24 Best Kali Linux Tools for Penetration Testing in 2026

Last updated: August 2026. Written by Josh Hutcheson, OnlineCourseing editor. Every tool below was checked against Kali’s official package listing at kali.org/tools before publication.

QUICK VERDICT

Kali Linux is the most widely used Linux distribution for penetration testing, and its appeal is straightforward: the tooling is already there. You do not spend a weekend compiling dependencies before you can run your first scan. Boot a live image or a virtual machine and the full toolkit is sitting in the menu, configured and ready.

That abundance is also the problem. Kali’s documentation describes the distribution as carrying “several hundred tools, configurations, and scripts,” and a beginner opening the applications menu for the first time has no way to tell which of those matter and which are abandoned experiments. Plenty of tool lists make this worse by padding the count with utilities nobody has run in a decade.

This guide takes a different route. It starts with the shortlist Kali’s own maintainers publish, then works outward through the phases of an actual engagement — reconnaissance, scanning, exploitation, credentials, wireless, forensics — so you can see where each tool fits rather than reading 24 disconnected entries. Where a tool has been renamed or removed, it says so.

Kali’s official top 10 tools

Most “best Kali tools” lists are one writer’s opinion. Kali itself settles the argument: the distribution ships a metapackage called kali-tools-top10, described in the official documentation as depending on “the 10 most important applications that Kali Linux provides.” If you want a defensible learning order, this is it — straight from the people who maintain the distribution.

Two entries on that list are worth pausing on, because they rarely appear in older roundups. Responder and NetExec are internal-network tools, and their presence in the official top ten reflects where the industry actually spends its time: assessing Windows and Active Directory environments from inside the perimeter, not just scanning public web servers.

How Kali organises several hundred tools

Before working through the tools, it helps to know that you probably do not have all of them installed. Kali groups its packages into metapackages, and which one you installed determines what is on your system:

• kali-linux-default — the standard ISO. Kali’s docs describe it as depending on “all the applications that are included in the default official Kali Linux images.” This is what most people have.
• kali-linux-headless — the same toolset minus anything requiring a GUI. Useful for a cloud VM or a Raspberry Pi.
• kali-linux-large — the default set “and adds many more on top of those.”
• kali-linux-everything — all of it. Kali’s own warning: “Beware, this will install a lot of stuff!”

If a tool below is missing from your menu, you are almost certainly on the default image and can install it with sudo apt install <package> rather than reinstalling the distribution. There are also domain-specific metapackages — kali-tools-web, kali-tools-passwords, kali-tools-forensics and others — if you want a whole category at once.

Reconnaissance and information gathering

1. Nmap

Nmap is where nearly every engagement starts. It maps what is alive on a network, which ports answer, what service and version sits behind each one, and often what operating system is running. Its scripting engine extends it well past port scanning into vulnerability checks and service enumeration. Learning to read Nmap output properly — and to explain why you chose a particular scan type — is the difference between running a tool and doing reconnaissance. If you learn one tool on this page thoroughly, make it this one; our roundup of the best Nmap courses covers structured options.

2. Gobuster

Kali describes Gobuster as a “high-performance discovery tool for directories, DNS and cloud storage.” In practice it is how you find the parts of a target that are not linked from anywhere: unlisted admin paths, forgotten staging subdomains, exposed S3 and Google Cloud Storage buckets. It runs in distinct modes — dir, dns, vhost, fuzz, s3, gcs and tftp — and it is only as good as the wordlist you feed it, which is why the seclists package is usually installed alongside it.

3. Maltego

Maltego handles open-source intelligence and link analysis. Rather than scanning infrastructure, it builds a graph of relationships — domains to registrants, people to email addresses, companies to subsidiaries — which makes it valuable for scoping and for digital forensics work. Two caveats: it ships pre-installed but requires you to register a Maltego account before first use, and the Community Edition is metered rather than unlimited — Maltego’s entry plan bundles Community Edition with a monthly credit allowance and access to only a subset of its commercial data sources. That is ample for learning the graph-and-transform workflow, but it is not the tool investigative teams are actually paying for.

Traffic capture and network attacks

4. Wireshark

Wireshark captures traffic and lets you inspect it frame by frame. Its real value is educational as much as operational: filtering a live capture down to a single TCP stream and watching a handshake, a redirect or a cleartext credential go past teaches you more about how networks actually behave than any diagram. The display-filter syntax is the part worth investing in, and it is what our Wireshark tutorial roundup concentrates on.

