Security is not in rest in this book since a full chapter is dedicated to the topic. It covers setting up a firewall, monitoring, intrusion detection systems, setting up SELinux policies, dealing with a compromised machine, and gives many thoughful advice to define a security policy within your organization.

The authors have pledged to release the book under an open source license if the associated “liberation fund” reaches 25,000 EUR. Today, there’s less than 3,000 EUR to raise and we invite you to contribute as well. By giving 10 EUR or more, you’ll get a copy of the ebook as soon as it’s available (even if the liberation fund is not completed). Click here to contribute now.

The book is planned to be released in April but in the mean time you can have a peek at a sample chapter and the full table of contents. We have no doubt that this book will provide a solid foundation to all those looking to better understand Debian, BackTrack and Linux at large.

Initially, the bug report confused us, as BackTrack 5 R2 by default has a single root user, with no open TCP or UDP ports – therefore a console escalation from root to root seemed frivolous. The title of the bug was even more confusing – calling it a “BackTrack 0day” misrepresents the bug, apparently in an attempt to make it seem bigger than it is.

As an organization who claim to be security professionals, the Infosec Institute should know better. They should know that an accurate vulnerability description is probably the most important aspect of a bug report. Without this basic rule in place, every single 3′rd party FTP overflow in windows would be categorized as a “Windows 0day”, and every PHP web application vulnerability would be defined as an “Apache 0day”.

To summarise, we believe that the intentional misrepresentation of this bug report has discredited BackTrack unecessarily in the eyes of those who do not understand the underlying mechanisms of our OS, and also discredited the Infosec Institute in the eyes of those who do.

Lastly, we found the following quote from Saul Bellow relevant to this situation. “A great deal of intelligence can be invested in ignorance when the need for illusion is deep“.

After months of development, bug fixes, upgrades, and the addition of 42 new tools, we are happy to announce the full release of BackTrack 5 R2 available for download now. Running our custom-built 3.2.6 kernel with the best wireless support available, this is our fastest and best release of BackTrack yet. In the past few weeks, we have had a flood of submissions to our BackTrack Redmine Tracker with submissions for many new tools and dozens of packages that needed to be updated and this has helped to make this one of the strongest releases we’ve ever had.

Once again, our good friends over at Paterva have created a special BackTrack edition of Maltego 3.1.0 for your data mining pleasure and we have also included their recently-released CaseFile tool to help you organize and collate data from numerous sources. If you have never used these tools before, you really need to…they will change the way your interact with data and conduct reconnaissance.

You will also find we have included Metasploit 4.2.0 Community Edition, version 3.0 of the Social Engineer Toolkit, BeEF 0.4.3.2, and many other tool upgrades too numerous to mention.

In addition to the aforementioned updates and additions, we have also added the following new tools to BackTrack:

BackTrack 5 R2 – Reliable Weekly Security Updates and Fixes

Perhaps the one change that we are most excited about in this release is that we are now including the Ubuntu updates in our repositories on a more regular basis. So from now on, when you run a dist-upgrade, you will also receive the updated tools and packages that are being pulled from Ubuntu, making for a more secure and stable distribution. Rest assured that we will not be pushing out the updates blindly. We will be testing the updates internally to ensure that they don’t break any functionality prior to rolling them out publicly.

If you are merely upgrading your existing BackTrack installation to R2 instead of doing a fresh install, you can add the new update repository as shown below.

BackTrack 5 R2 – Wiki Updates

Along with this release, we have created some new HOWTO’s in our wiki to cover some things that simply can’t be packaged efficiently into a distribution, particularly the configuration of clusters.

• Building a Pyrit Cluster
• Creating a John the Ripper Cluster
• Enabling PAE in BT5 R2
• Installing VMware Player
• Installing VMware Tools

We hope that you enjoy this new release of BackTrack as much as we enjoyed creating it. Our goal, as always, is to be the world’s best penetration testing distribution so if you find bugs or have tool suggestions, please feel free to open up a ticket in our Redmine tracker.

1. Update and upgrade your BT5 (R1) installation:

Once that’s done, you should already have the new kernel installed as well as any last updates we have for the official R2 release. You need to reboot to have the 3.2.6 kernel kick in.

2. OPTIONAL – Once rebooted, log back in, and get your pretty splash screen back.

On the next reboot, you should see the red console splash screen appear.

3. Verify that you are running a 3.2.6 kernel:

You should see something like “Linux bt 3.2.6 …”

4. Feel free to install any or all of the new tools featured in BackTrack 5 R2:

5. Add the new security updates repository to /etc/apt/sources.list, and run another upgrade.

During the last upgrade you’ll be asked about file revision updates. Make sure to always keep the locally installed file. Feel free to press “Enter” and accept all the defaults.

6. Some of the newly installed services will be set to start on boot. We like disabling these as needed:

And…you’re done! Expect a more comprehensive introduction to BT5 R2, on the day of the Official release – March 1st! The BackTrack 5 R2 ISOS will we available for download from our site on March 1st via Torrent only. HTTP links will be added a few days later.

