APPENDIX 1: LINUX

A discussion on hacking and penetration testing would not be complete without a brief discussion of Linux. Linux is a favorite operating system of hackers and pen testers due to its flexibility and functionality.

Linux was initially developed by a Finnish schoolboy, Linus Benedict Torvalds, as a way to manage memory on his 386 PC. Linus developed an operating kernel that he then offered to the world as open source code, so that anyone else that wanted to could contribute to its development.

There are many advantages to an open source project, such as Linux, as it can be developed and enhanced using the ingenuity and skills of many people, and any flaws or problems that are found in the program are likely to be found and repaired rapidly. There are no secrets in an open source program!

However, there are also disadvantages to open source software: it is easier to attack, since its flaws and wrinkles are visible to everyone, and not all updates to the code can be immediately trusted.

The Linux shell provides the command line from which many user commands can be executed. By setting up a shell script, a user can execute a series of individual commands. Linux allows the user to customize their system through the use of shells and the option to set individual variables.

The option to run privileged programs on the system is usually restricted to an account at root-level access. Passwords are kept in a file named “etc/passwd.” This file is accessed by many tools and may be a security risk. A more secure place to store passwords is in the shadow file, which stores the passwords in an encrypted format and is not accessible to anyone without root-level access.

There are many tools used in pen testing based on Linux. Having a Linux CD that will allow an administrator to boot up a system from a USB stick or CD will allow an administrator to bypass many Windows^® controls and run tools on the system. This can be a valuable way to examine and access a system, scan for malware and even reset Windows^® passwords.

The pen tester should become familiar with many of the commands and tools used on UNIX-based systems.