Choose pentesting tools by the question you need to answer, the evidence they can produce and the effects they may have. Start with a small setup you can explain and recover, then add a specialist tool when the authorized task requires it.
This documentation-based selection guide contains 49 distinct options, including an operating environment, software families and a hardware platform. They are not interchangeable products or a performance ranking. The earlier 50-entry list repeated Burp Suite; it now appears once. Sources checked: October 16, 2026. No comparative benchmark or personal engagement experience is claimed.
Define the task before choosing the tool
Record the systems, permitted actions, test period, resource limits, data handling and stop conditions. Check the project’s official documentation, compatibility and licensing for the exact release and edition. Source links in the tables lead to project or vendor material; availability does not imply permission to run a tool against a particular system.
For a web exercise, a proxy and a reproducible request record may be sufficient to investigate one behavior. For a cloud review, inventory and the visibility of the collection identity may come first. Choose a program because it resolves that question. The essential Kali tool workflows explain session, scan, proxy and privilege-evidence limits in more detail.
Build a usable baseline
A practical starting setup needs an environment, discovery, web inspection when relevant, traffic analysis when needed and a record of the work. Burp Suite and ZAP appear in the web section below. Choose one proxy initially; installing both is useful only when a specific requirement justifies it.
| Option | Use and selection check |
|---|---|
| Kali Linux | A security-focused operating environment. Verify the image, guest compatibility, update plan and recovery path. |
| Nmap | Discover selected hosts, ports and services. Record transport and coverage; an open port is not a vulnerability. |
| Wireshark | Inspect captured traffic. Visibility depends on capture position; encrypted application content may remain unavailable. |
| Obsidian | Organize notes and evidence references. Review storage, synchronization, access and backup arrangements for assessment data. |
Discover candidate assets
Asset candidates need attribution. A domain name or indexed service may belong to a supplier, shared host or former owner. Record the source and date, then compare against the authorized inventory before any direct requests. ProjectDiscovery’s httpx is distinct from the Python HTTPX library.
| Option | Use and selection check |
|---|---|
| Amass | Map external assets and relationships. Check collection mode and confirm ownership before active testing. |
| Subfinder | Gather subdomain candidates from passive sources. Source coverage and API access affect results. |
| httpx | Probe HTTP services and metadata. No HTTP response does not establish that the underlying host is offline. |
| theHarvester | Collect public-source information such as domains and email addresses. Verify provenance, age and permitted use. |
| Shodan | Research indexed internet-facing service observations. Check timestamps and ownership; a search result grants no testing permission. |
Discover services and triage scanner results
Agree on hosts, transport, ports, rates, scan credentials and stop conditions. Preserve the policy and feed or template version. A scanner match needs review of the request, response and affected configuration; a clean result describes tested coverage, not the absence of every weakness.
| Option | Use and selection check |
|---|---|
| Masscan | Perform broad port discovery when scope requires it. Bound targets and rate; validate important results separately. |
| Nuclei | Run selected template-based checks. Review template behavior, requests and version before using a match as evidence. |
| Nessus | Run vulnerability assessment workflows. Check edition, scan policy, credentials, plugin coverage and applicable licensing. |
| Greenbone / OpenVAS | Use the Greenbone assessment ecosystem, including the OpenVAS scanner. Record feed status, scan configuration and authentication. |
| netcat family: Ncat | Test selected network connections and data transfer. Ncat is one implementation; flags differ between netcat variants. |
Inspect and test web applications
Capture an ordinary request and response before altering one variable. Verify the account context and destination of redirects. Replaying an operation can change state. The project now uses ZAP rather than OWASP ZAP; check the installed release and selected workflow.
| Option | Use and selection check |
|---|---|
| Burp Suite | Inspect and replay HTTP traffic. Match features to the edition; review target scope, redirects and state-changing requests. |
| ZAP | Proxy web traffic and run selected testing workflows. Separate passive observation from approved active scanning. |
| ffuf | Discover candidate paths and inputs. Establish a baseline; response filters can hide useful results. |
| Gobuster | Enumerate paths, DNS names or virtual hosts using the chosen mode. Bound inputs, request rate and target. |
| sqlmap | Automate selected SQL injection tests. Review requests and impact; extraction or operating-system actions require separate scope. |
Assess internal services and identity relationships
Keep relationship collection separate from attempting a path. Confirm the identity, protocol and resource involved in each access claim. Establish account lockout limits before authentication tests. Responder is not merely passive inventory software: review poisoning and rogue-service behavior before enabling it.
| Option | Use and selection check |
|---|---|
| BloodHound | Analyze collected identity relationships and attack paths. Collection scope and data freshness limit the graph. |
| Impacket | Use protocol libraries and example programs for Windows network testing. Review the specific program and authentication context. |
| NetExec | Automate network-service assessment tasks. Limit hosts and credential attempts; accepted authentication does not establish administrator rights. |
| Responder | Test specified name-resolution and authentication exposure. Poisoning and rogue-service behavior can affect other systems. |
| enum4linux-ng | Enumerate Windows and Samba information with structured exports. Results depend on accessible services and the tested identity. |
Review passwords and credential exposure
Offline hash testing and online login attempts have different effects. Define authorized inputs, retention, attempt limits and handling of recovered values. Wordlist generation and a plausible pattern do not establish that a password will be recovered within any particular time.
