Last updated: August 2026. Written by Josh Hutcheson, OnlineCourseing editor. See our review methodology.
START HERE
The short answer: install Kali Linux, then learn Nmap, Wireshark and Burp Suite Community before anything else. Those three cover reconnaissance, traffic analysis and web testing, they are free, and every tool below assumes you already understand them.
- Cost: 13 of the 15 tools here are free and open source
- Skip: the paid enterprise scanners until someone else is paying for them
- Legal: written authorisation first, every time — see below
This is a learner’s guide. If you are evaluating commercial scanners for a security team with a budget, our penetration testing tools guide covers the paid platforms and how they compare. This page is about the toolkit you can install tonight for nothing, in the order that actually makes sense to learn it.
The 15 Tools at a Glance
Before you spend money on the wrong online course, read this.
Get the free 2026 Platform Comparison Guide — 12 platforms compared on price, certificates, and refund policies. Instant PDF, plus my honest Tuesday picks.
No spam. Unsubscribe anytime.
| Tool | What it does | Cost | Learn it |
|---|---|---|---|
| Nmap | Network discovery and port scanning | Free (OSS) | Nmap courses |
| Wireshark | Packet capture and protocol analysis | Free (OSS) | Wireshark courses |
| Burp Suite Community | Web application proxy and testing | Free tier; Pro is paid | Web pentesting |
| Metasploit Framework | Exploitation and payload delivery | Free (OSS) | Metasploit courses |
| Kali Linux | The distribution that ships most of these | Free | Kali courses |
| OWASP ZAP | Open-source web app scanner | Free (OSS) | Web pentesting |
| sqlmap | Automated SQL injection testing | Free (OSS) | Web pentest checklist |
| Nikto | Web server vulnerability scanning | Free (OSS) | Web pentesting |
| John the Ripper | Password hash cracking (CPU) | Free (OSS) | Password techniques |
| Hashcat | GPU-accelerated hash cracking | Free (OSS) | Password techniques |
| Hydra | Online login brute-forcing | Free (OSS) | Password techniques |
| Aircrack-ng | Wi-Fi capture and WPA key recovery | Free (OSS) | WiFi pentesting |
| Social-Engineer Toolkit | Phishing and pretext simulation | Free (OSS) | Social engineering |
| Ghidra | Reverse engineering and disassembly | Free (NSA-released) | Ethical hacking courses |
| Greenbone / OpenVAS | Open-source vulnerability management | Free community edition | Network checklist |
Learn These Three First
Most tool lists are alphabetical or arbitrary. That is useless when you are starting, because these tools depend on each other. Nothing in exploitation makes sense until you can read a packet capture, and nothing in web testing makes sense until you can intercept a request. Learn in this order.
1. Nmap — find out what is there
Nmap is how you discover which hosts exist on a network and which ports and services they expose. Every engagement starts here, and every later tool needs its output. Learn host discovery, the difference between a SYN and a connect scan, service and version detection, and the scripting engine. If you can explain why a scan produced a given result, you understand networking well enough to continue. Practise on your own machines or a deliberately vulnerable target — never on infrastructure you do not own.
2. Wireshark — understand what you are seeing
Wireshark captures traffic and decodes it protocol by protocol. It is the tool that converts abstract networking knowledge into something you can watch happen. Learn capture filters, display filters, following a TCP stream, and how a TLS handshake looks. The common mistake is treating Wireshark as a magic answer machine: it shows you everything, which is useless until you know what you are looking for. That is why it comes after Nmap.
3. Burp Suite Community — get between the browser and the server
Burp sits as a proxy between your browser and a web application so you can read and modify every request. The free Community edition is genuinely enough to learn on; its main limits are a throttled scanner and no saved projects. Learn the proxy, Repeater and Decoder first. Almost every web vulnerability class becomes obvious once you can see and edit the raw request.
Network Reconnaissance and Traffic
Beyond Nmap and Wireshark, Ettercap handles man-in-the-middle work on a local network, and Maltego maps relationships between domains, people and infrastructure for open-source intelligence. Maltego is the one commercial-leaning tool worth learning early — its Community edition is limited but sufficient to understand what link analysis is for.
If your networking fundamentals are shaky, that is the real gap rather than the tooling. A structured networking course will do more for your results than another scanner.
