 Parrot OS. Parrot security is a free open-source Linux distribution based on WN testing designed for security experts and developers and privacy-aware people. It includes full portable arsenal of IT security and digital forensics operations, but also includes everything you need to develop your own programs to protect your privacy while surfing the net. Now this is a really slick distribution, and I've been doing a lot of testing with it. I've been using it on and off over the years, anytime I do any type of, you know, some of the hacking, testing, having fun, you know, we do the how they get hacked videos. A lot of people talk about using Kali Linux. I always preferred Parrot over Kali. And Parrots become very, very popular. They've both been around for a long time. They're both based on Debbie and testing. And I'll leave this blog article that kind of goes in detail. Maybe I will one day Kali versus Parrot, but because I've used Parrot way more than Kali, I'm favoring that one quite a bit. But in short summary, and I'll leave, like I said, the link to this entire post, when it comes to tools and functionality, Parrot OS is the winner over Kali Linux. Parrot OS has all the tools available in Kali Linux and also adds its own tools. Now I didn't verify the statement on this blog post. I did find it though, and it's pretty much because they're both based on Debbie and repositories. If there's something you find missing, either one, like I said, you can add it over there. But there's a couple of things that Parrot does have right away, which is a non surf and Wi-Fi Fisher. Both of these are pre built in with Parrot OS. The other thing that's built in is a handful of other tools that I just found easier or at least more complete to set up with less problems in Parrot, but that goes back to a number of years ago. And I haven't tried Kali recently to see if any of those bugs have been worked out. And with any of these, there's always going to be bugs, especially when you're talking about an advanced pen, pen testing tool like this. But what I did to go a step further with Parrot was I form into my laptop and loaded on there. And we're going to cover that next in the video is actually using it. It's more than just using it just for the purpose built of pen testing. I like Parrot as now my, you know, operating system on my laptop because of having all the tools, but still being able to use it as my, so to speak, heavily driver system that I can use to get my work done. So let's first cover a little bit about the system of Parrot. So they've been around since 2013. This distribution is not new. They didn't just start it yesterday. They have a secure sandboxed environment using fire gel and app armor. So this is actually kind of cool because they wrap everything in a set of security policy. So they've done a lot of fine tuning. This is not like a Debian repository with some add ons or a fork. This is they copy all the Debian repositories into their own and run their own repository system and then do a lot of customization. So I'm actually really heavy security customization that they build in here. And one of the things that, you know, I really like is this a non-serve. That's one of the things we're going to demo later in the video is showing how that works as it's a really neat system. They have, like I said, a lot of documentation. I'm not going to cover every little thing on here because this is more about showing you how it looks and how it works. But it's well, well documented. Matter of fact, that's actually one of the nice things is they have getting started using Parrot troubleshooting network map information. This is kind of cool. They have this whole breakdown of where their mirror servers are, details about their mirror server, where the master nodes are. This is, it's really interesting. They've done a lot. It's more than just a distribution download. They have a lot of information in their site, whole user guide, troubleshooting, everything. A nice FAQ. So if you need to get into it from like the live method, they do have this and they have their own Parrot upgrade and Parrot installs. So when there's upgrades and things that need to be done, it completely comes from their repositories. Like I said, so it has, you're still using the app tools, you're still able to load the deviant tools on it and we're going to adopt dev package. But the way their repository works, they keep everything very up to date, especially because they have so many hacking tools in there. And this system will take care of upgrading them as well. So it's kind of a very self-contained security and pen testing system that is easy to manage and easy to update. So like I said, they've done a great job on having all this in there. Now, if you're familiar with apt and how their sources list work, they do comment on here, my sources list should be empty and they only have the parrot list. You have to be very careful because you could run into trouble if you add your own or add more repositories to this. This is Debian based and you may end up with some conflicts. So just a word to warning on this, be careful what you add if you decide to add other repositories, but they pretty much, they take care of it for you. And so far, setting it up and running it on my laptop, I haven't