BackTrack 5 & Sleuth Kit

The more I use BT5 the more I am falling in love with it. As a set of tools and resources it is by far one of the most complete I have ever seen. I really wish I had stumbled across it prior to this year instead of building my own loads and distros all this time.

One of the more useful things I have done this year is to replace my aging desktop at home. It took months to build as I acquired the parts necessary for the machine I wanted (as compared to the machine which would accomplish the goal). Now that it is completed and working, I have begun setting up my tools again and getting things organized as I normally operate. I have added BT5 in a VirtualBox environment to this suite of tools. Now that I have seen the offensive and monitoring capability of the BT5 suite, I need to look into the Live CD and its set of forensics tools. I would really like to move my digital crime course to more hands on and more of a lab environment for the students. I'm trying to find a way to do this both realistically and systematically at the same time. The hands on items of interest I am currently doing in the course seems to be not only very popular among the students, but also seems to be the most retained knowledge throughout the semester, which is somewhat straightforward.

I need to just set aside some time to see how many (if any) videos and tutorials already exist for Sleuth Kit and PTK. Both of these tools are on BT5 and several other Live disks. I would not be difficult to create 10-20 laptop drives as a project for using these tools and from what I'm reading in the academic journals, a team based approach seems to work better and produce more interaction. At the same time the course has been moved from an 8am to a 2pm course, I'm sure that alone will inspire more interaction.

For those of you who are not familiar with BackTrack 5 or The Sleuth Kit (TSK), just click the links.

BackTrack5 Install

I recently came into a mode of downtime for a few days and decided to finally install backtrack5 on a Lenovo X201 laptop. I burned the disk early on this semester but between my own students and my deliveribles at DSU, it sat on my desk at home collecting dust until this last weekend.

Out of the gate I hit the dreaded black screen. It took about an hour to find the right combination of grub tweaks to get it to boot and launch X. From there I will have to say that an i5 and 8GB of RAM is sheer overkill for this distribution. I did like the number of tools loaded into the live disk and the ease of use of the Ubuntu based apt installer made it easy to get the extra tools I wanted in my load. This left some testing of the tools to see if they performed any better than the windows versions.

For the most part I was pleasantly surprised at how well everything worked. I did find that the wlan0 adapter was not talking well with ssidsniff even when calling the adapter explicitly in the argument tags. Small issue really and I fully admit that in the short amount of time I did not try Kismet. I was able to quickly pull off an (on my own network of course) arp poisoning MITM attack using SSLStrip which I had seen demonstrated from the BlackHat tutorials and a few YouTube links prior. I was really impressed at how many tools were available to the user for security concerns. Nessus, OpenVAS, and  Snort were full installs with some of my more favorite tools such as Nikto and Ettercap.

I have to say that I'm sad I did not pick up this distribution earlier. BT5 is great and it would have saved me all those hours configuring my previous Ubuntu installs with tools had I just moved to this instead. I will also say that it is likely that the Lenovo hardware on this is what caused most of my issues. I will play around with it a little more this week before my summer courses get crazy and perhaps get it going in a VirtualBox environment although having real adapters in place of bridged mode NICs is always nicer.