5. Responder

Kali lists Responder simply as an “LLMNR/NBT-NS/mDNS Poisoner.” When a Windows machine fails to resolve a hostname through DNS, it falls back to broadcasting the request across the local network; Responder answers those broadcasts as a rogue authentication server and captures the hashes clients offer up. It is one of the highest-yield tools in an internal assessment precisely because the underlying fallback behaviour is enabled by default in most environments. It also supports DHCP and DHCPv6 poisoning.

6. Kismet

Kismet is a passive wireless detector and sniffer. Unlike active tools it never transmits, which makes it useful for surveying an environment without announcing yourself — mapping access points, spotting rogue devices and identifying hidden networks. It has broadened well beyond Wi-Fi into Bluetooth and other radio protocols, and it works with most wireless adapters used for pentesting.

7. Yersinia

Yersinia attacks layer-2 protocols that most security testing ignores — spanning tree, DTP, VTP, DHCP and Cisco Discovery Protocol. It is a niche tool and we would not put it in anyone’s first ten, but if your scope includes switching infrastructure it covers ground nothing else in Kali does. Expect it to be genuinely disruptive on a production network; this is a lab tool unless your engagement explicitly permits it.

Vulnerability scanning

8. Greenbone / GVM (formerly OpenVAS)

This is the entry most tool lists still get wrong. The package in Kali is gvm, the Greenbone Vulnerability Manager, described as a “modular security auditing tool, used for testing remote systems for vulnerabilities that should be fixed.” Kali’s own documentation notes plainly that “the tool was previously named OpenVAS.” It remains the leading free alternative to commercial vulnerability scanners, and it is the closest thing Kali offers to the enterprise scanning products covered on our penetration testing tools guide. Setup is the hard part — the feed sync on first run takes a while.

9. Nikto

Nikto is described by Kali as a “pluggable web server and CGI scanner.” It checks a web server for dangerous files, outdated server software and common misconfigurations. It is fast, noisy and makes no attempt to hide — every request lands in the target’s logs — so treat it as a first-pass sweep on an authorised target rather than a stealth tool. Its findings need manual triage; a Nikto report is a list of things to look at, not a list of confirmed vulnerabilities.

10. WPScan

WPScan enumerates WordPress installations: core version, themes, plugins, exposed users. Given how much of the web runs on WordPress, and that the vulnerabilities almost always live in third-party plugins rather than core, it earns its place. One practical catch: the vulnerability data comes from WPScan’s API and needs a token. The free tier allows 25 API requests per day, and once those are exhausted the scanner keeps working but returns enumeration only — no vulnerability matches. If a scan comes back suspiciously clean, check your token before believing it.

11. Lynis

Lynis runs the other direction — it audits a system from the inside rather than attacking it from outside. Run it on a Linux host and it reports on hardening gaps, weak configuration and compliance issues. It belongs on this list because a large share of real security work is defensive review, and because running it against your own machine is an easy way to understand what a hardened system is supposed to look like.

Web application testing in Kali

12. Burp Suite

Burp Suite is the standard intercepting proxy for web application testing. It sits between browser and server so you can read, modify and replay every request. The Community Edition that ships with Kali covers the manual toolkit — the proxy and its history, plus Repeater, Decoder, Sequencer and Comparer — which is genuinely enough to learn on. What it withholds is worth knowing before you plan around it: the automated web vulnerability scanner is Professional-only, Intruder runs in a demo mode rather than at full speed, and Community cannot save project files, so a session ends when you close it. Being fluent in Burp is close to a hiring requirement for application security roles.

13. ZAP

ZAP — the Zed Attack Proxy — is Burp’s fully free counterpart. It is the tool most often mislabelled in older guides: it was OWASP ZAP for years, but the project left OWASP and now describes itself as “an independent Open Source project,” currently backed by Checkmarx. Functionally it is the same core idea as Burp with no paid tier withholding the scanner, which makes it the better choice for automated scanning in a CI pipeline and for anyone unwilling to pay for Burp Professional. Most testers end up using both. Our web pentesting checklist covers where each fits.

