airsnort
* Bluesnarfer
* DSniff
* EtherApe
* Ethereal
* Ettercap
* ExploitTree
* FragRouter
* Honeyd
* IISEmulator
* John the Ripper
* Kismet
* Metasploit
* Nemesis
* Nessus
* Nikto
* NMap
* Samdump2
* SSLDump
* VNCrack
* Void11

---

not listed...F.I.R.E.

ok... now it is listed. ty.

knoppix STD is pretty nice.

I have compiled a list of emails which discussed this very topic recently on the SecurityFocus pen-test mailing list. Here's the link to it: clicky.

Enjoy! :)

-jk


[edit] Note: First emails at bottom, newest towards the top (sorry about that). Emails separated by line of equals (======).

[edit2] There's also some more info available in this post.

I hadn't heard of Backtrack until SirDice threw it up here in this thread, but after reading up on it, it sounds pretty amazing. I have used Whax on numerous occasions. It had something like over 157 security related tools built in. Now, fusing the best features from both live cd's.... definitely going to have to give it a whirl!

I am unsure weather Bart's PE is classified as a Live-CD Toolkit but I have been using it and realy like it. It alows you to build a fully customizeable boot disk that will load a mini XP enviroment with free tools that you compiled into the cd. You can add tools such as spyware scanners, virus scanners, process managers, hijack this, startup managers and such. I Found it very usefull in the past and have just recently started using it again.

http://www.nu2.nu/pebuilder/

I used Knoppix STD. Primarily use it for etheeal, but I guess I could use another for the same application.

Howdy.

Well i must admit, i've got the Phlak addiction. {Check my profile picture ;) } anyhow i like it because it's light, and doesn't consume a heap of computer resource's.
It comes with a heap of security tools to play with.
And i love it as i can boot it up on any computer, and just use Ctrl-D and i'm instantly on the Sneaky desktop so any suspecting person would think i'm using XP..

I used to use knoppix, but i personally found it to be a system resource hog. and it really hasn't got a lot of updated tools.

anyhow all in all i would choose Phlak everytime.

cheers
front2back