PentestBox - Portable Penetration Testing Environment For Windows Video Lecture | Get to know Ethical Hacking (English) - Software Development

[Music]
hey guys hack is Floyd here back again
with another video and in this video
we're going to be looking at Ventus box
alright so a lot of you guys have been
requesting me to make a video on pendous
box and rightfully so this has the
potential to change the way penetration
testing is done on a windows-based
operating system alright so I apologize
for the late upload today I hope
everyone is doing work but that being
said let's get let's get started so if
you haven't heard of pentas box let me
just break it down really early simply I
have the website right in front of me
the link will be in the description for
you to obviously check out and download
but before that you want to know what
exactly is Ventus box so let's get
started there so pentas box is an open
source pre-configured portable
penetration testing environment for the
Windows operating system alright so it
is targeted to work on Windows instead
of a set of Linux for example or Mac now
again some of you may be asking well why
on earth would I want to use this in you
know as compared to running
virtualization software or dual booting
so you can see they answer that question
on the website so why another
penetration testing distribution so
literally pentas box is not like any
other pen testing it's not like any
other Linux pen testing distribution
which either runs in a virtual machine
or run on a dual boot environment it
essentially provides all the security
tools as a software package that's the
key word there as a software package
unless you run them natively on Windows
so this is effectively this effectively
eliminates the requirement of virtual
machines or dual boots on Windows so I
think now you can understand the
significance of such a tool and the
reason I've not covered it so fast
because I was waiting for the latest
update which is the 2.3 update which I
know has been out for a while now and I
just wanted to make one in regards to
that so again it essentially answers
your question so if you are for example
running a computer on low resources and
you don't want to use a virtualization
software like VMware of VirtualBox then
pen test box you know will pretty much
offer you the penetration testing tools
that are that you are currently or are
commonly bundled with the
- interesting distributions like Kali
Linux or parrot to us just to name a few
all right so essentially it is targeted
for Windows so it only works for Windows
and essentially comes in a software
package so it is created because more
than 50% of penetration testing
distribution users use virtual machines
to run those distributions on the
Windows operating system so again this
gives you an idea of why this was
created and it's because they wanted to
perform or they wanted to provide a
native solution for penetration testing
for Windows because with Linux you have
the options in terms of kali linux and
part OS but for Windows it's always been
that you can to use it for penetration
testing natively alright so if you look
at the features some of the features
i'll irie find are awesome come in terms
of performance no as I said because it's
not running in any type of
virtualization it's not even hitting
your performance any bit and you
depending on the programs you're running
maybe you're running Metasploit or burp
suite that will impact your performance
but not the virtual in it any type of
virtualization second thing is no
dependencies required so you don't need
to install anything you can easily just
install it on Windows it's portable
which means you can carry it on a USB
stick you can run it off your USB stick
you can extract the files off a USB USB
stick it then comes with Linux utilities
like for example my favorite are curl
that most you know that you would you
not expect to find it then also comes
with awesome text editors like them
which is fantastic
alright so it doesn't have any driver
issues because again as you know with
Linux most of you have complained about
the graphics driver issues but with this
you're not faced with a graphical user
interface per se but with a terminal or
a command prompt that really really
comes that that you will come to enjoy
it then as a modular type a type of
setup where you can install you can
install any other tools using the tools
manager that is present inside the pen
test box but essentially this allows you
to install update on install tools which
are not already included in pen test box
which I'll be talking about in a few
seconds so you can see it uses
less memory usage all right so pen test
book runs runs on the host machine
without the need for virtual machine so
it needs only 20 megabytes are for
launching compared to at least 2
gigabytes of RAM for running a virtual
machine distributions which is
absolutely correct as I've mentioned a
virtual machine cannot run on anything
below 2 gigabytes and for the other
features you can see that it comes with
a version of Mozilla Firefox which is
another feature that I wanted to explain
it supports 32-bit systems and obviously
it can be shared on the network so you
can run this this folder or this tool
shared on the network so if you're for
example in an environment like a an
office or your school and you want to
share this you can easily do it that
being said let's get started with pen
test books and you can just go all the
way to the bottom to get started with
downloads and if they offer two versions
you have your your normal version
without Metasploit and you have the the
version with Metasploit so i would
recommend that you get the vision with
Metasploit to experience it fully so
it'll give you information here in
regards to how to get this set up so
exact you can see here there are two
variants of pen test box one without
Metasploit and one with Metasploit anti
viruses and firewalls need to be
switched off to install and operate the
version of Metis with Metasploit alright
so make sure that you turn off your