14. SQLMap

SQLMap automates the detection and exploitation of SQL injection flaws. Point it at a parameter and it will fingerprint the database, enumerate schemas and, where the configuration allows, read files or open a shell. It is genuinely powerful and correspondingly dangerous: it can write to a database as readily as read from one. Understand the injection you are testing before you let SQLMap loose on it.

15. BeEF

BeEF, the Browser Exploitation Framework, hooks a browser rather than a server. Once a target loads a hooked page — typically via a cross-site scripting flaw — BeEF can enumerate the browser, fingerprint the machine behind it and launch further modules. It is the clearest practical demonstration of why XSS is not a low-severity finding, and it works against mobile browsers as readily as desktop ones.

Password and credential attacks

16. John the Ripper

John the Ripper cracks password hashes offline. Its strength is breadth of hash-format support and its rule engine, which mutates a wordlist the way people actually mutate passwords — appending years, substituting characters, capitalising. Its companion utilities matter as much as the cracker itself: the various *2john scripts extract crackable hashes from archives, disk images and documents. Pair it with an understanding of how passwords are stored rather than treating it as a black box.

17. Hashcat

Hashcat does the same job as John but on the GPU, and for large hash sets the difference is not marginal. It is the tool that turns a captured NTLM dump or a WPA handshake into results in a realistic timeframe. The catch is that a Kali virtual machine usually has no GPU passthrough, so many people run Hashcat on the host rather than inside Kali. Learn John’s concepts first; Hashcat’s syntax makes more sense once you understand attack modes and rules.

18. Hydra

Hydra is the online counterpart to John and Hashcat: instead of cracking a stolen hash, it attempts logins directly against a live service — SSH, RDP, FTP, HTTP forms and dozens more. That makes it loud and, against anything with lockout policies or rate limiting, frequently counterproductive. Used carelessly it locks out real accounts, which is exactly the kind of incident that ends an engagement badly.

Exploitation and post-exploitation

19. Metasploit Framework

Metasploit is the exploitation framework the rest of the field is measured against. It standardises the awkward parts of exploitation — module selection, payload generation, session handling — so you can move from a confirmed vulnerability to a working shell without writing an exploit from scratch. Its Meterpreter payload is a post-exploitation toolkit in its own right. Learn to read a module’s source rather than only running it; understanding why an exploit works is what the pentesting methodology actually asks of you.

20. NetExec (formerly CrackMapExec)

Kali describes NetExec as a “network service exploitation tool that helps automate assessing the security of large networks,” working across SMB, LDAP, MSSQL, WinRM, RDP, SSH, FTP, VNC, WMI and NFS. Given a set of credentials it will tell you, across an entire subnet, where those credentials work and what they can reach. The naming matters: Kali’s documentation states that “NetExec is the continuation of CrackMapExec, which was maintained by mpgn over the years, but discontinued upon mpgn’s retirement.” Tutorials referring to crackmapexec or cme are describing this tool under its old name.

21. Social-Engineer Toolkit (SET)

SET automates the human side of an assessment: credential-harvesting page clones, phishing payloads, malicious media. It is included because social engineering is how a large share of real breaches begin, and a phishing simulation is a standard part of a scoped engagement. It is also the tool on this page most easily misused, and running it against anyone who has not agreed to be tested is not a grey area.

Wireless and forensics

22. Aircrack-ng

Aircrack-ng is a suite rather than a single binary: airmon-ng puts an adapter into monitor mode, airodump-ng captures, aireplay-ng injects, and aircrack-ng recovers the key. It remains the reference toolkit for WPA and WPA2 assessment. Two practical notes: it needs a wireless adapter that supports monitor mode and packet injection, which rules out many built-in laptop cards, and against WPA2 it is only recovering keys weak enough to appear in your wordlist.

23. PixieWPS

PixieWPS exploits weak entropy in the WPS pin exchange on vulnerable access points, recovering the pin offline in seconds where the attack applies. Its scope has narrowed considerably as manufacturers patched the underlying weakness, so treat it as a quick check against older hardware rather than a dependable route in. It is usually driven through a wrapper such as Reaver rather than run directly.

24. Autopsy

Autopsy is a graphical digital forensics platform built on The Sleuth Kit. It analyses disk images and file systems — timeline reconstruction, deleted-file recovery, keyword search, browser artefacts. It belongs on a pentesting list because incident response and offensive testing draw on the same underlying knowledge, and because forensics is a common career pivot. Our guide to the best digital forensics courses goes deeper.