really had any problems setting all the things up that I wanted to run for my daily usage. So it has all the pen testing tools and I added just a couple of things like I do like Google Chrome to be on there for the business things that I do. It all worked very well. So let's jump over to the download and show you a little bit about the install and then we'll switch over to my laptop to show it in action here. When you want to download it, it comes in a couple different flavors. I think it's kind of slick that they have a home workstation build. So if you don't care about all the hacking tools, but you just want a more privacy focused operating system in terms of a Linux based one. So they have all security sandboxing, they have a smaller download that's for your home workstation. It's only a two gig download. Now they also have for the home edition and KDE home edition and virtual appliance. So you can download a virtual box image of it, you can get the KDE edition or the home edition, which is going to be based on the Mate interface. Mate interface is going to be much, much lighter weight. For the security edition, we have the paired security with the Mate interface. It's four gig download, the KDE edition, which is a four gig download as well and runs with the KDE plasma desktop and still the virtual machine edition. And they still have other sub editions for things like loading it on a Raspberry Pi. So if you go down to other builds, they have a Docker, a net install, orange pie, RPI and a pine 64, if you haven't seen some of the pine 64 boxes, pretty cool. These are all still experimental arm based distributions, but still they're compiling them for more than just x86. So Parrot's got a lot of options for you there. Now it does, of course, come with the live one. I didn't feel like demoing the live, but I pulled up here so you can see what the installer looks like. It does have a standard Debian installer, pretty basic. I'm not going to run through the entirety of the installer, but it's, if you use a Debian installer at all, it works quite well. It also supports on setup full LVM encrypted drives. I do recommend that all the time, especially if you're loading this on, you know, anything that can be walked off with like a laptop, please encrypt the whole drive. It's just a good habit to be into encrypt all my desktop drives and my laptop drives and it's arbitrarily easy to do without really a performance hit on here. So when we switch over my laptop here, it is fully encrypted from the boot of the drive. And like I said, this is facilitated on the install with LVM encryption. It's a nice system. Now before we switch over my laptop, the other thing I wanted to cover was I downloaded the standard Monte desktop one but installed the version with KDE and it's actually really easy to do. Now I'm demoing this in my virtual system because I can't show this part when we do the screen capture on my laptop. But up here at the top, I have the ability to choose either the default accession, which is the Monte or the plasma desktop. So we're going to choose plasma and put my password in and it loads this up in KDE plasma and then we'll go in log out and we'll switch to the Monte desktop. When I do the screen share on my laptop, it won't capture that screen. That's why I'm doing this right here. But this is the default desktop that you get and all you have to do in order to make this work, sudo apt-get install parrot KDE. And this will install the entire KDE desktop. I believe that if you can do, if you download the KDE version, you can also install apt-get install parrot dash Monte M-A-T-E and it will install full Monte desktop on both. So you don't really have to choose one or the other. If you're not, if you're undecided which one you like or you keep going back and forth, it does allow you to install both simultaneously. And then each time you log in, you can choose which desktop you want and both because you're installing the parrot version of these desktops via all the parrot repositories. By doing this, you get the best of both worlds, which is actually really nice from a standpoint of, you know, not deciding which desktop, try them both out. I did try the Monte desktop out and I did find it rather flat and kind of boring. It works excellent for all the exploit tools and everything else, but I thought the KDE one was a little bit better. So we're actually going to cover this from the KDE side of my laptop. But I wanted to show that both work perfectly fine. And I will also add one more thing to this before we switch to the laptop is both work through X2Go. I did load X2Go on my virtual server here and we're going to go ahead and switch to it. So here it is with X2Go logged into the Monte desktop. All the applications and everything I can, you know, works quite well. And Monte being a very flat desktop still has that really flat look. We go ahead and system, we're going to log out. Then we'll go to parrot KDE. And once again, X2Go was built in. I didn't have to add any repositories just, you know, apt get install X2Go server and configure it for this. And because KDE and Monte are supported in X2Go, it works with both of them here. And I keep this virtual install here. The reason being, because when you're doing some of the pen testing or enumeration work