Hi.
Welcome back to the official third Cup series.
We're going to talk about package management and other repositories.
So package management essentials for the Kali Linux operating system.
And useful things that can will help you better optimize your.
Penetration, testing, distribution.
So this is the outline.
So we're going to look at the Debian package management tools or the D package which stands for the
DBM package manager and also the HPT.
One of the essential qualities of Kali Linux is its adaptability of packages, which.
Makes installation, upgrading and removal process very easy.
It's important to understand how.
To take advantage of these so you can streamline your operations.
If you're working for a Linux for a long time.
You'll understand the difficulty in many cases of compiling programs from source code.
Because compilers take so much time and debugging and making changes.
It can be very stressful even to run only a few tools.
So the Kali package management system as well as the repositories, make it easier on you to stay up
to date on the latest and greatest tools without having to compile them by hand.
This is our chapter flow.
So we're going to look at packages, we're going to look at AAPT, we'll look at AAPT and be packaged
together.
We'll talk about the sources list file and what needs to go in there and what some optional things that
might go on there as well.
We're going to look at the package log file and as well as the synaptic package manager.
So let's do a brief introduction to packages and AAPT.
So of course it's flexible to upgrade packages, software or move software and even the OS itself.
So we've got to take some.
Hat tips to the Debian operating system.
Of which Kelly Lennox is based on a binary package, which is a dot Debbie file or a Debian package
contains the files that can be directly used while a source package contains source code.
So if you have a dot db file, you have.
A prepackaged program.
If you just have some executable code, then you have to actually compile it in order to be able to
make it executable, in order to be able to run it.
So b d package is built to be able to process and install dot DB packages.
But if there's an unsatisfied dependency, usually the package will list the missing dependency and
let you install that manually so you can be able to install the file.
So the daemon package contains all the applications, documents and any other metadata, including application
dependencies and the contents that help.
You'd be better able to manage the packages, particularly the lifestyle life cycle.
So the app stands for the Advanced Package Tool.
Now we're going to go ahead and look at.
The main page for that.
Let's go over to our colleague Linux Distribution and let's look at the AP.
So.
Again, this is the high level command line interface.
You have the update command, the upgrade command.
You can do a full upgrade.
You can install, remove, purge, you can auto remove packages that are out of date.
You can even show.
The APT Cash app or the advanced package tool can.
Let you install applications, remove applications, and even upgrade your whole system.
The package installs a package locally or located on your system and does not automatically resolve
dependencies.
So that's the main difference between the package and APD.
So apt risk retrieves its packages from a repository, a package storage system, or more importantly,
the FC apt sources list file.
So there are some capability with being able to edit the sources doubtless file more, but you're better
off going to the file itself.
So let's go do an apt dash get update.
I notice it's going out to the Cally repositories and it's pulling down some information again.
This is a new install of a virtual machine.
So even with only a short amount of time, there are updates.
So you can see how frequently updates do come along.
So let's go ahead and clear the screen.
Let's go ahead and apt get auto remove.
So we'll get rid of any obsolete packages.
So no packages there.
Let's do an apt get upgrade, see if there are any upgrades and yes, there are upgrades that need to
be done.
So let's go ahead and do that.
While that's going in the background, we'll go ahead and open up a new tab.
Let's go ahead and.
Edit I'm going to use G at it because it's a little bit easier to see in my view and work with, especially
for live demos, sources lists.
The G added is not installed by default.
I want to go ahead and go grab that as well.
Of course, we have to wait on the the update here now.
So we'll go ahead and use them.
So this is the sources list file which contains the Acdp Collen Cowley Dawgs Cowley Cowley Rolling Main
non-free contrib repository.
And it gives you some comments, things that you might want to.
Enable later.
To add other functionality or if you need maybe source code, for example, but generally you're only
going to have the one entry on the standard clean install of quality.
But if you want the source code, you can go ahead and go to this line and you can uncomment it.
And now you'll get the latest source code.
If that's something that you require these source packages.
I'm going to go had an escape.
I'm going to write this file.
And then once you update your sources, doubtless file, you want to go ahead and do an app diskette
update because you may have new updates that come out with it.
So notice we got a change here to open S-H.
And that's fine.
It'll usually let you know what changes there are so you can read the updates or you can just hit queue
to quit.
Notice it's telling you every step that it's doing, it's pulling down the dot db files or the binary
packages and it's going ahead and unpacking them for you.
Just imagine if you had to do this by hand yourself.
It's also running some shell scripts of the dot stage extension that's unpacking a few more libraries.
Let's go ahead and clear the screen and I'm going to go ahead and zoom in.
So see a little better.
Right.
For.
All right.
Now that our installs are completed, we went ahead and ran the auto remove tool.
One package.
So now we've updated.
