24 Best Windows Pentesting Tools For Ethical Hacking in 2026

Last updated: August 2026. Written by Josh Hutcheson, OnlineCourseing editor. See our review methodology.

QUICK VERDICT

Search for pentesting tools and almost everything you find assumes Linux. Kali dominates the conversation, most tutorials open with an apt install, and the implication is that testing from Windows is a compromise you make only if you have no other option. That was closer to true a decade ago than it is now.

Two things changed. WSL2 gave Windows a real Linux kernel, so the Linux-only objection mostly evaporated — you can run Kali inside Windows and get a graphical desktop through Win-KeX. And the enterprise targets that matter most are themselves Windows: Active Directory, Kerberos, SMB, LDAP, AD Certificate Services. The best tooling for attacking those is written in C and C# and runs natively on Windows, not on Linux.

This guide lists 24 tools that earn a place on a Windows testing machine in 2026, grouped by the job they do rather than ranked against each other — a port scanner and a password cracker are not competitors. For each one we say plainly whether it runs natively on Windows or needs WSL2, what it costs, and what it is genuinely good at. We also name the tools that used to appear on lists like this and should not any more, because several widely-cited ones have been archived or renamed while their old download pages still return a healthy-looking page.

What counts as a Windows pentesting tool?

A Windows pentesting tool is software used to find and demonstrate security weaknesses that runs on a Windows host — either as a native Windows executable, or through the Windows Subsystem for Linux. The category spans network scanners, web application proxies, vulnerability scanners, exploitation frameworks, credential and Active Directory tooling, and password crackers. Most are free and open source; a few of the enterprise scanners are commercial with limited free tiers.

That definition matters because “works on Windows” hides three very different experiences, and most listicles collapse them into one. Sorting them out first will save you a weekend:

• Native Windows. A signed installer or a standalone .exe. Wireshark, Nmap, Burp Suite, Nessus, Ghidra, Hashcat, Mimikatz and the Sysinternals tools all fall here. This is the smoothest experience and, for the C# Active Directory tooling, the only sensible one.
• WSL2. A real Linux kernel running inside Windows. Impacket, NetExec, Responder, sqlmap and Metasploit are far happier here than in any native port. Networking has caveats — tools that need raw layer-2 access or that must receive inbound connections on the LAN, Responder especially, need bridged networking or a VM rather than default WSL2 NAT.
• Virtual machine. A full Kali or Parrot guest under Hyper-V, VMware or VirtualBox. Slowest to start, but it is the only option that gives you unrestricted control of the network stack, and it keeps testing tools off your daily-driver OS.

One more practical note before the list. Windows Defender will quarantine a good portion of this software on sight, and it is not wrong to do so — Mimikatz, Rubeus and the C2 frameworks are the same binaries that appear in real intrusions, which is exactly why they are useful for testing. Handle that with a dedicated, isolated testing machine and documented exclusions, not by disabling protection on a computer you also use for anything else.

AT A GLANCE

The 24 pentest tools for Windows, compared

Reconnaissance and traffic analysis

1. Nmap

Nmap is where nearly every engagement starts. It maps which hosts are alive, which ports are open, which services and versions sit behind them, and it will often fingerprint the operating system correctly from the responses alone. The Windows build is a proper installer with Npcap bundled, and it includes Zenmap, the graphical front end that Linux users largely abandoned but which is genuinely useful when you are learning how scan options change the results.

The part people underuse is the Nmap Scripting Engine. NSE ships with hundreds of scripts that go well past port discovery — enumerating SMB shares and users, pulling SSL certificate details, checking for specific known vulnerabilities. Run it from an elevated prompt on Windows; without administrator rights Nmap silently falls back to slower, less accurate scan types, which is the single most common reason a Windows scan disagrees with the same scan from Linux.

Best for: the first hour of any internal or external test. Watch out for: aggressive timing options on fragile industrial or embedded targets — a scan can take down badly-written services, which is a finding you would rather report than cause.

2. Wireshark

Wireshark captures and decodes network traffic packet by packet, with dissectors for thousands of protocols. On a pentest it answers questions no scanner can: what a proprietary client is actually sending, whether credentials are crossing the wire without encryption, why a service responds to one host and not another. It is equally a debugging tool, which is why it belongs on the machine even when you are not testing.

The Windows version depends on Npcap for capture, and the practical limitation to understand is that on a switched network you see only your own traffic unless you have a monitor port, a tap, or a position that gives you more. Learn the display filter syntax early — the difference between a useful capture and an unreadable one is entirely in the filtering. Note also that on Windows, capturing your own machine’s loopback traffic requires Npcap’s loopback adapter, which is an install-time option people routinely miss.

