Operating Systems: specialized (27)

Ubuntu MATE-based VM for Android app assessment, reverse engineering, and malware analysis

BlackArch

Arch Linux-based distribution with one of the largest pentest tool repositories

Automated malware sandbox for dynamic analysis and config/payload extraction

Cuckoo3

CERT-EE's Python 3 rewrite of Cuckoo Sandbox for automated malware analysis

Debian-based distribution focused on web and cloud penetration testing

SANS Internet Storm Center's honeypot sensor for contributing threat data, with an ELK dashboard

FACT

Fraunhofer FKIE's firmware analysis and comparison platform for routers, IoT, and UEFI images

FLARE VM

Windows-based reverse-engineering and malware-analysis distribution

HackerOS (Cybersecurity Edition)

Polish Debian-based distro with a dedicated red-team-focused Cybersecurity Edition

Kali Purple

Kali Linux's defensive/purple-team security operations platform

Linux Kodachi

Debian-based privacy and anonymity platform

Malcolm

CISA/Idaho National Laboratory network traffic analysis tool suite

MISP

Open-source threat intelligence and sharing platform, with an official test VM

Mobexler

Linux Lite-based VM for combined Android and iOS application penetration testing

Fedora-based network security monitoring and analysis toolkit

Debian-based encrypted live-USB OS for secure communication and anonymous browsing

Qubes OS

Security-by-compartmentalization OS built on the Xen hypervisor

REMnux

Ubuntu-based toolkit for reverse-engineering and analyzing malicious software

OWASP-maintained web-app pentest training environment

Security Onion

Ubuntu-based network security monitoring and threat hunting platform

SigintOS

Ubuntu-based distro for SDR-driven signals intelligence operations

T-Pot

All-in-one multi-honeypot platform with 20+ honeypots and Elastic Stack visualization

Tails

Amnesic live OS focused on privacy and anonymity, routing all traffic through Tor

TheHive

Incident-response case management platform with an official demo VM

Trace Labs OSINT VM

Debian-based virtual machine purpose-built for OSINT investigations

Wazuh

Open-source SIEM/XDR platform distributed as an official VM appliance

Whonix

Debian-based anonymity platform routing traffic through Tor