To our latest version,
we can see we're on a rolling update 20 20.2 that's using the LSB underscore release Dash eight command.
And let's go ahead and get back into the lecture.
So.
Again, the main calendar repository contains.
Packages that don't that fully comply with the Debian free software guidelines.
So if there's non-free, that means it's not going to always be free.
So essentially they can be distributed, but they don't always conform to the package guidelines.
There's also some that are contrib, which just short for contributions.
These are open source that cannot function without some non-free elements.
So the other calling repositories, you have the COLLATE rolling repository, which is your primary
repository for your end user type or your end client.
Installation packages.
So they can be overseen by.
Proper testing, making sure that each package can be fulfilled and bundles should work without any
bugs.
So of course there's testing.
Each day called a rolling repository will also get updated as well.
So then there's the county dev repository.
So this is not open for utilization.
That's essentially where engineers try to make things work and they test out different things.
New packages arrive.
And so if you require a refresh and maybe it's not been into the.
The Cali rolling repository.
You might be able to get it from this particular location, but it's not best practice for regular use.
Then of course, there's the bleeding edge repository.
If you want to be on the latest and greatest, the bleeding edge of everything, you want to be on the
top of the line.
Repository.
The latest version built directly out of the get or subversion code repositories.
That's the bleeding edge.
So you can enroll in this bleeding edge either by editing the sources list file, or you can make another
record under the sources list directory.
So additionally, there's the Kali Linux mirrors repository.
So this is essentially a server running mirror brain to which to redirect your request to a mirror that's
closest to you so you get a better performance, a better download.
And this is the guidance from the Kelly developers offensive security.
So again, as we spoke about, the clean version will only have the one entry.
So if you want to verify, you can issue this command and make sure you have the correct.
Repositories enable.
So if you don't have the exact output there, you may not be able to install new updates.
Maybe you did an offline install for some reason.
Maybe you switched to Branch.
Then there are some other regular repositories that you want to make sure that, you know, whatever
the best option for you, that maybe sometimes you need a certain tool that requires you to add this
repository.
And there are some other offline installs as well.
There's even some non-call repositories.
And the list of the official calling mayors is located here.
You can actually set up your own, but this is essentially if you wanted to run a private mirror.
There is documentation to do that on the.
Offensive security website.
Now let's look at how we work with APTs or the advanced package tool.
So it's a big project and the original plans for it had a graphical interface, but essentially it's
centered around the command line.
Interface.
And when you're working with AAPT, you should first make sure that you have the latest update using
an apt dash get update or an app update.
So depending on the size of your internet connection, you may have different performance.
Metrics.
So we can also install with D package.
So for doing this, you can download a binary direct directly.
A great example of this is for a good number of years the Chrome browser was not able to be installed
on.
Kelly one s per se.
So you can install the chromium browser, which is what it's based on.
But if you want it to install Chrome, let's go ahead and open up so that we have the web browser we
do have.
Several different options, of course.
Let's go ahead and download chromium.
If you wanted to get the official Google Chrome from Google, you could actually download it in a DBM
package format.
So we'll go ahead and demonstrate installing that.
So if you're on the latest version of.
Kelly.
Let's see.
Let's do this.
Just go to Google Chrome Download and we'll click on the download button.
And we say download and it's going to give us the option either for an RPM file, which is more for
fedora.
And so you say, of course, I've got to enter the password because it is installing a file, so I'm
going to accept.
And I'm going to keep that.
It will actually try to say that it could be harmful.
But notice we have this Debian.
Package right here.
This is we're going to install this outside of the normal app tool.
So let's go to our downloads directory.
Let's see.
So there's our Google Chrome stable so whether it be packaged dash, I know we're gonna do the full
file name and it's going to go and read the database and it's going to unpack it and prepare to install
it.
And so just like that, that was fairly quick.
So let's go ahead and do let's go ahead and open it up.
Actually, that may not be the command to run it again.
Sometimes things change.
So just know that your process may vary.
If you're doing this sometime in the future and there's Google Chrome now as an option.
If we want to make it the default browser, that's fine.
But that was an example of installing something with the package command.
So if you want to do APC, let's say I want to get the Kauri Olympics.
GP Let's go ahead and open up our terminal again.
We have a couple of these already open.
Need to go ahead and close them down.
So the package is in the repository of AAPT.
It will find it in this case.
This one may have been moved to another repository or it just may not be there at all.
Let's do an ABS stash.
Get install.
Of course, if you do try to do a command that's already there or a package that's already there.
And I'll tell you that this is already the newest version.
And there you go.
So we go back to our user mode because it's never good to stay logged in as read all the time because
that just presents an opportunity for attackers to get into our system.
So again, notice in the screenshot here, this will it'll show you the package and then it'll go out
and then it'll look for some new new packages if it can find them.
