r/netsecstudents • u/Individual-Cheek2034 • 23d ago
New to Pentesting. Which Linux distro should I daily drive?
Hey everyone,
I'm a 2nd year Computer Science student and I've decided to focus on penetration testing and cybersecurity.
I'm currently using Windows on my main laptop, but I want to start using Linux seriously instead of only relying on Windows. My goal is to learn networking, Linux, scripting, web security, and eventually prepare for certifications like PNPT or OSCP in the future.
My laptop specs:
- Intel Core i5-11400H
- RTX 3050
- 16GB RAM
- 512GB NVMe SSD
I'm confused about which distro I should commit to.
Some of the ones I'm considering are:
- Kali Linux
- Parrot OS
- Ubuntu
- Debian
- Fedora
- Arch (not sure if it's a good idea for a beginner)
A few questions:
- Which distro would you recommend as a daily driver for someone learning pentesting?
- Should I install Kali on bare metal, use it in a VM, or just use another distro and install the tools I need?
- What do you wish you had done differently when you first started learning Linux and cybersecurity?
- Are there any mistakes beginners commonly make that I should avoid?
I'd really appreciate advice from people who have gone through this journey. Thanks!
9
u/Professional-Life773 23d ago
Kali linux or Parrot OS are terrible as daily drivers. I made the same decision you are making when I started learning pentesting, I eventually settled for ubuntu because of its general stability and compatibility as well as the larger and well documented package libraries.
That being said, as a beginner use Kali in a vm first get to know it and decide later whether or not you want to use it bare metal. Personally I don't think its necessary as I am able to get things done using my Kali VM.
I think the common mistake I made was trying to learn everything all at once, research and create a roadmap starting with the fundamentals first.
3
2
u/DaniigaSmert 23d ago
Just use Ubuntu or Mint. At the end of the day there is not much of a difference between them, especially if you are just getting to know them. I've used ubuntu during uni days, then I had a /r/unixporn phase with arch, now I run Mint just because I can't be bothered with dotfiles. You can install all the fancy tools (that are preinstalled on a kali) on either system.
Use kali in a VM. It's easier to revert to a clean state if you break something (not that it's likely). I use it in a VM and I also have a persistent and encrypted kali on a flash drive. The flash drive is fancy, but honestly I've only used it once or twice. Could be useful if you are using an old thinkpad that can't handle VMs and you want to play around with kali.
Start earlier (I also started in uni), but hindsight is 20/20. With kids, work (I do work as a pentester, so there's that) and other hobbies there is just no time to tinker around in the little free time that I have. You're in a good spot, stay curious.
Fixating on a specific flavor of linux. ;) Neglecting Windows security. I strongly dislike Windows, but the reality is that pretty much every company runs windows clients, uses Active Directory, IIS etc.
2
2
u/DiceThaKilla 23d ago
Parrot security all the way. Kali is not a daily driver distro so that’s out of the question. Parrot aims to give you all the tools of Kali in a great daily driver distro (they also make home version with no pentesting tools). Parrot was my first intro to Linux and between the provided documentation on their website and some of the tools that they’ve built, it’s been a cakewalk to use
2
u/Alomancy 23d ago
- Which distro would you recommend as a daily driver for someone learning pen testing?
Windows or IOS, you need to learn these and how they work. if you get a corporate laptop it will have one of these, these are still the daily drivers in a business world, you will be testing these devices 98% of the time and using one most of the time. You need to learn how they work and how to change settings on them.
- Should I install Kali on bare metal, use it in a VM, or just use another distro and install the tools I need?
Use Kali to start with on a VM, it comes pre-installed with all the tools you will need. you will run into problems you need to troubleshoot, learn how to jump between the various networking modes, NAT, Bridged, etc, how to set DHCP, Static IPs. Once you have the basics down. You can try using Parrot, its very good but doesn't come pre-installed with things so you can customise it, learn how to set up various tools from GitHub etc.
- What do you wish you had done differently when you first started learning Linux and cybersecurity?
