Managing third-party applications
Although Kali comes preloaded with several hundred applications, it is likely that you will need to install additional applications to effectively test specific environments (such as industrial systems), add new cutting edge tools, or ensure that your favorite tools are installed. Kali makes it easy to locate, install, and manage these tools.
Installing third-party applications
There are multiple ways to install third party applications: using the apt-get command, accessing a GitHub repository, and directly installing the application.
All tools should be installed from the Kali Linux repository using the apt-get install command. The install command can be executed from the command line in a terminal window, or the user may select a graphical package management tool.
Recommended third-party applications include:
apt-file: This is a command-line tool to search within packages of the APT packaging system. It allows you to list contents of a package without installing or fetching it.gnome-tweak-tool: This allows users to change themes and rapidly configure desktop options.instanbul: This is a desktop screen recorder that allows you to make a movie of desktop activities.openoffice: This is an open source office productivity suite that assists in documentation.scrub: This is a secure deletion (anti-forensic) tool that securely deletes data to comply with stringent government standards using various overwrite patterns.shutter: This is a screenshot tool that captures images of a desktop, open window, or a selection.team viewer: This supports remote access and remote administration. It also allows testers to place a pre-configured computer (a dropbox) on the target network and control testing from a remote location.terminator: This is a replacement for the Linux terminal window that allows horizontal scrolling—no more wrapped text!
Tools that are not present in a Debian repository and are accessible using apt-get install can still be installed on Kali. However, the user must accept that manual installs are not coordinated with repositories, and they may break dependencies causing applications to fail.
Some tools use the GitHub online repository for software development projects. Many developers favor this open repository due to the flexibility of the Git revision system as well as the social-media aspects of the software sites. One tool that we will be using is recon-ng, a web reconnaissance framework.
To clone the current version of recon-ng from the GitHub repository, use the following command line:
cd /opt; git clone https://LaNMaSteR53@bitbucket.org/LaNMaSteR53/recon-ng.git cd opt/recon-ng ./recon-ng.py
Finally, some applications must be manually installed. For example, to restore the asynchronous port scanner Unicornscan, can back to Kali, you must:
- Ensure the dependencies are first present:
apt-get install flex - Download the latest version of Unicornscan (www.unicornscan.org – the current version is unicornscan-0.4.7-2)
- Extract the contents of the file to a new directory:
tar jxf unicornscan-0.4.7-2.tar.bz2 - Change to the directory containing Unicornscan:
cd unicornscan-0.4.7/ - Compile the source code:
./configure CFLAGS=-D_GNU_SOURCE && make && make install
The exact dependencies and make install process will vary for each application, so you will need to refer to the developer's README file to ensure correct installation and configuration of these applications.
Running third-party applications with non-root privileges
Kali Linux is intended to support penetration testing. Most of the tools require root-level access, which is why access to the toolset and data is protected with passwords and encryption.
However, some third-party tools are not meant to run with root-level privileges. Tools such as web browsers may be compromised, and giving an attacker access to root privileges can have a significant security impact.
If root access is not required, tools should follow the principle of least privilege and run as non-root users.
To run an application that normally runs as a non-root user, log on to Kali using a root account. Kali should be configured with a non-root account. In this example, we will use the noroot account previously created with the adduser command.
Perform the following steps to run the web browser Iceweasel as non-root:
- Create a non-root user account. In this example, we will use
noroot. - We will use
sux, which is a wrapper application that transfers credentials from a privileged user to a target non-root user. Download and installsuxusing theapt-get installcommand. - Start the web browser, and then minimize it.
- Enter the command line:
ps aux |grep iceweasel. As you can see, Iceweasel is running with root privileges. - Close Iceweasel, and relaunch using the command
sux - noroot iceweasel, as shown in the following screenshot:
If you examine the Iceweasel title bar, shown in the following screenshot, you will see that it was invoked as the user noroot, an account that did not have administrator privileges.
You can also confirm that Iceweasel is running under the noroot account by examining the open processes, as shown in the following screenshot:
