Merging Kali with Tails

Question

I want to get into Linux penetration testing, but still want to have the benefits from anonymous surfing.

Is it possible to setup a good and 'secure' (Yes I know, TOR!=security, blabla) merge from Kali and Tails, starting with Kali?
And how?

Answer 1

It is possible. Using a Kali Linux LIVE USB key in forensic mode and using a script to route everything through Tor, and two scripts to wipe RAM on halt and secure-delete (srm or shred) files on halt.

Heres a complete writeup, you should really check it out :

http://homeofbannedhacker.blogspot.fr/2015/07/merging-kali-linux-with-tails-improving.html?m=1

Answer 2

Well, I had the same problem as you did. At first I struggled for about a day or two trying to get Qube's ISO image to read when I found I didn't have the right hardware in the first place. I liked the whole "security through isolation" idea of the Cube OS, of having each of my own work spaces neatly separated.

So, I came up with another plan; I simply installed Tails as the main OS, and then installed VirtualBox , and then I went ahead and downloaded kali linux for work related projects, and for entertainment I went ahead and threw Linux mint into virtualbox. Now, the whole idea here was that even though both Kali and Mint run off of Debian, Linux mint is used for entertainment purposes such as; movies, gaming, etc. Of course, if at any time I'd click on the wrong link I'd compromise my security, but not to the entire system. In such an event I would easily delete linux mint and re-install back in to VirtualBox.

The same would go for Kali, if I'm compromised, then poof. All would be hosted under a secure Tor encrypted Tails environment.

Now, I know that both Kali and Mint are both Debian based distros,and are known to be very secure, but I've had a slight run in with some malware and ransom-ware when running Mint alone, so I just wanted to take some precaution this time around. We'll, thank's for listening everyone and I hope some of this information helped.

Answer 3

There is AttackVector, "Linux distro for anonymized penetration based on Kali and TAILS". I don't know if it still up to date, but seem what you're looking for.

Answer 4

Seems like you answered your own question - start with Kali.

All these different distros are (definitely simplifying here) essentially a base Linux OS with various compile options and applications configured within. So in the case of Tails you are looking at specific configurations/applications geared towards trying to maintain anonymity.

If your primary goal is pen testing then, as you mentioned, you should start with Kali. You will then need to work on the individual tools found in Tails and try to implement them into that base OS. I say try as you may run into issues fully implementing them depending on your desired results. For example, if you are trying to bounce your traffic through a proxy to remain anonymous, a directed pen test may not work as expected. If you are going to keep your browsing (anonymous) and pen testing (direct) separate then this might be easier for you to do.

As far as I know, there is no current distro that combines both pursuits into a single package. Although that does sound like a worthwhile pursuit... maybe this will be your new distro!

Personally, I would stick to using the best tool for each task, using Kali for my pen testing learning (which I would do in an internal network anyway) and running a separate system for my anonymous browsing.