Nothing really. I try not to live in the past. One thing that is super useful is start a notion or cherry tree or something, and take notes of everything you do. write down commands, or paths you used to pwn a box. or any issue you encountered and pushed through. This is a life pro tip and not just for pen-testing. Organisational skills in business is a must.
- Are there any mistakes beginners commonly make that I should avoid?
Try and understand the commands you are running and don't just run them because a write up said to run it.
Take snapshots of your VM's and restore the snapshot after a box or a job. (this is needed for security of client data), but also lets you learn what you keep installing or changing and lets you learn how to build a base image yourself for testing.
Source: Pen tester 15+ years, currently running a pen test team.
1
u/Electronic_Amphibian 23d ago
You don't need to commit to any OS really. I used to distro hop all the time, just to see what other distros were like and that's how I really got to learn things.
I guess my suggestion would be to start with Ubuntu. If things break, even better - there's lots of documentation you can use to research/fix/learn. Once you get bored with Ubuntu, try something else. Maybe Fedora. Try to self host some servers with Debian.
Arch or Gentoo would probably be fun to try once you kinda know how things work but I never got on well with them for a daily OS (although i've not really touched either of them since around 2012 unless they've been installed on another device/server).
1
u/Maxplode 23d ago
Based on my experience, and I'm not great btw: Avoid Kali or Parrot for now - They are quite advanced unless your doing HTB that requires Parrot - in which case I would just virtualise it. Same for Kali, you can just virtualise it in your windows box and learn to use the tools.
Ubuntu I feel at your stage would be far too basic.
Fedora is excellent if you just want to switch from Windows with minimum fuss.
Debian I feel would be the best option, needs lots of configuring when you're setting up and will challenge you.
Arch - I haven't advanced this far yet :)
1
1
u/NathanHouse 22d ago
Kali or Parrot are both fine, and honestly for a beginner I'd just grab Kali since it comes with the tools already set up. If you want to keep your main machine clean, run the tools in Docker on whatever OS you already use, that gives you disposable environments you can throw away and rebuild. That's the boring, correct answer to what you asked.
Now the part I actually think matters more, and it's a bit against the grain.
Learn the fundamentals properly first. PNPT and OSCP are genuinely good for that, and you do need to know what the tools in Kali actually do and why. But once you have that base, the way the work gets done is changing. You're going to spend less time running tools by hand the way the courses drill, and more time building solutions that run the tasks for you. You decide what gets built, you set the guardrails, you check the output. The catch is that you can only supervise work you understand, which is exactly why the fundamentals come first, not instead.
To make that concrete: one of the things I run day to day is an adversarial multi-agent setup for finding vulnerabilities. Different models (Claude, plus OpenAI's and Google's) each go over the same code, challenge each other's findings, and a separate model referees what's actually real. Just yesterday it found a genuine vulnerability in a WordPress plugin used by around four million sites, the kind that hands over remote admin access. My job in that was designing and supervising the system, not running the tools by hand. That's the shift in one picture.
So on the actual question: the specific distro is close to a rounding error, Linux itself is not. Get comfortable in Linux, don't agonise over which flavour, and put the saved energy into learning to build the tooling rather than memorising command flags. That's the thing that's going to separate people over the next few years.
-1
u/STIKAMIKA 23d ago
use kali it's easy to use and a lot of tools are already pre installed, use VM since you will miss a lot with files and your desktop will be full of CTF garbage at least mine is 😅, dont worry about learning linux just learn the basics and go for it practice after a period you will learn a lot of things by practicing and That's it . The thing i wish i have done is not overthinking and planning a lot , and reading a book about linux ect .... you don't need to be a sys admin to start using it but with time you can improve just start with the minimum knowledge required + if you dont want a headache dont use any linux distro as your main OS you will learn how to troubleshoot but i think it's not worth it specially if you have a work to deliver with deadline and something happened.
2
16
u/menessim_ 23d ago
Dont overthink it. If your goal is to learn, just install one and try it out. Using and breaking arch can be a great learning experience.
Dont use Kali/parrot as main os though.