respective antivirus I have Windows
Defender here now I am running this on
Windows 7 and that's because for some
reason I have really huge issues with
Windows Defender on Windows 10 just you
know keeping live real-time protection
on even though one even when I turn it
off and I'm not going to go into my
registry and disable it from there then
install this so I thought why not just
show you this on a vanilla operating
system like Windows 7 just to show you
that it can indeed work on on an
operating system with minimum resources
that being said the the Installer will
extract the the files to the C Drive
under the pen test box folder and for
its proper functioning it's gonna tell
you here do not make any changes to the
directory make sure it's saved on the C
Drive
alright so I have downloaded the file
already it's free and you can see I have
it on my desktop it is the Penta
box with Metasploit vision 2.3 and it is
quite large it's about 2.4 gigabytes so
for those of you who are asking when
compared to candy necks it's slightly
larger but I think it offers a great
idea or ideal of functionality so you
can check it out for yourself so once
you have extracted the files it's really
very simple to install just double-click
it as you can see and just hit extract
I've already extracted so I don't need
to do it again I'm going to go into my C
Drive here and I'm going to go into my
pen test box folder that's the folder
you want to go into and voila
this is where Pentax this is where pen
test box is stored and this is where you
can launch it so if I launch it and I
would recommend that you run it as
administrator there just so that you
don't run into any hitches you can see
there we are welcome to pentas box and
you might be asking yourself well what
in the world is this and what tools can
I use well it's slightly different than
than what you might expect with Callan X
because you have slightly less tools but
they've installed the most important
ones Metasploit being one of them and to
launch them it's pretty much very very
simple it's going to just prompt you
that it's just gonna prompt you here and
you can use your Linux commands like
list and the default directory is your
desktop which is awesome and if I was to
just type in the MSF console command now
of course I'm not sure that the database
will work but you can see that if you
look closely you have Ruby so it has
Ruby and Python pre-installed which is
awesome and you know as you know ruby is
pre required to run Metasploit but there
you're Metasploit console is running you
know with the latest version but as I
said I'm gonna be testing it intensely
intensively throughout a full
penetration test and then I'll be
letting you guys know my review of
pentas box once I've actually understood
whether or not it can actually perform
in the field you know enthusiastic
beside we want to actually see if this
can replace virtual machines in in the
field so they you are warning no
database support test is expected I'll
be looking into that
of course I've not configured everything
wholly but I just wanted to give you
guys a head start to understand what
exactly is going on here all right so if
you look in the bin folder
this is where all your tools are going
to be exist this is where they all exist
and if you left your firewall I mean
your antivirus software on it will have
deleted some of them that it considers a
malware so for example if you look at
the fact that you have 7-zip you have
aircrack-ng which is awesome that means
you can run aircrack here you have
android security so you have your
Android applications like the jet X or
at the SDK which is awesome as well so
it comes with all the important tools
like the apk tool for reverse for
reverse engineering you have the atom
editor awesome we'll be looking at that
and second you have your best framework
your better cap burp suite awesome I'll
be showing you that just right now
Firefox also this is Firefox portable
information-gathering you have nmap you
have your the harvest all the tools that
you'd find with Kali Linux in terms of
information gathering are here you have
the Metasploit framework you have n map
password attacks you have the John the
Ripper so pretty much all the tools
exist in the fundamental regions of
penetration testing hash cat John the
John the Ripper and you also have the
reverse engineering tools right there so
you can check that you can check all
these tools out and again you might be
asking is launching it the same yes it
is so talking about the other tools like
for example the awesome thing the thing
I love about this is the fact that it
comes with SQL map it comes with nikto
and for the love of God it comes with
zap which is awesome so as you can see
Metasploit is working awesome which I'm
pretty much I was pretty sure sorry
about that that you guys are not gonna
believe but indeed it is working so
that's Metasploit and again I said I'm
not going to be going through it if you
want me if you want me to perform a
penetration test with this just let me
know in the comment section I just want
to show you that this tools do work so
you can you can use the default linux
commands there and for example if we
were to launch Firefox it does launch it
on its own version of Apple II portable
the portable version of Firefox so if I
type in Firefox right there there you
are is going to open up Firefox the
portable version and voila now again
it's going to use the kick
cookies and the history in regards to
the version of firefox that you have
installed i just wanted to point that
out let's take a look at some other
files so for example an map and we can
scan my router here let's see if that
does work and map and there you are by
the way will I'll be looking at in the
other videos how to upgrade the tools so
if you if you click on this option here
while that's performing the scan you can
see that you can launch a new console
you can go into your settings and I
would not recommend mucking with these
settings because this is well what you
would consider a Linux emulator and if
you want me to go ahead and take a look