on a network, I like to have a virtual install on my network because I actually use this to test my network. I like it to beat up on my network, but it takes time to do so. For example, if I run a tool like OpenVast for a vulnerability assessment against something, it may take a couple hours or longer to run series of these tests. Therefore, it's nice having it installed as a virtual machine where I can kick it off and let it run in the background on my VM server for however long that particular tool that I'm running takes. So it's really cool that it does this. And like I said, X2Go does work perfectly fine. Go ahead and log out from here and switch over to my laptop. So I've loaded both Mate and the KDE desktop on my laptop. So this is running Parrot Linux, GNU 4.6, latest version as of today. And I loaded both, but after playing with it, the Mate desktop is just too simple and flat for my daily use. So I'm going to show you this on the KDE. All these tools work the same in both. So this is really just a matter of desktop preference. If you have a lower end system, you may want to lean towards the Mate due to its flatter look and lack of 3D requirements in terms of acceleration. It does run a little bit faster on there. Now, my laptop, here's the specs on it is Intel Core i5 5300, 2.3 gigahertz with 8 gigs of RAM, 7.5 gigahertz, just some shared memory, etc., etc., and only four cores. So this is not exactly a powerhouse of a system, but it runs perfectly fine. Applications open fine. It's not slow to use. It works quite well. Now, the first thing we're going to talk about that I think is really slick, and this is where the customization you'll start to notice right away. If you went from a standard Linux desktop to this is the fact that there is a lot of other networking features added into this. So the first networking thing we're going to talk about, let's go to configure network connections. And when you go into configuring the network connections, it's kind of cool. I've got the PA Sweden set here for the VPN and our LTS office VPN set up in here. And let's talk about when you set up VPNs. This is I just want to start. I know it's starting at kind of the beg end, but I thought this was cool. So you want to add a new connection. It has a lot of options here for adding network connectivity, Wi-Fi, shared Wi-Fi, Cisco VPN, any connect, Iodine DNS, Juniper, IPsec VPN. And I believe 40 gate is in 48 SSL VPN. So it's a lot of those are preconfigured here. Like I said, these are all things you can load in other Linux distributions, but out of the box, these are the extras that they threw in here. So you can go to a standard open VPN and there's obviously instructions on how to do this to set that up. Or this is the best part. And I just downloaded this from PA, they let you download the OVPN file. Now, as many of you know, I'm a PF sense user. And with PF sense, you can also just download the inline configuration out of PF sense and then do an import. So when you go to import connection, we hit create, go to downloads, PA, I have all these, they have a whole download pack you can get from PA VPN. And I can choose like Singapore, South Africa, wherever I want to be. Open it up and it'll let me log in and import that. So let's go ahead and say, South Africa open. Do I want to import including all the certificates? Whoops, I said no, and I meant to say yes. That's alright, it's in there. If the certificates aren't in line with the file and they're separate, it can bring them all in there from that download folder and put them in the proper data store. But here we are, I just got to put my PA username and password in there and away we go. So how does it connect to the open VPN? That's actually really slick to right now I'm connected to PA Sweden. I hit disconnect and show you how the connection works. I don't save my passwords in my VPNs. Alright, and now it's connected. And refresh to show you here, actually, we'll go to ifkinfig.co here, open it up in another page. And you can get my IP address right here. I've always liked this site is kind of slick just ifkinfig.co. And you can grab your IP address. By the way, if you're not familiar with this tool, you can curl it as well. Whoops. And it's going to pull your IP address. And if you want to disconnect from the VPN, just go ahead and disconnect. And it shows me back here in the United States. So I'm not going to show you my public IP address. Sorry. And if you're wondering all these IP addresses were open for PIA VPN. So they made it really easy to do. And I thought that was really slick right off the bat for the networking that I can just go ahead and import that in and import it right out of PF sense and instantly have the VPN connected along with all the other options they have for Cisco and 48 and everything else. Because, you know, if you're doing some pentesting, you may need to connect to some of those networks. So go back to configure network connections again. And you'll see right here I'm connected to our internal Wi-Fi general configuration. If I want to make this connection available to other users Wi-Fi security options. And, you know, all the usual here, but where they added a lot more is we go up here to the wire connection. This is just a nice little feature. So maybe you don't want