Hello, world.

This is CS 50 on this Colton argument today.

We're joined by sees fifties.

Nick.

Juan.

Hello.

Thanks for joining us on screen.

What we're talking about today we're talking about Callie.

Callie Lennox County S O.

Yeah.

Great question.

I think a lot of people have heard of Callie more or less, but basically it is a penetration testing Lennox distribution.

So it is geared towards pen testers all over.

The goal is for them to be able to just spin up a device with a fresh OS, and they have all the tools that they would possibly want to do.

Pen testing eso I see in the chat room talking about hacking, pen testing and hacking are different, really and kind of intent and permission, but not much else.

Both have to think like Attackers.

Both have to understand the systems that they're attacking.

The networks that they're attacking both have to understand a lot about how people think.

And there's many more things not not covered in those three topics that are also part of pen testing and hacking.

The difference.

Key difference being pen testers are, I would say, 100% of the time asked to do the hacking.

Uh, there's maybe a corporation or an individual or an institution that asks pen testers to come in and test the security of the network or test the kind of resilience of the network to being penetrated by external forces or Attackers.

Hackers are usually not asked to attack people.

I think the only times that would occur is if someone thinks that they're so secure and they challenge people to hack them.

But that is the kind of key difference there.

But both have been known to use Callie Lennox.

They will have to kind of go through a couple of terminologies here in that black hat.

White hat, pen tester, hacker um, and script kiddie are kind of five key words I think we should cover because we've kind of covered a little bit of pen tester and hacker.

There's Black Hat White House, which kind of correspond just white hats and black hats that correspond where a white hat hacker is someone who tends thio work as a pen tester.

They're employed, that's their job.

They get money and they're legally allowed to do certain things.

A lot of times in pen testing scenarios.

If you're hired by like, AH, company that has sensitive Donna, they have very strict rules on what you're actually allowed to do.

Maybe you guess the password username combo and that you don't you don't go any further.

Or maybe they say, OK, you've got that.

And now you are allowed to spread a virus from machine to machine, but you're not allowed to do anything else from the virus can take information.

No information extraction.

There's other companies that might say, Hey, extract as much information as you can get at the end of the week.

Tell us what you got and will verify that that was like the right information.

Black actors are what you think of.

Usually when you say hacker, that's that's the person who's going around snooping through a system, putting viruses on things, doing all sorts of terrible stuff, maybe for good purposes in their minds.

But it is certainly illegal, or it should be very illegal.

United States laws on hacking are actually a little questionable, and whether or not they actually do what they say they do.

I think you can look at the Senate interviews of our Congress interviews Zuckerberg and, uh And we kind of tell you what you need to know as faras where our lawmakers are on hacking legislation or just technological legislation.

Someone removed?

Yeah, that's a good way to put it.

Uh, yeah, it's Ah, it's a wild time.

And I see in the chat David is President said I was a little bit popping.

Was that Mr Robot is lurking the sandwiches that I saw the first episode I saw.

I watched the first episode of Mr Robot because he always talked about it, and I was super sites to actually see that very good shot pretty prominently, especially towards the later season.

After season one, we don't use a ton, but season to season three.

You'll see the that Connie pull it up on my screen.

But yeah, very cool.

Nick Co tu auras, Lennox, your thing s o.

I mean, those aren't necessarily mutually exclusive.

I do love Lennox systems.

I tend to be a lot better with Nick Systems that windows, for example.

But I do also code quite a bit.

I mostly in python and suppose plus, but I'm pretty familiar with, like our if you count?

That is programming.

Uh, nothing against aren't sorry that I really like by that.

I'm not a huge fan of our Matt lab, I guess if you count it on Java script and Jake weary and things like that A lot of Web development stuff as well.

How does he have a sees fit to send what topics to cover on stream.

Oh, yeah, you and I do.

A lot of the streams will get a lot of ideas that kind of talk about it, but a lot of it is cater towards the end of the folks expertise who have the time to come on stream.

It's usually in the center of what the folks are familiar with.

But we'll take suggestions.

If you have suggestions different, let us know you should be wearing a black honey.

Actually, I should've brought my, like, hacker black Hoody.

Probably true U s.

So what is the overall, I guess, sort of flow of the stream state, like, how are we gonna demonstrate politics?

So originally, I was going to walk through some of the tools that are included in Cali Lennix by default and kind of explain what they do and so on.

And we're still gonna do that.

But we're going to contextualize it a little bit on.

So the way that we could kind of imagine this scenario is somewhat comments and actually right now, and I think it'll actually getting more common as we go where I used to.

We're gonna protect his All Star.

Am I?

Some of it was actually personal, True, but it's all scenario at this point where we're going to say that cold and I work for a company on I am a network admin or kind of like a sys admin.

I do stuff on the computers.

I told my manager, and I called is not happy with my performance one day.

It makes perfect sense fires on Once I'm fired.

I have most companies, I think, try to implement this in such a way that they, like, clean out your access very quickly.

But this company doesn't really do that.

So I get access to the machines for around a couple hours before I fired.

Plus, I kind of knew the firing was coming, you know, like I keep sleeping on my shifts and eating bananas, whatever.

So I have kind of known that everyone does as one does when there's this admit And Yates.

