The *nix-based operating systems all have their roots in Unix. Besides the various forms of Unix itself, this OS family includes Linux, Android, macOS (and its BSD-based predecessors), iPhone iOS, and others. Vulnerabilities for *nix-based operating systems have the following commonalities:

  • All of the generic risks apply, including physical, administrative, coding, and social engineering.
  • Although the *nix OSs have more kernel types than Windows, they are still written in some variant of the C programming language. They have the same inherent risks related to insufficient input validation and lack of bounds-checking.
  • Although the open source community (in theory) has "more eyes" vetting the software, incorporation of secure coding best practices is inconsistent among developers. For example, Apple iOS has a very strict application vetting process, requiring apps to be digitally signed with an Apple-supplied certificate before they can be installed. Linux and Android, on the other hand, allow apps to be side-loaded or installed without digital signatures.
  • The *nix-based OSs are also subject to cross-platform exploits including POODLE, Heartbleed, XSS, XSRF, SQL injection, and SMB overflows and enumeration.

As a pen tester, you will use the same methodologies with *nix OSes that you used with Windows to find vulnerabilities and exploits.

Note: Most Android apps are written in Java, and many userland (non-kernel) Linux components are written in Python.