your wire to have the same MAC address all the time. And I believe you can do this for the one here. I can choose a random MAC address instead of my own. So both of these have this option on here to go, okay, I want to choose a different random MAC address. So I don't want to use mine each time. This is kind of cool that they built this in on the fly. So I can just go ahead and change that. So I don't want to have my computer fingerprinted based on if you're trying to plug in and do some things. So each time you plug in, you want a different address. You can keep using a different MAC address, which is usually prompts DHCP servers to give you a different address on the network. And obviously you may not want that network to be tied to your physical adapter. So they allow you to spoof that that's built right in. A couple other side notes. So they do have it so you can automatically connect to a VPN when using this connection. So when you pre-define a bunch of different network interfaces, which they again, once again, make this really easy to do. Just hit the plus and you can divine like another version of your wired interface with different IP settings on there. They've made this. So like certain ones, maybe you automatically want to just connect to a VPN. And you know, like I said, this is kind of a nice feature and niceties when you're doing security testing. It's not that you want everything to be automated, but it's nice to have a few automated things in there to, you know, help you out. Alright, so that's the network configuration. Pretty slick. Now the Firefox configuration out of the box has a few plugins installed, which I think is kind of cool. So we're going to go ahead and close this. And whenever you fire up Firefox, it by default wants to start with the parrot profile. And I actually loaded both parrot and Tom profiles in there that way I can use a couple different ones. But if you load the parrot profile, it opens up Firefox and displays your public IP address. Don't worry, I'm on PA. You don't need to leave a thing in the comments. But the parrot profile has a handful of, you know, a few different websites bookmarked for you, things you can look up learning, programming books, parrot, open books, crypto books, other books. They have a lot of links that they prebuilt in that are all free for you to start downloading and diving in and stuff. I thought that was kind of nice that this level of customization. But hey, really cool that you can start reading right away. So you can load this distro, dive right in to start reading and learning within it with nice links to it and a donate page if you want to donate to the Parrot Security Project because well, it takes a lot of time to make an operating system this awesome with all these features in there. And they have a lot of different ways to donate. So if you can afford a few dollars, I know I'll be doing this. Throw some money at the project. It helps people out who put together these advanced projects. Now we also have you block origin privacy badger and no script installed in the Firefox browser as well. So like I said, the out of the box experience is pretty privacy oriented in Parrot Security. Now the other thing I wanted to talk about was the anonymous surfing. We're going to dive right into that too. So they have the non surf. Now when you're going through the applications here, there's all kinds of things that we're going to get to those in a second. But I like that the non surf is right here. So a non surf start, a non surf stop. Now I ran into a couple errors. I find it works better from the command line. You get a few errors and I'm not clear what those errors mean. They said they're going to be fixed soon. So I like to run the anonymous surf as sudo and it makes those errors go away. And it's just a non surf start. Now I wanted to do it this way too, because I want you to see exactly what happens when we do this. We're going to get a non surf start. And it's going to say, do you want a non surf to kill dangerous applications and clean some application caches? We would love you to do that. So what it's doing here, and it walks you through, it's going to start up a tornado, but it's also, you know, killing off applications, cleaning out the cache, shutting down things that are open to kind of, you know, clear out your trail of where you were. And it's going to start everything back up, stopping resolvers, stopping the DNS mash. Those are for that's for your DNS. So we want to make sure everything starts fresh from a tor node connection. And you are under a non surf tunnel. Now, if you didn't see it up here at the top, it says dance like no one's watching and Crip like everyone is global anonymous proxy activated. I just really like the way they did this. So now we can use that same tool we used before. So we're going to curl if config.co. And it takes a second to get the tor nodes going. We're still connected to PI Sweden. Let's just connect that. And while we're at it, we're going to look at the onion circuits that are formed. So we'll see which ones are built. Once again, more stuff they've integrated. So this has tour built in in the back end, the announcer kicks off the tour, runs the wrapper. So we'll see if it works now. All right, that site didn't loads, we'll just go ahead