Um, actually, it's an illusion turn cybersecurity competition on.

So I know that, and I know I'm gonna get fired, so I kind of messed around with some of the systems.

They also work.

Everything still works.

It's all operational.

Well, actually demonstrate that it's still operational.

But I like, you know, added some things miss configured some stuff through some service is around, you know, there's there's some other things going on there, and I am super familiar with catalytic.

So I made it really easy for Kelly to attack U S O.

He fired me.

I no longer have direct access to the systems.

And now Colton being the man good manager that he is, he went through the change, the passwords, that was it.

And actually a lot just don't even do that.

So, like, that's actually pretty good step.

The passenger knew now he changed into things.

He heard of this thing called Wait, speak.

So he, uh he, uh, modified some of his passwords that their lead spoken.

Now I guess that's the very secure, very secure.

And we're gonna talk about why Callie is kind of cool.

It's the best tool for script kiddies if and I know that someone somewhere I'm positive will comment on, either you do video the Facebook stream.

So one of these dreams will be like You're handing script kiddies all these tools to attack people.

But it's like you Astra has property, but it's not like they don't have the Internet.

You know, you can go Google things and it'll it'll tell you.

But I think that my point on the streams I'm gonna very much emphasize that it's important for us to understand how the stones work and what they're doing and why they're important.

Because as a pen tester and as someone who like very much advocates for ethical hacking and wants people to be aware of these sorts of things, I think that it's really just two sides of the same coin to understand how someone could hack you and to understand how to defend against the attack.

And if you want to be better at attacking someone, you should be better at defending systems.

They go together, so I like, As Lee points out of hate, thes air two parts, right?

Me sleeping on the job.

I've never that I'm aware of policy job.

But I got you.

Okay, So when asked what, uh you know.

But what Lennox do you run in there?

Seeming arch, actually, really like our clinics.

I've since switched away from our ex towards something called Alpine Lennox.

I think it's a little bit Maur, just like director modularity concepts, but I generally really, like a boon to because it comes with so many things that I can then play around with.

It's a very standard destro people.

It's pretty easy for people like you noticed understands.

There's a lot of support in the community on Dhe.

It's pretty versatile.

I can use it to be optimized for almost anything.

The main complaint that I would have is that a lot of its default things have become very clunky.

The one that I particularly dislike his system resolved D, which is the kind of default Deanna's resolver on of into systems.

I really dislike it.

I don't I just don't like the way it's set up.

I don't like the way that it manages D.

N s.

I don't really understand exactly what the paradigm was that they were trying to follow when they did it.

But I'm sure that it made sense for them.

I just don't particularly understand it, but I do really like I've been to in general, and I really appreciate the community that's around it, and I wholeheartedly supported.

So I actually generally use Evangeline IX.

Um, but I had used.

So I have another laptop that was given to me when I fixed that person's laptop on that laptop.

Dual boots a bin to destroy, actually in trouble.

It's a tool of its inability Destro, a Windows distribution and Callie distribution.

So I have to stop that.

Stop it.

Just stop.

Um, yeah, that is kind of what I use.

I actually use a Mac for, like, most work and things I use Lennox stuff for when I'm being a little bit more white hat factory.

But I really like my Mac.

Mac is also a unique space system, so it ends up being very similar in a lot of important ways.

Um, yeah.

So let's see.

Um, there's some other stuff going on in the chat.

I see.

I think I joke from Buck.

See, I just want to send a ping message and get a pong.

Answer is very funny.

You're wrong.

Answer might contain a remote shell I TMP shells or ICMP reversals.

A.

Really cool.

We won't be building one on this chat.

There will be other.

River Shell's already has a fuel, but well, there will be other things.

And so you're like, What's a river shell?

And we'll talk about that when we come on.

Ben, Fisker says, is commanding bash the same in Mac analytics.

Of most part there, Bash is a type of shell.

It is a particular shelter, the born again shell, and so that shell works.

I think, to my knowledge, it works almost exactly the same in Mac and Lennox Lennox sisters Mack.

There are some things underlying it that, like change implementation details, but I think otherwise it's pretty much the exact same.

I used National both.

I've also heard people really like seashell.

I've almost been Cannon convinced to switch to the show, but I have not yet.

There's another shell called Fish that I really like, but I haven't had the chance to, like, sit down and get like acquainted with its super Well, it just looks really eloquent and beautiful, so I might switch to it.

But for the most part, I like Bash.

I'm pretty familiar with the show, but I like basket most at the moment.

Savage been in a super love that name.

They start our test all sorts.

Cool, Beautiful.

Why not Devi and asks Igor Voltaic, right?

So let's see, um, I've been to is a Debian based system.

It's very somewhere.

It's more like they kind of work from each other.

But I don't use Debbie and myself just because I got acquainted with him into first.

I didn't get a lot of these systems at some point, they're all kind of the same.

If you can get them to work for what you need, then there's no reason to switch how you just said which Lennox history is best for you.

I think that is pretty much the same.

Answer right is like, If it works for what you want to do, then that's great.

Andi, think that the more you learn what you actually want to do, the more you realize what things have tools already built in and are just gonna be you probably Google.

I'm guessing, like, depending on your objectives and yeah, exactly.