HackerOne vs. Kali Linux

It is one of the good platforms for security researchers to submit bugs and other vulnerabilities, it however, has some challenges, in terms of un-verified and duplicate submissions.

Incentivized

Kali is quite honestly appropriate for use on a Test Lab, a Virtual Machine, it will even run on a Raspberry Pi. It is the most popular tool used in most all training courses. It can be uses in home labs, work labs and production environments to perform real life scans for vulnerabilities among other things. It is the most popular tool for Cybersecurity tool.

Incentivized

• Filter for spammy bug reports
• Nice central interface
• Payment/reward system is nice

Incentivized

• Provides high security.
• Does great job with penetration testing.
• Has good number of testing tools with in.

Incentivized

• A lot of duplicate bugs get reported, although it does offer automatic suggestion of previously reported bugs that may be duplicates, it is far from perfect.
• Anyone can report bugs, a lot of them are not verified before submission. This sometimes leads to a lot of time spent in verifying if the bug is really actionable.
• Each submission has to be treated with equal potential, a lot of time, some time gets invested in vulnerabilities that aren't as important as some others.

Incentivized

• Usage wise, it is tough for use by beginners. Can be improved.
• With Kali Linux have noticed driver related issues especially with Nvidia graphics cards.
• Kali Linux can be improved for use as a day to day OS.

Incentivized

These were very close and we liked HackerOne better. For a time we did have both and we felt the need to consolidate the information into one platform and end of life our internal offering. Overall we've been fairly happy with HackerOne.

Incentivized

The hard feature to be beat Kali with is the amount of preinstalled tools. I.e. Ubuntu is great but you would have to install each and every tool separately

Incentivized

• Bugs that can't be tracked internally are submitted by external researchers, which is an important factor for security vulnerabilities.
• Even if the bugs reported are duplicates, there still is provision to award reputation points, that keep the researchers engaged.
• It also requires a lot of verification and validation, as a lot of the submissions are unverified to begin with.

Incentivized

• Till now Kali Linux have not made a single penny negative impact on our companies business , its so powerful and useful at the same time for our company.

Incentivized