and open up under paired security to show my IP address. And now my IP address is 77247181162. Like said, this is a tour address here. And I'm apparently in the Netherlands. And if I want to be somewhere else, I have these onion circuits open here, I can see where I'm connected to which circuits it's going through. We're going to go ahead and if we sudo tour service restart, we can force it to rebuild those connections. And I should end up statistically likely with a different IP address. So here it goes thinking. All right, connections are all built. Looks like it built the same route. But like I said, this is kind of a nice feature. They built all this in for it. So if you care about the privacy, you want to be able to suspend something up without going through a VPN, but they go through a tour node. They've just built this right in on here. Now, in terms of what else they have on here, that's where it gets really extensive. So we're going to go and close this, close this, close tabs. Actually, let's shut down the anonymous mode because it does walk you through that too. So if we go sudo non surf stop. Do you want a non surf to kill all dangerous applications and clean the caches? Yes. So we're not going to take ourselves off. So it says cash cleaned, dangerous applications killed takes a few seconds while it restarts all these. Then it tells you global anonymous proxy closed, stop dancing. It's just cute that they put that in there. But I like that they give you these notices so you're aware of when you've turned it on when you haven't. Obviously, if you're doing security, you have to make sure that these things stay up and running. You don't really want to start doing a test and maybe have it jump to your public IP address. That could be very problematic for you. Now let's start digging into the applications they have here. So we're going to go under here and under the heading of parrot. So they have them all grouped here. There are so many. Like I said, according to the article over 600, I didn't count. But I believe it. We've got air crack, air getting art image burp suite comes with the burp suite mostly configured too. So you just throw it in, throw a proxy and away you go. We have kayak, multigo, loft crack, wire shark, Zen map. I've covered Zen map before, OS app. So these are all these common applications for pen testing, information gathering. Once again, they're all nicely categorized DNS information. Now just so you know when you're running some of these like DNS map, what they're going to do is require sudo because they require elevator permissions to run. But they're just going to open up a terminal because not all these have a graphical interface and they are designed to be run from a terminal. If I can remember to type my password properly. There we go. But they leave you with like a help message on there to help get you started. So here's how you run it. Here's the how you would do the target, etc, etc. So they give you like an example usually just the defaults like if you run the command on there. So it's like, if I just typed it in without any parameters it probably give me the same yeah gives me the same information. So a lot of these are not all graphical, but it's running each one in its own session. So you can start running your reconnaissance information out of there. Let's go back over to the applications and parent phone building analysis webinar like database assessment, the actual exploitation tools, what to do post exploitation tunneling and exploitation OS back doors. Like I said to even go through these there's a lot of books. You know, I have a book list on my site in my Amazon site. We recommend if you go through any of the Kelly books, they kind of equate back over to the parent books. Like I said, the parody features of these are pretty much the same when it comes to tools. Your splitting hairs when you talk about which one is there, which one stopped. But if any tool you find them one pretty much be loaded on the other. One of the things I thought was cool too, and I have not played with any of these tools because I've never really gotten into this, but they have the canvas tools for automotive reverse engineering. So you have all your can utilities here and there's quite a few of them. So if you are into the automotive hacking, which I would like to be but have not really put any effort into it, but it seems really novel. They do have a lot of that in there and there's a big demand from the automotive companies because they know people are hacking at it. So they're trying to hire more security researchers to work on that. Now another neat thing they have is all the different system tools on here. So if you want to start an SSH server, start, stop it. Obviously for me, I'm more used to doing all this from the command line suit is, you know, start and stop the SSH services, but they've enabled it so you can start and stop those services right from here. One of the tools that I like that I thought worked really good in here is open vast. I'm going to do a separate video on that, but I do use this in my sometimes when I'm testing devices, I want to see and use the open vulnerability assessment tool. It can be a lot to set it up, I can figure it. They may get pretty easy to set up configure right from here inside