So you want to upgrade, call 11 X like you saw there.
You want to do apt update followed by apt upgrade or apt get upgrade.
So if you wanted to do these together, you could do apt get update and put to ampersand.
And we're already going to be at the latest version.
Of course, it's going to ask me for the pseudo password.
And this ensures that we're up to date at the latest.
Let's see that I.
Let's try that again.
I may have just mistyped the password.
Remember, Linux is case sensitive, so if you make a mistake, just fix it and move on.
And the good thing about it is generally it will tell you, but if you're typing in the wrong case or
you're missing a character, you type your password wrong.
You may not be able to see it.
And so the following packages have been kept back.
That's fine.
Some packages were not upgraded.
Go ahead and so apt get clean.
We're going to go out and clean out the repository that's going to do a little bit of update for us.
So you can actually do the walk that desk out with a Y in front of it and I'll go ahead and bypass that
whole like, do you want to do this command?
So that's another little trick if you want to if you know what you're installing and you want to maybe
script it out or you want to bypass the that process.
So the dash get command line tool will be a little more demanding than aptitude or app because it will
refuse to install packages that were not installed beforehand.
So you might want to tell AAPT to use a specific distribution.
So when you're searching for certain packages, so you might have to put a dash T or a dash dash target
release in front of it.
So it is possible.
Also, if you package or not install, you can do a force with the package to force it to install.
Sometimes that might.
So you have to do a dash f.
But app desk and app install pretty much do similar things.
You can also use AP combined with DX package.
And once you're done, if you want to remove a package, you can use the DX package.
Dash.
Remove command.
You can also install multiple packages together.
You can do apt will install and then the names of the packages if you know what they are.
So let's do an example of that real quick.
So let's say we want to go ahead and install a couple of different packages at once.
Let's do an app dash get.
And so I'm going to install Rider Ray, which is a reverse engineering tool.
And also going to install E3, which is a graphical monitoring tool.
And it looks like we were able to type in to it once it had a couple of extra dependencies that it found.
So we'll let that go ahead and run and we'll take a moment.
And those we were able to install one package right after the other.
So there's one other command that's interesting if you want to get all of the elements, tools and the
repository, because Cal is designed to be kind of lightweight too, you don't necessarily want all
the tools at once, but in case you do, there's this command the app to get install Kelly Dash Linux.
Nash.
So sometimes old commands that used to work don't always work, so don't get panicked if things don't
always work for you.
There's a couple little fun programs that have nothing to do with the packages, but I always like to
give students an option.
There's the steam locomotive.
And if you're.
You use the typing in command ls for list file structure.
Right.
So to list your photos, well some people type it backwards and there's the little steam locomotive
that but for some reason on newer versions of calling it doesn't work.
But this will work on just about any Debian based version of Linux so you can make the steam locomotive
do different things.
And it hasn't been updated in a while, but it is a lot of fun.
It's more of an Easter egg from the command line.
But again, you should be able to have fun with the command line while you're doing this as well.
So other things you can do, maybe you want to remove a particular package, so you decide that now
you don't want that package there.
So we're going to go ahead and get rid of it.
So we're going to get rid of the steam locomotive and we have to run this route.
And the steam locomotive is gone.
Still say no manual entry for steam locomotive ever can't find it.
They may not actually tell you that it's not there.
You can also remove packages much the same way you install them if you do abt dash purge.
You can also remove all the data that might have been with the packages.
So Zain stalled.
So let's.
As install another program
as the Easter egg program to but.
Called Fortune or actually install your they'll tell you your fortune.
So.
So, again, if we want to get rid of this Fortune program,
you have to be root for it.
So there was no extra data from it.
So people.
You can also do it with the package as well.
Of course we have to be rude.
And it just purged all the files for.
So there you go.
Hope that was useful.
We can also do some other things.
We can query the database of available packages and look for specific packages by name.
So let's say we want to look for.
Forget the dash.
So app dash, cash search our spoof and it will give us the various packages that are related to it.
This information gets gathered from the sources doubtless file.
And we can also search based on keywords as well.
There's all the map tools.
And there's all those python tools on the screen.
So, again, a lot of functionality there.
What about the B packaged dash log file?
So this keeps the log of all the actions in the var logged package dash along.
So every time a package gets installed, you can go here and we'll just carry it out.
And these are all the different packages that have been installed.
So it can get very verbose.
But it's useful to find out if there's a ever a problem with a package or a system, and you can see
what's been installed.
And this will definitely help you.
And your troubleshooting as well.
We can also use the Taylor command, which will give you the last entries.
So we haven't talked about tail yet.
Till will output the last part of the file as the last ten lines.
You can actually tell it how many lines you want it to output.
So let's do var slash log de package, dot log.
