Backbox vs Kali: Which Service Is Better
The Digital Guyde team are self-professed tech nerds, obsessed with digital security and privacy. They love debugging «lost causes» and thwarting hackers.
Thankfully, good-hearted nerds have spent hours on end coding open source software, and there has been a veritable explosion of Linux operating systems over the last 18 years. In the olden days, you really had to know how to work from the command line, and many Linux systems had extremely limited GUI’s…if they had one at all. Many Linux distributions were little more than a command line, and though they had tons of great software, only the nerdiest of the nerds ever successfully ran the operating system.
Fast forward 18 years and distributions like Ubuntu make Linux so user-friendly it has become a commonplace desktop replacement for Windows and Mac. And though versions like Ubuntu are great for personal use and common tasks, they’re not best suited for white hat hacking and penetration testing. Network and endpoint security is absolutely critical in today’s data-driven world, and white hat hacking skills are in high demand.
If you want to build penetration testing to (ethically!) probe networks and computer systems to find holes and plug ‘em up, you need a Linux distribution designed for just that purpose. Several years ago, I would have recommended a distribution called Backtrack Linux, but the latest version of Backtrack has been redesigned and re-branded as Kali Linux years ago.
This is the most advanced and versatile penetration testing distribution ever created. BackTrack has grown far beyond its humble roots as a live CD and has now become a full-fledged operating system.
But is Kali the only version of Linux designed for security testing? Not at all, and today we’re going to take a look at two of the best penetration testing and ethical hacking distributions: Backbox vs Kali.
Version History
There are a million and one “flavors” of Linux, though they can be separated broadly into a few categories, such as Red Hat, Debian, and so on. Wikipedia has a Linux family tree timeline that is as fascinating as it is dizzying. Ultimately, both Backbox and Kali Linux can be traced back to their primitive Debian ancestor.
However, each distribution has followed wildly different evolutionary paths. Kali Linux is maintained by Offensive Security and used to be called Backtrack Linux. And believe it or not, Backbox is actually based on Ubuntu, which leads me to my next point: ease of use.
Ease of Use
Look, you’re going to have to know how networks, computers, and operating systems function if you have any hope of becoming a competent security professional – there’s no way around it. Sooner or later you’re going to need to get comfortable with the command line. However, that doesn’t necessarily mean you should dive into the deep end and try the most challenging variety of Linux, because it’s easy to become discouraged.
Personally, I think that Backbox is easier for beginners to use, and the Kali is more challenging. Both offer clean and intuitive interfaces, but because Backbox looks and feels more like Ubuntu, and because most people who have used Linux have touched Ubuntu at some time or another, I think it’s easier to use. Furthermore, as I’ll discuss later, Backbox doesn’t include nearly as many default programs, which I think is less intimidating and less overwhelming.
Price
There’s not much to say about the relative price of either operating system, because they can both be downloaded for free. Some of the tools, however, may link to an online service that requires a subscription, but by and large, the overwhelming majority of the programs included by default are entirely free to use.
A perfect example of an exception, however, is a tool like Metasploit, which can be used for free, though there is a Pro version with vastly expanded capabilities and a massive price tag.
Default Packages and Tools
One of the most beautiful qualities of Linux is that it is incredibly customizable. A standard operating system like Windows and Mac OSX, though they do include some degree of customization, can’t hold a candle to what Linux can do.
Linux comes with a myriad of free software packages, and during the installation process, you can pick and choose which packages you want to install, and which you wish to forsake.
But not all Linux distributions were created equal, and Kali includes a drastically higher number of packages, applications, and tools than Backbox. By default, Backbox includes approximately 60 various penetration testing tools. Kali Linux, on the other hand, offers nearly ten times that number and includes over 600 various hacking and penetration testing tools.
Personally, because Kali offers access to so many more tools and applications than Backbox, I would opt for Kali Linux. Additionally, both operating system ISO’s are relatively small in size considering that they’re fully fledged operating systems.
The largest Kali download is 3 GB, while Backbox is 2.2 GB. However, even though Backbox doesn’t have nearly as many tools, it does offer the main core group of programs needed to start learning how to perform penetration testing techniques.
For example, it comes with all the big name tools like Metasploit, Crunch, Armitage, Wireshark, and so on.
Support and Documentation
One of the most important qualities of a Linux operating system is how active its community is. If you’re using an obscure distribution of Linux that doesn’t have a large, active following, you’re probably going to run into trouble. Unless you’re a Linux guru, sooner or later, chances are you’re going to need to perform some troubleshooting.
In such a scenario, having a community to turn can be a real lifesaver. More specifically, you want to be able to reach out to other users through a blog or forum, and having a Wiki chock full of troubleshooting and how-to guides is a massive benefit as well.
Admittedly, both Backbox and Kali are well supported and frequently patched and updated. Both operating systems provide guides, blogs, and forums, but I think that Kali has a slight advantage.
Technically, Backbox is older than Kali. Backbox was originally released in 2010, while Kali was released in 2015. However, Backtrack Linux, which Kali is based upon, was released back in 2007, and for that, I think that Kali has a larger following of more active users who populate the Wiki and forums with more information than Backbox. Nevertheless, whichever OS you choose, you won’t lack for documentation.
Practical Uses
We’ve discussed ease of use already, but I wanted to take a moment to talk about practicality. The point I want to make is that unless you already work in an IT discipline or are currently studying computer science at university, Kali probably isn’t going to be very valuable to you. There are people who live and eat this material every day, and it takes an immense amount of sacrifice and time spent studying to build relevant skills.
Someone with top-level penetration testing skills and the right certifications could easily make over $100,000 per year, but unless you’re in a position to spend significant amounts of time studying the tools and testing them, Kali Linux isn’t very practical. Conversely, if you’re not especially experienced in the IT field but do have some basic Linux skills, Backbox is a great place to start and a lot more pragmatic.
Kali is often used in the real world by experts and professionals to perform real penetration testing to secure real-life networks. Backbox is certainly used in the real world too, but in the Linux community, it’s perceived as a watered down penetration testing OS that’s more practical for learning the ropes.
Final Thoughts
While both Backbox and Kali Linux facilitate white hat hacking and penetration testing, I think they are vastly different tools conditionally suited for different segments of users who want an operating system from which to perform penetration testing. On the one hand, Backbox doesn’t have nearly as many tools as Kali Linux, but hear me out, because in some situations that can be a good thing.
I think Backbox is best suited for users who are new to Linux and penetration testing. A new user diving into Kali might be easily confused or have a hard time finding the right tool or try each tool out a little instead of learning how to use one competently because there are so many to choose from. I’m not sure I would recommend it is as the very first Linux operating system for a newbie to use, however.
For that, I would recommend Ubuntu since it’s such a mild and user-friendly operating system, yet still offers the BASH shell; it’s a great OS for a newbie to get their feet wet.
On the other hand, I think Kali is better suited for someone who at least feels comfortable in a Linux environment. If you have some experience with Linux already, switching over to Kali isn’t that much of a leap.
I will warn you, however, by saying that you probably aren’t going to understand the syntax and operation of many of the penetration tools in the command line, but as long as you have basic Linux skills like navigating the file system, using the BASH shell, understanding root-level privileges, the path structure and so on, Kali Linux is the way to go.
This is the most advanced and versatile penetration testing distribution ever created. BackTrack has grown far beyond its humble roots as a live CD and has now become a full-fledged operating system.