| Option | Use and selection check |
|---|---|
| Hashcat | Test authorized hashes offline. Record hash format, candidate strategy, actual coverage and stopping point. |
| John the Ripper | Audit password hashes using supported formats and methods. Check the selected build and format support. |
| CeWL | Build wordlists from authorized web content. Crawling generates requests; control destinations and handle collected information carefully. |
| Crunch | Generate candidate wordlists from specified character sets or patterns. Estimate output size before generating a large list. |
| Kerbrute | Perform selected Kerberos account and authentication tests. Review the mode, account lockout policy and attempt budget. |
Validate impact with a defined stopping point
Before validation, identify the smallest approved action that demonstrates the specific impact. Record the execution context, changes, test artifacts and cleanup responsibility. Research matches, generated payloads and working tunnels are different results; none alone proves successful exploitation of the target.
| Option | Use and selection check |
|---|---|
| Metasploit Framework | Use selected assessment modules. Review prerequisites, module behavior, possible side effects and cleanup. |
| SearchSploit | Search a local Exploit Database collection. A matching product name is a research lead, not a verified exploit. |
| msfvenom | Generate payload artifacts for a defined exercise. It belongs to Metasploit; artifacts require controlled handling. |
| Sliver | Support adversary-emulation exercises. Establish approved infrastructure, endpoint actions and cleanup before deployment. |
| chisel | Tunnel selected connections. Review endpoint authentication, bind addresses, permitted destinations and application routing. |
Review cloud and container configuration
Prowler supports multiple providers, rather than AWS alone. Specify accounts, subscriptions, projects, regions and collection identity for cloud checks. Record permission failures as coverage gaps. For Kubernetes, benchmark checks, artifact inspection and network probing answer different questions; none substitutes for the others.
| Option | Use and selection check |
|---|---|
| Prowler | Assess supported cloud and other providers. Select the provider, identity and account or project scope explicitly. |
| ScoutSuite | Audit supported cloud environments. Record the credential permissions and resources actually visible to collection. |
| Trivy | Inspect supported artifacts for vulnerability and configuration findings. Record artifact identity, scanner options and database status. |
| kube-bench | Check Kubernetes configuration against supported CIS benchmarks. Match benchmark and deployment; passing checks is not complete security assurance. |
| kube-hunter | Probe Kubernetes security weaknesses. Its optional active hunting can change cluster state; review tests and approval first. |
Plan wireless and RFID work separately
Plan the capture or transmit mode, equipment, physical boundary and data handling before radio work. Nearby devices can fall outside the permitted exercise even when they are visible. Review applicable requirements with the responsible organization; written permission alone does not settle every radio or privacy obligation.
| Option | Use and selection check |
|---|---|
| Aircrack-ng | Use selected Wi-Fi assessment components. Capture, injection and password testing have different effects and hardware requirements. |
| Kismet | Collect and analyze supported wireless observations. Record datasource, channel coverage and collection boundary. |
| hcxdumptool | Capture Wi-Fi material with supported hardware. Review mode and transmit behavior; do not assume passive-only operation. |
| Bettercap | Perform selected network and wireless assessment tasks. Inspect enabled modules before running interception or disruptive actions. |
| Proxmark3 | Use compatible hardware and software for RFID research. Match firmware and supported tag technology to the exercise. |
Keep reporting, notes and code checks distinct
Reporting platforms, note applications and source analyzers serve different roles. Keep the original evidence with timestamps and tool configuration. Verify source-code and secret-detector matches before reporting impact; restrict access to collected secrets and follow the agreed remediation process.
| Option | Use and selection check |
|---|---|
| Dradis | Organize assessment evidence and reporting. Check edition-specific imports, templates, exports and access controls. |
| Faraday | Aggregate assessment data and collaborate on vulnerability records. Review imports, permissions and report requirements. |
| CherryTree | Maintain hierarchical notes. Plan evidence references, backups and access to the underlying files. |
| Gitleaks | Detect potential secrets in source material. A match needs verification and secure handling; it is not a reporting platform. |
| Semgrep | Analyze source with selected rules and products. Record rule coverage and verify findings in application context. |
Check whether the selected setup is sufficient
- Question: state the exact behavior or configuration you are reviewing.
- Scope: list the permitted target, identity, protocol and action.
- Baseline: preserve a known observation before changing a test variable.
- Coverage: record what was tested, skipped, inaccessible or stopped early.
- Evidence: retain the relevant configuration and output without exposing secrets.
- Interpretation: explain what the result supports and what still needs verification.
- Next action: choose a follow-up check, remediation or retest that addresses that uncertainty.
Estimate effort from a small approved pilot and observed constraints, including authentication setup, service response, rate limits and manual validation. Target count multiplied by an arbitrary depth factor cannot predict when a defensible finding will appear. Record a coverage gap when work cannot be completed within the window.
Common selection questions
Which tools should a beginner install first? Choose a supported environment, a note system and the discovery or proxy tool needed for a specific training exercise. Learn what its output means before adding another category. A wireless or adversary-emulation platform is unnecessary for a basic web request exercise.
Do paid products guarantee better findings? No. Compare the required workflow, authenticated coverage, integrations, support, export options and total cost. Verify current edition and licensing terms with the vendor. A report template or severity label does not replace validating the underlying issue.
Does a clean scan mean the system is secure? It means no reportable match was produced under the recorded checks and conditions. Note missing credentials, untested features, inaccessible services and incomplete runs. Business logic and authorization questions often require a separately designed test.
Choose one task and define its evidence
Write the question, expected observation and stopping point for the exercise you already have. Select the smallest suitable tool set, preserve its configuration and examine the result. Expand the setup when the evidence reveals a specific gap, and document a useful negative result with the same care as a confirmed finding.