And instead of getting the whole log, we just get the last ten lines.
So we'll tell.
You could do a lot of things as well.
It's a useful command to have at your disposal.
So we can also do apt reinstall.
So if you mistakenly damage your system, you can use a reinstall.
For a particular package if you need to do a full upgrade or the fourth option and there's a broken
dependency, like if you're getting a problem with something updating and not being consistent, you
can do the app dash get dash f upgrade app that gets.
And this will force the upgrade.
So now I have some packages that are no longer needed.
Uh.
Let's see.
Oh.
I quite incorrectly.
So you want to make sure you do the optimum command on a regular basis so you'll keep your system in
a good, consistent state.
All right.
So let's now look at.
Synaptic.
So Synaptic is a graphical package manager.
So if you don't want to do this from the command line, you can use synaptic.
Of course it will not be installed by default on Kali Linux 2020 if you don't choose the genome installation.
So you'll have to do a pseudo app to get install synaptic and I've already got it installed.
And we'll go over to the.
Search bar and we can see Synaptic Package Manager.
I probably have the name wrong, but you have to authenticate with the pseudo credentials and you can
see it's a graphical user interface that says the software honor system is organized in so-called packages.
The package manager enables you to install, upgrade or remove.
You should reload it regularly, otherwise you might miss important security updates.
So let's go ahead and reload and it's going to go download new information is there's 56,000, there
was 56,000.
Now there's the same three 6708 packages and 2222 of them are installed.
So you can actually go here and click on different packages if you want.
You can sort by category, sort by origin from the Kelly dot org repository.
If you wanted to install something like VirtualBox.
That is, these are already they already have a checkmark that means they're already installed.
Once you make some selections.
Mark for installation.
So this is essentially you hit the apply button and that's going to go and tell you what's going to
be installed.
Give me a little summary.
So 41 packages are going to be held back and not upgraded.
And you'll watch it go through an upgrade.
So there are lots of filters, lots of things you can do.
You can see in the obsolete packages, things that become out of date.
You can look at by architecture, and you can also just search by search string.
And at the top the menu is pretty robust as well.
So you can set different preferences, you can add repositories, you can pick whether you want the
toolbar to be there.
You can have it even fix broken packages.
So there's any broken packages.
It'll go out and it will fix that as well.
And it keeps a running history of all the packages that were installed.
So a very useful program.
In summer.
We talked about binary packages.
We talked about DBM packages.
What they actually are the way to install both binary packages as well as standalone DBM based packages.
We looked at the advanced package tool IPT on how to install and or move applications update packages.
We looked at the concept of a source package being source code versus an actual binary.
We looked at the sources dot list file to be able to configure different Kali Linux repositories.
We also looked at.
The different repositories like the rolling, the dev repository, the bleeding edge, if you want to
be on the latest and greatest.
We looked at D package dash or the debian package manager.
If you want to be able to remove packages or install packages or even just run queries to find out what
packages are installed.
We looked at the Debian package log file and we also looked at synaptic package manager.
So now we'll get into our practice questions.
So a two fold binary package by law contains records that can straightforwardly be utilized.
Is called a what file?
A dot db file, a dot z file.
A dot AP file or an MP for.
The answer is, of course, a Debian package file.
Then we have.
Question two What is a T stand for?
The Advanced Package tool, the advanced port map tool kit.
Automatic Package Management Tool.
Or the advanced packet tracer.
The answer is a the advanced package tool AAPT.
Not to be confused with advanced persistent threat, which is a different type of discussion altogether.
You may have question three.
These are the three types of quality repositories, a main security and update.
The main contrib and non-free.
Or c contrib security and free and then d update security or non-free.
The answer is B main control and non-free are the main packages.
Are the main repositories, I should say.
So definitely want to know those.
And that's going to help you a lot, especially if you're trying to get source code versus getting being
on the bleeding edge of Kelly Wallace.
Let's look at number four, which Kelly Repository contains only installable and recent packages.
Kelly made.
Rolling.
Kelly Dove or Kelly bleeding edge.
The answer is B, the Kelly ruling.
So these are the rolling updates or the rolling INSTALLABLE and racing packages.
So practice.
Question number five Which repository of quality is not for public use?
Kelly Rowing.
Kelly Main.
Kelly Dove.
And then, Kelly, a bleeding edge.
The answer is C Kali Dev.
Kali dev is the development or testing ground for Kali repositories and not generally recommended to
be for public consumption of packages.
So in summary, we talked about the different ways to manage packages on K-1.
Next, we talked about the advanced packages to the baby and package manager.
We looked at the different Kali repositories, we looked at the DD package log file, but also looked
at Synaptic Package Manager and a few other commands along the way.
Appreciate your attention in this module and we'll see you in the next lecture.