Web Application Testing
OWASP ZAP is the open-source alternative to Burp and the better choice if you want automation without a licence. sqlmap automates the detection and exploitation of SQL injection, and it is the clearest demonstration of why parameterised queries matter. Nikto scans web servers for known dangerous files, outdated software and misconfigurations — noisy and easily detected, but fast and genuinely useful early.
These three overlap deliberately. ZAP and Burp do similar jobs; run both and you will quickly develop a preference. Work through our web application pentesting checklist to see where each fits in a real methodology.
Passwords and Credentials
John the Ripper and Hashcat both crack password hashes you have already obtained; the practical difference is that Hashcat uses your GPU and is dramatically faster for large wordlists, while John is more flexible about obscure hash formats. Hydra is different in kind — it attacks live login services rather than captured hashes, which makes it far noisier and far more likely to lock accounts or trip alerts.
Understand the distinction before you touch any of them: cracking a hash offline is invisible to the target, while brute-forcing a login is an active attack against a running system. Our guide to password attack techniques covers the categories in more depth.
Wireless
Aircrack-ng is the standard suite for capturing wireless traffic and recovering WPA and WPA2 keys from a captured handshake. The limiting factor is usually hardware rather than software — you need a wireless adapter that supports monitor mode and packet injection, and most built-in laptop cards do not. Budget for a supported USB adapter before you spend an evening debugging why nothing captures. See our WiFi penetration testing tools guide for the wider set.
Exploitation and Social Engineering
Metasploit Framework is the free, open-source core of Rapid7’s platform, and it remains the standard way to learn how exploitation, payloads and post-exploitation modules fit together. Its real teaching value is structural: once you understand the exploit/payload/handler split, exploitation stops looking like magic.
The Social-Engineer Toolkit automates phishing pages and pretexting campaigns. It is the tool on this list with the narrowest legitimate use and the widest scope for harm — it belongs in authorised red-team work and awareness training, nowhere else. If people are your attack surface, our social engineering courses guide covers the discipline properly.
Reverse Engineering and Vulnerability Management
Ghidra is the reverse-engineering suite the NSA released publicly in 2019; it is free, actively developed, and the realistic alternative to a commercial disassembler licence. Its home is now the project’s GitHub repository. Greenbone (the project formerly known as OpenVAS) provides open-source vulnerability management, and Snort is the long-standing open-source intrusion detection system — worth learning because understanding detection is what separates a tester from a script runner.
What Actually Costs Money
Thirteen of the fifteen tools above are free and open source. That is not a compromise selection — Nmap, Wireshark, Metasploit and sqlmap are what working professionals use daily. The paid tier buys you three things: automation at scale, reporting that satisfies auditors, and support.
| What you want | Free option | When you actually need paid |
|---|---|---|
| Web app scanning | OWASP ZAP, Burp Community | Scheduled scans across many apps, and compliance-ready reports |
| Vulnerability management | Greenbone / OpenVAS | Large asset inventories with SLA-backed feeds |
| Link analysis / OSINT | Maltego Community | Commercial data transforms and higher entity limits |
| Disassembly | Ghidra | Team collaboration features and vendor support |
If you are learning, or testing your own systems, you do not need any of the paid tiers. If you are building a security function with a budget and need vendor comparison, that is what our penetration testing tools guide is for.
Is It Legal to Use These Tools?
The tools themselves are legal to own and run in most jurisdictions, including the United States and the United Kingdom. What is illegal is using them against systems you do not own and have not been authorised in writing to test. That distinction is the entire profession.
In practice this means three things. Get written authorisation that names the exact systems, the time window and the permitted techniques, before you scan anything. Practise only on your own equipment or on environments built to be attacked. And understand that “I was only scanning” is not a defence — unauthorised port scanning has been prosecuted. Our guide to whether ethical hacking is legal covers the specifics, and hacking vs ethical hacking covers where the line actually sits.
How to Learn These Properly
Tools are the easy part. What takes time is methodology — knowing what to run, in what order, and what a result means. A structured course is worth more than another tool, because it gives you the sequence.