Renamed and removed: what older guides get wrong

Kali’s package set moves, and a surprising number of published tool lists have not moved with it. If you are following an older tutorial, these three are the ones most likely to waste your time:

Is it legal to use Kali Linux tools?

Installing and running any tool on this page is legal. Pointing one at a system you do not own or have written permission to test is not, and the tool being freely distributed has no bearing on that. In the United States the relevant statute is the Computer Fraud and Abuse Act; the United Kingdom has the Computer Misuse Act 1990; most other jurisdictions have an equivalent. Unauthorised scanning and access are criminal offences under all of them.

The line professionals work to is simple: a written, signed scope agreed before testing begins, naming the systems in scope and the window in which testing may occur. Everything else — your intentions, whether you caused damage, whether the target noticed — is legally beside the point. If you are learning, use a lab you control or a platform built for the purpose: a local VM, Hack The Box, TryHackMe, or the deliberately vulnerable OWASP Juice Shop and Metasploitable images. Our network pentesting checklist covers what a properly scoped engagement looks like.

How to learn Kali Linux properly

Reading a tool list does not build skill. The pattern that works is narrow and repetitive: pick one tool, run it against a lab target until you can predict its output, then learn the next one in the same phase. Nmap first, because everything downstream depends on knowing what is there. Wireshark second, because it explains what Nmap is doing at the packet level. Burp Suite third, because web applications are where most findings live.

Structured courses are worth it mainly for sequencing and for the lab environments they provide — the tools themselves are documented well enough that you rarely pay for the tool knowledge alone. If you are working toward a role rather than curiosity, a broader security foundation matters more than tool fluency; employers hire for methodology and can teach the tooling.

Compare Kali Linux Courses →

Frequently asked questions

How many tools does Kali Linux come with?

Kali’s own documentation describes the distribution as containing “several hundred tools, configurations, and scripts.” The exact number on your machine depends on which metapackage you installed — kali-linux-default is the standard image, while kali-linux-everything installs the complete set. Kali deliberately avoids publishing a fixed headline figure, so treat any precise count you see quoted elsewhere with caution.

Which Kali tool should a beginner learn first?

Nmap. Reconnaissance comes first in every methodology, and almost every later step depends on knowing what hosts and services exist. Once you can read Nmap output confidently and explain your scan choices, move to Wireshark to see the same activity at packet level, then Burp Suite for web applications.

Are all Kali Linux tools free?

Every tool on this page is free to install and use, and Kali itself is free. Two have commercial tiers you can ignore while learning: Burp Suite Community omits the automated scanner found in Professional, and Maltego’s Community Edition limits results per query. Neither restriction blocks you from learning the tool.

What happened to OpenVAS in Kali Linux?

It was renamed. The scanner is now Greenbone Vulnerability Manager and the Kali package is gvm; Kali’s documentation states directly that the tool “was previously named OpenVAS.” It is still free and still maintained — only the name and package changed, so apt install openvas will not give you what older guides promise.

Do I need Kali Linux to use these tools?

No. Almost all of them are packaged for other distributions, and several — Nmap, Wireshark, Burp Suite, Hashcat — run on Windows and macOS too. What Kali provides is the assembly: the tools installed, configured and grouped so you are not spending your first week on setup. There are also other security distributions such as Parrot OS that take the same approach.

Is Kali Linux good for everyday use?

No, and Kali’s maintainers say so themselves. It is built as a specialist testing platform, not a general-purpose desktop, and using it as a daily driver means running a system configured for offensive work for tasks that do not need it. Run it in a virtual machine or from a live USB alongside a normal desktop distribution.

The bottom line

The volume of tooling in Kali is intimidating and largely irrelevant. Kali’s own top-ten metapackage is the honest answer to what matters, and the twenty-four tools here extend that shortlist across the phases of a real engagement without padding it with software nobody runs. Start with Nmap, Wireshark and Burp Suite, work outward as your scope demands, and check the package name at kali.org before trusting any tutorial written more than a couple of years ago — as the OpenVAS and CrackMapExec renames show, the tool usually still exists, just not under the name you were given.

Related reading: ethical hacking tools · penetration testing tools · Windows pentesting tools · hacking terminology · best penetration testing courses