BackBox & Kali Linux

Kali Linux vs. Backbox: Pen Testing and Ethical Hacking Linux Distros

Hackers as portrayed on the big screen are usually sitting hooded in front of a monitor with sleek, shiny black hat tools laid out on the screen. Though in reality such tools in past years were mostly CLI-based, a new generation of penetration testing (pen testing) and ethical hacking tools feature both slick UIs and powerful functionality for testing cyber security controls and posture. In this comparison, we'll look at two of the best: the Kali Linux and BackBox Linux pen testing and ethical hacking distros.

1. Kali Linux by Offensive Security

Maintained and funded by Offensive Security, Kali Linux is a Debian-based distro chock full of pre-installed security and pen testing tools—over 600 to date. Some examples include nmap, Wireshark, John The Ripper, BURP Suite, OWASP ZAP, and Aircrack-ng, among others. Check out our comparison of Netcat and Wireshark for protocol analysis  —in this case, it comes packaged with Kali Linux.

2. BackBox Linux

To both black and white-hat hackers alike, Ubuntu-based BackBox needs little introduction; the popular network and systems security analysis toolkit includes a suite of ethical hacking and security testing tools for a wide array of purposes: web application analysis, network analysis, stress testing, vulnerability assessment, computer forensic analysis and exploitation, and more.

3. Scoreboard and Summary

The following is the scoreboard for Kali Linux vs. BackBox Linux based on the 12 criteria listed above:

		Kali Linux		BackBox Linux
Capability Set
Ease Of Use
Community Support
Security and Surface Attack Probability
Release Rate
Pricing And Support
API and Extensibility
3rd Party Integrations
Bug Bounty Program
Companies That Use It
Age Of Language Developed In/Used
Learning Curve
Total		55		46
Average Score

Both solutions are excellent distros for pen testing and white hacking use cases, and both are free and open-source, so cost will never be an issue. Those that require commercial support and other perks that a for-profit-backed project enjoys (e.g., a bug bounty program) should probably go with Kali. And for continuous security monitoring and vulnerability assessment, ScriptRock is the platform to beat. Try it today, the first 10 nodes are on us.