Although we do not make it a habit to announce third party releases, in Maltego’s case, we happily make an exception. Maltego 3.1 is the new flagship product from the guys at Paterva and offers a range of fantastic new features and enhancements to the already phenomenal product. If you haven’t tried Maltego, you don’t know what you are missing. Some of the new features include:

Completely new graph organisational abilities:

You now have the ability to organise the graph in terms of alignment as well as setting the layout for specific segments of graph as well as the entire graph:

New views, including Bubble View which allows users to sort information on their graph in terms of relevance by either incoming links (how many different bits of information point into a node), outgoing links (how many different links point out from a node) or both, as seen below:

Additionally with the layouts there is also the new Interactive Organic view which improves the speed of graph rendering dramatically by only redrawing relevant parts of the graph that are updated. There is also the ability to lock entities in place in a graph to allow for a more human structured format. Within the entities of the graph you can also merge entities together, add notes, add attachments (either from the web or local) as well as the previous features of adding custom entity types and changing the link properties:

Lastly the investigate tab also offers users the ability to now select all entities on a graph based on their bookmark, the type of entity it is as well as the previous searching capabilities:

Once the Parerva development team get their rest, we should be seeing a Maltego 3.1 CE edition surface…we will keep y’all updated once it does. Head down to the Paterva website now, and see the awesomeness of Maltego!

Commercial Support

BackTrack Linux has become the most popular Linux based penetration testing distribution available. However, to this day there are some organizations that would love to use it but have not been able to due to internal regulations that require support contracts for any software that is used. Additionally, other organizations have reached out to us to let us know that they rely on BackTrack so much that they would find support contracts extremely helpful.

Our new commercial support services are designed to help these organizations and more. Commercial support allows subscribers to obtain direct access to the developers, as well as a committed response time for any open tickets. Premium support subscribers are additionally provided with support for alternative kernel configurations.

BackTrack ISO Generation Engine

While we try to ensure that the default BackTrack image fits the needs of as many people as possible, some organizations have unique needs. The BackTrack ISO builder is designed to allow the generation of custom ISO images that can be built to your specific needs. Using the ISO builder you can select which package groups you would like to be included, as well as include custom branding such as bootsplash and wallpapers.

We are also proud to announce that a percentage of the profits from the ISO builder will go to help support Johnny Long’s HFC project.

Commitment to Freedom

These services have been designed to compliment, not replace, the free BackTrack offerings. We always have been, currently are, and always will be, committed to providing the highest quality Linux Penetration Testing Distribution available. Nothing is going to change this.

We are really happy with this release, and believe that as with every release, this is our best one yet. Some pesky issues such as rfkill in VMWare with rtl8187 issues have been fixed, which provides for a much more solid experience with BackTrack.
We’ve released Gnome and KDE ISO images for 32 and 64 bit (no arm this release, sorry!), as well as a VMWare image of a 32 bit Gnome install, with VMWare Tools pre-installed.

Lastly, I would like to thank the whole BackTrack team for pulling off the late nights working on this release, as well as Offensive Security for funding all of this stuff. If you need real world Penetration Testing Training – head on over to Offensive-Security and get ready for a bumpy ride!

BackTrack 5 R1 pre-Release

With over 7,000 DVDs released at BlackHat, we once again would like to thank the BlackHat folks for all their efforts. An additional “thank you” is in order to all the testers who have been reporting back to us. We received many requests to add some amazing tools which were presented during the cons. We are actively working on including these tools into BackTrack 5 R1 – hence the delay.

BackTrack ISO Generator Engine

This month we will be releasing a new paid service which will allow easy, online generation of custom built BackTrack images. Backtrack users who require custom builds will be able to use a simple web interface to configure and customize various aspects of BackTrack, such as package selection, graphics, penetration testing templates, drivers etc. We are very excited about this new service as it will provide a unique opportunity for various organizations and individuals to create unique and highly customized BackTrack environments for the first time. A percentage of all profits from this service will be directed towards Johnny Long’s HFC program.

BackTrack Commercial Services

Together with the ISO generation service, we will be announcing our new commercial BackTrack Support Channel. This service will allow large organizations which require official support, in order to deploy BackTrack in their networks, to finally do so. The BackTrack Support Channel will allow for direct communication with our developers, to aid in easy enterprise installation and deployment processes. The service will initially be provided to enterprise organizations only. For more information about the BackTrack Support Channel, contact info at backtrack-linux dot org.

BackTrack 5 – Free and open-source

With all these commercial services going on, this would be a good time to reassure our community that we are fully committed to a free, open-source BackTrack, forever. This will never change. We hope that through our commercial services, we will be able to better fund BackTrack and (heavens forbid) actually start paying our developers for their time and effort.

BackTrack 5 R1 to be released August 10th

To our friends at BlackHat who will be printing over six thousand (6000!) BackTrack DVD’s and distributing them during the conference, we thank you!  We hope you all enjoy the upcoming conferences and have a productive and fun time. May the sauce be strong with you.

Our goals with the book are to provide a single resource for the Metasploit Framework which doesn’t quickly become outdated and to provide an in depth resource for penetration testers who wish to understand the Framework inside out. The book covers everything from Metasploit basics to fuzzing, exploit development, custom module creation, writing post exploitation modules and meterpreter kung-fu.

In addition to the Metasploit Framework, we cover toolkits that leverage the Framework such as the Social-Engineer Toolkit (SET) and Fast-Track. The book also integrates the Penetration Testing Execution Standard (PTES) as the general methodology for performing penetration testing.

As part of this release announcement, the book is available for pre orders with a 40% discount at No Starch Press when you use the discount code of REDTEAM. This special discount code is valid until midnight on Wednesday, July 20th and if you pre-order the print book, you will immediately receive a PDF version of the book so get your copy now! Over 25% of net revenue going to the authors will be donated to the HFC group.

In addition, the authors will be appearing on the PaulDotCom Podcast this Thursday and the Infosec Daily Podcast Friday to discuss the book and give away free tickets to DerbyCon.