- Ethical hacking courses — the broad foundation, and where to start if you are new
- Penetration testing courses — methodology and hands-on labs
- Kali Linux courses — the distribution most of these tools ship on
- Bug bounty courses — the legal, paid way to practise on real targets
- Cyber security courses — the wider defensive context
If you want a credential rather than just the skill, our cybersecurity certifications guide ranks the ones employers actually ask for.
Where to Practise Legally
The single most common way beginners get themselves into trouble is running a scan against something that felt harmless. You do not need to. There is an entire ecosystem of systems built specifically to be attacked, and using them is both legal and better practice, because they are designed to teach a particular lesson.
- TryHackMe — guided rooms with hints; the gentlest on-ramp if you are genuinely new
- Hack The Box — unguided machines that assume you can already work independently
- OverTheWire — free wargames that drill Linux and networking fundamentals hard
- OWASP Juice Shop — a deliberately broken modern web app covering the OWASP Top 10
- DVWA — the classic damn-vulnerable web app, with adjustable difficulty levels
- VulnHub — downloadable vulnerable VMs you run entirely on your own hardware
The safest of these is the last one. A vulnerable VM on your own machine, on a host-only network, involves no third party and no terms of service at all. Build that lab first: a hypervisor, a Kali VM and a target VM on an isolated virtual network is about an hour of setup and removes every legal question from your practice.
What We Left Off, and Why
A few tools appear on almost every competing list and are missing here deliberately.
| Tool | Why it is not on this list |
|---|---|
| Nessus | The free Nessus Essentials tier is capped at 16 IP addresses. It is a fine scanner, but it is a commercial product with a trial, not a free tool — it belongs in the paid guide. |
| Invicti (incl. the former Acunetix) | A commercial web scanner with no free tier. Note that Acunetix is now Invicti Web + API — one product, not two. Covered in our penetration testing tools guide, where budget is the assumption. |
| Cobalt Strike | Licensed commercial adversary-simulation software, and the most abused tool in the category. Not a learning tool, and cracked copies are both illegal and routinely backdoored. |
| Angry IP Scanner | It works, but it does a narrow subset of what Nmap does. Learn Nmap instead; there is no scenario where you need both. |
| Ettercap | Still maintained and still useful for local man-in-the-middle work, but modern networks and encrypted traffic have narrowed its practical use considerably. Worth knowing, not worth learning third. |
Frequently Asked Questions
What are the best free ethical hacking tools?
Nmap, Wireshark, Metasploit Framework, OWASP ZAP, sqlmap, John the Ripper, Hashcat, Hydra, Aircrack-ng, Nikto, Ghidra, Greenbone/OpenVAS and the Social-Engineer Toolkit are all free and open source. Burp Suite offers a free Community edition. Thirteen of the fifteen tools on this page cost nothing.
Which ethical hacking tool should I learn first?
Nmap, then Wireshark, then Burp Suite Community. Nmap teaches you to find what is on a network, Wireshark teaches you to read what it is saying, and Burp teaches you to intercept and modify web traffic. Later tools assume you understand all three.
Do I need Kali Linux to use these tools?
No, but it saves time. Kali ships with most of these tools pre-installed and configured, which removes a lot of setup friction when you are learning. Every tool here can be installed individually on Linux, macOS or Windows.
Is it legal to use ethical hacking tools?
Owning and running the tools is legal in most jurisdictions. Using them against systems you do not own or have not been authorised in writing to test is not, and unauthorised scanning has been prosecuted. Always get written authorisation naming the systems, the time window and the permitted techniques.
What is the difference between ethical hacking tools and penetration testing tools?
In practice the toolsets overlap almost completely. The difference is context: ‘ethical hacking tools’ usually refers to the free, open-source toolkit people learn on, while ‘penetration testing tools’ more often refers to the commercial platforms security teams buy for scheduled scanning and audit-ready reporting.
Is Burp Suite Community enough, or do I need Pro?
Community is enough to learn on. Its main limitations are a throttled scanner and no saved projects. Burp Pro is worth it when you are testing professionally and need the automated scanner and the ability to resume work across sessions.
RELATED GUIDES
- Penetration testing tools — the commercial platforms, for teams with a budget
- Windows pentesting tools — the Windows-specific toolkit
- Kali Linux tools — what ships on the distribution
- Penetration testing methodology — the seven-step process these tools sit inside
- Hacking terminology — the vocabulary, plainly defined
Related reading: iOS penetration testing