the parrot system. That's, like I said, I could spend hours and there's other people who do and I'll actually leave links to another YouTube channel that goes more in depth on each individual tool. Well, because they're just better at those tools than I am. And that site is the Hsploit.com and the accompanying YouTube channel, which there's a lot of great tutorials within this channel that will help cover like everything. They've got all kinds of different documentation in here for walkthroughs for how to do wire shark and burp suite and lots of other tools. So if you're looking for a channel to get started in some of this, I myself would find I found some of these tutorials very helpful that are on here and they have an entire website to kind of go along with it where they break down a lot of the details. So there's a companion blog post on each one of them for going to the tools. Now overall, I really like parrot Linux using it on my laptop here has actually been really pain free and easy. Once I got those couple of things loaded that I needed, it's worked perfectly fine out of the box. Even for some of my workflow, using things like GIMP, not a problem. I was even able to load K my money, which is what I use to do my accounting, which is something I do on my laptop because it's tedious and nice to do it while I'm watching one of these other YouTube videos when I go through that. But I haven't found anything that I can't really do on this with one big exception, which I'm trying to figure out a work around for. There is a screen capture tool I'm in love with that's called shutter. It is really great for capturing screens. So I don't know that I'd want to use this on my desktop until I can solve that problem. But I also don't have a use on my desktop for all the hacking tools. So I'm still going to keep running PapaOS on my desktop or for my laptop, where I used to spin up a VM to run the tools. It's really convenient to be able to have all these tools running right on the hardware here on my laptop. But at the same time, because I can get to my Chrome browser, get to my office VPN and do the communication tools that I use, such as, you know, you talking to people, the key base and signal, I can use this as my daily laptop and home use and it works perfectly fine. So it's definitely a nice operating system. I like the extra twist. I like the network connectivity and the nature of when I go out to a client, if I'm on site visiting a client, it's usually to do some network engineering troubleshooting and try to figure out what's going on with someone's network. So it's nice having all those tools just loaded up and ready to go when I have to figure things out because a lot of people ask how we enumerate networks or how we go through and find things when we take on a new MSP client. Honestly, I spend a lot of time doing things like Nmap or ZenMap to just try to find all the devices and having all the extra tools because sometimes when we do IT takeovers, we don't have the password. These tools are actually very helpful to check things inside of clients network to try to determine what the password is of things is sometimes you can just guess that it's admin admin, but having some of these tools which sound like hacking tools that you're thinking black hats would use are also helpful when clients who have well poor IT people that they had to fire that doesn't always mean they had good documentation. So this also helps with some of those documentation and maybe I'll do some more videos specifically on those use cases for it. But jump over and check out the HackersPlay channel because they have a great tutorial on how to dive into things a little bit further in terms of, you know, using all the tools on here. But it's fun because just remembering the list of all the tools that this comes with this hard. So sometimes being able to go through and have them all organized by category, the way they've done in Parrot is really great. I think it's a great operating system overall. It's not had any problems loading a laptop or in the virtual instance that I loaded it. So definitely give it a go. It's definitely with the try. If you want something polished and you're still a beginner, you just want to have a nice Linux system. I'm still thinking the Papa West would be more suited for that. But if you want to dive into the pen testing, hacking, Parrot OS is excellent. I do highly recommend it. All right, thanks. Thanks for watching. If you like this video, give it a thumbs up. If you want to subscribe to this channel to see more content, hit that subscribe button and the bell icon. And maybe YouTube will send you a notice when we post. If you want to hire us for a project that you've seen or discussed in this video, head over to LawrenceSystems.com where we offer both business IT services and consulting services and are excited to help you with whatever project you want to throw at us. Also, if you want to carry on the discussion further, head over to Forums.LauranceSystems.com where we can keep the conversation going. And if you want to help the channel out in other ways, we offer affiliate links below which offer discounts for you and a small cut for us that does help fund this channel. And once again, thanks again for watching this video and see you next time.