in into these menus and what it deals
with you know you can let me know but
for now just don't play around with this
menu too much because there's a huge
margin of error in terms of the things
that you can do until and obviously the
mistakes you can make as for that menu I
would recommend that you just leave it
alone right now we'll be taking a look
at that later you can add more you can
add more consoles if you want and for
some reason this scan is taking a while
now but what we can do is we can let
that finish up here and we can launch
the other tools that I wanted to show
you guys which again is pretty awesome
so let that complete and wait for that
to complete in the meanwhile let's look
at some of the other tools that it does
come with so one thing that you have to
understand is it's going to be using the
windows alternative programs just so
that it runs natively so what do I mean
by this if a program is like zap is
available on Windows they are going to
use the Windows version alright they are
not going to use the Metasploit console
version for Windows because yeah it
doesn't exist right what I'm talking
about is SQL map for example you can see
that SQL map is a script and a Python
script so that will come in its original
version there isn't any exe version all
right so let's see if this is done if it
isn't I'm just probably going to cancel
it probably I should have actually
specified the scan here so I'm just
going to cancel it and we'll be looking
at how to perform a penetration test
with this but later we've tested
Metasploit so that does work
let's have a look at another tool like
birth how about let's try per sorry bub
sweet you have to launch it with the
program name and there you are bub so it
opens up in a new program and as you can
see it's using Java which means it is
running the perb sweet dot java file
let's see if it does launch there we are
it is the community edition just in case
you are wondering so I'm just going to
cancel this and onto exit and yeah there
we are
so bub sweet does work let's look at
some of the important tools that one
would require Zapp is not that important
Wireshark how about Wireshark it would
be awesome if they can bundle Wireshark
ooh this Wireshark there we are
yes it does work so for some reason this
program the runtime alright so these are
the errors that I was talking about in
regards to to the tools that you can see
right here so if I just close this one
you want to close why shocked we'll be
looking at how to troubleshoot these
errors because a lot of people have been
actually commenting on my videos telling
me that they want to learn how to
configure it correctly because it does
it it is a great option in terms of
penetration testing let's look at some
of the other tools again if you only
perform a review of this I'll be making
one and also will be looking at how to
utilize this inner penetration test that
being said let's take a look at some of
the other tools that we can use nothing
important here that is you know that
stands out in let's try Adam this would
be really awesome if it does work the
Adam editor it has split it and yes it
is working I'm not sure whether it's
launched it it is using the exe as I've
said they're going to be using the
windows alternatives or the Windows
versions just so that it runs natively
without any hitches all right so let's
give this a few seconds to start up
hopefully it does and as they have
mentioned it's not virtualizing any any
type of operating system you are running
it core so the performance should be
much better when compared to using
something like of VMware with Kali Linux
but I'm still to see if this can replace
Kali Linux because that is a question of
its own let's
some reason this isn't opening so I'm
just going to give that it's time and we
can launch a few other programs here
we've tried the Metasploit we've tried
nmap John I'm pretty sure the positive
tracking tools will work just fine
it comes with rainbowcrack and you have
your Hydra which we've already looked at
find my hash that's an additional one
that isn't very very common forensic
tools well pretty much just to be honest
the they have passed probably the most
important tools that you will be using
on a frequent basis if you're performing
penetration testing now can this replace
canon NEX well we have to categorize
this into into several sections and test
it accordingly and that's what I'm going
to be doing in the next video in regards
to pen test box we're going to be
reviewing it critically and comparing it
to Kali Linux and I'll be giving you my
final verdict on whether or not it can
replace it and the categories we'll be
testing for are number one
ease of use and one talk about ease of
use does it have a graphical user
interface is it user intuitive does it
offer the authentic Linux experience and
can you perform penetration tests with
it
the second thing is the the the upgrade
ability of the tools which they're after
as they've mentioned with pen test box
is possible you indeed can use or can
upgrade the tools within and the third
thing is other tools reliable and today
do they work without any hitch that's
what we're going to be talking about and
of course you are you are using a pen
test box with one exception the
exception being that you have to turn
off your your antivirus software which
is a downfall because you know why would
you need to turn your antivirus software
off even if you're using it for a short
period of time it does pose a potential
threat with the time in which you have
the antivirus software turned off
alright so this video is kind of an
introduction to pen test box it's a tool
that won't a feature on the channel
because I think it has a lot of
potential and I'm sure you guys can
really enjoy it
now that being said I'll be seeing you
guys in the next video if you like this
video or you found value in it please
leave a like down below if you have any
questions or suggestions let me know in
the comments section or
my social networks and I'll be seeing
you in the next video peace
[Music]