Operating Systems

3 min readArticle

Understanding operating systems is fundamental to security work. Every attack surface, every tool, and every defense is OS-dependent. You need to be comfortable moving between Linux, Windows, and macOS.

Major Families

OS Family	Primary Use in Security	Notes
Linux	Offensive tools, servers, OSINT	Kali, Ubuntu, Parrot — home of most security tools
Windows	Enterprise environments, Active Directory	The target in most enterprise engagements
macOS	Developer workstations, management	Common in tech companies; iOS shares core
Android/iOS	Mobile pentesting	Frida, drozer, MobSF
Embedded/IoT	IoT attacks, firmware analysis	Linux-based usually; custom RTOS

Linux for Security

Linux is the security professional's OS. Kali Linux is the standard distribution for pentesting.

bash

# Essential Linux knowledge
man <command>         # Manual pages
--help               # Built-in help
ls, cd, cp, mv, rm   # File operations
chmod, chown         # Permissions
ps, kill, top, htop  # Process management
netstat, ss, ip      # Network
systemctl            # Service management
apt / yum / pacman   # Package managers

Key Distributions

Distro	Use Case
Kali Linux	Penetration testing, comes with 600+ security tools
Parrot OS	Pentesting, lighter than Kali
Ubuntu/Debian	Servers, general use, base for many things
BlackArch	Extreme security focus, Arch-based
Tails	Privacy, anonymous operation
Whonix	Privacy via Tor

bash

# Kali on various platforms:
# Bare metal, VM (VMware/VirtualBox), WSL2, Raspberry Pi, Docker, live USB

# Quick Kali setup
sudo apt update && sudo apt upgrade -y
sudo apt install kali-linux-everything   # Install all tools

Windows for Security

Windows is the dominant enterprise OS. Most pentesting targets are Windows. Need to know:

Active Directory
Windows file system and registry
PowerShell
Windows event logs (Security, System, Application)
Common services: SMB, RDP, WinRM, DNS, DHCP

powershell

# Windows security essentials
whoami /all                    # Current user + privileges
net user; net localgroup       # Users and groups
Get-Process                    # Running processes
Get-Service                    # Services
Get-EventLog -LogName Security # Event logs
netstat -an                    # Network connections

See windows-os/windows-server for server-specific notes.

macOS for Security

macOS is UNIX under the hood (Darwin/BSD). Security tools mostly work the same as Linux. Key difference:

/etc equivalent is still /etc
Homebrew for package management
SIP (System Integrity Protection) limits some attack techniques
Gatekeeper, XProtect, AMFI — Apple's security layers
Apple Silicon (M1/M2/M3) — ARM architecture, some tools need Rosetta 2

bash

# macOS security tools
brew install nmap wireshark sqlmap
/System/Library/CoreServices/Applications/Directory Utility.app  # User management
sudo dscl . list /Users        # List users

Raspberry Pi

See raspberry-pi-guide for the Pi as a security platform.

Virtualization for Security Labs

Always do offensive security work in VMs:

Kali Linux in VMware Fusion/Workstation
Snapshots before every test
Host-only network for isolated labs

shell

Lab Architecture:
VMware
  ├── Kali Linux (attacker)
  ├── Metasploitable 2 (vulnerable target)
  ├── Windows Server 2019 (AD lab)
  └── Windows 10 (workstation target)

Network: Host-only (isolated, no internet for targets)

Sub-pages

raspberry-pi-guide — Raspberry Pi setup and security use
windows-os/windows-server — Windows Server
windows-os/exchange-server/index — Exchange Server

techzonesite.comUnlock Your IT Potential