Best for: proving a protocol-level finding with evidence a client cannot argue with. Watch out for: capture files containing real credentials and personal data — they are sensitive artefacts and should be handled as such under your engagement’s data-handling terms.

Web application testing

3. Burp Suite

Burp Suite from PortSwigger is the default web application testing platform, and on Windows it installs and runs without ceremony. It sits as an intercepting proxy between your browser and the target, letting you read, modify and replay every request. Repeater for manual iteration and Intruder for automated parameter manipulation are the two tools you will live in.

The Community Edition is free and genuinely capable for learning and for manual testing, but PortSwigger throttles Intruder heavily and withholds the active scanner. Professional is the version working testers buy. Budget for it as a real line item rather than a nice-to-have — it is the one commercial tool on this list that most consultancies consider mandatory.

Best for: manual web application testing where you need to understand and manipulate individual requests. Watch out for: treating the automated scanner as the test. Burp finds the mechanical classes of bug; business-logic flaws still require you.

4. Zed Attack Proxy (ZAP)

ZAP is the free, open-source alternative to Burp and the closest thing to a like-for-like substitute. It intercepts and modifies traffic, spiders applications, and runs both passive and active scans — and unlike Burp Community, its active scanner is not restricted. For anyone learning web testing without a budget, ZAP gives you the full workflow at no cost.

One point of accuracy worth flagging, because a lot of older articles get it wrong: ZAP is no longer an OWASP project. It moved out in 2023 and is now an independent open-source project sponsored by Checkmarx, though the software is still free and community-developed and the name is still Zed Attack Proxy. If a guide is still calling it “OWASP ZAP”, that guide has not been touched in three years — a useful staleness signal when you are judging which tutorials to trust.

Best for: free web testing, and automation in a CI pipeline where per-seat licensing would be painful. Watch out for: a noisier findings list than Burp’s — expect to triage more false positives.

5. Invicti (formerly Netsparker)

Invicti is an automated web application security scanner aimed at organisations that need to scan many applications on a schedule rather than test one deeply by hand. Its distinguishing feature is proof-based scanning: for many vulnerability classes it safely demonstrates exploitability and reports the evidence, which cuts the triage burden that makes most automated scanners exhausting.

The name matters here. This product was Netsparker until the company rebranded to Invicti, and netsparker.com now redirects to invicti.com. Anything still recommending “Netsparker” is describing a product that no longer exists under that name. Pricing is quote-based and firmly enterprise; there is no meaningful free tier, so this is a tool you meet at work rather than one you learn on.

Best for: continuous scanning across a large application estate. Watch out for: the assumption that a clean automated scan means a secure application. It does not, and no vendor claims it does.

6. Nikto

Nikto is an old, simple, still-useful web server scanner. It checks for thousands of potentially dangerous files, outdated server versions, dangerous HTTP methods and common misconfigurations. It is not subtle and it is not quiet, but it finds the low-hanging server-level problems quickly, and it costs you two minutes to run.

It is a Perl script, so on Windows the sane path is WSL2 rather than wrestling with a native Perl install. Treat its output as leads rather than findings — Nikto’s checks are signature-based and generate a healthy number of false positives that need manual confirmation before they go anywhere near a report.

Best for: a fast first look at an unfamiliar web server. Watch out for: how loud it is — it will fill defensive logs, which is fine on an authorised test and a problem if you have not told anyone.

7. sqlmap

sqlmap automates the detection and exploitation of SQL injection. Give it a request and it will work out whether a parameter is injectable, identify the database back end, and enumerate what it can reach. It supports a wide range of database systems and injection techniques, and because it is written in Python it runs natively on Windows with a Python install, though WSL2 remains the smoother option.

This is the tool on the list where scope discipline matters most. sqlmap’s more aggressive options can modify data and place files on the target, so read what a flag does before you use it and keep the engagement’s rules of engagement open beside you. Confirming a vulnerability exists is the deliverable; extracting a customer database to prove it usually is not, and your scope document should say so explicitly.

Best for: confirming and characterising SQL injection quickly. Watch out for: running it at default aggression against production systems.

Vulnerability scanning

8. Nessus

Nessus from Tenable is the vulnerability scanner most enterprises actually run. It installs natively on Windows, presents a browser-based interface, and checks hosts against a very large and frequently updated plugin library covering missing patches, misconfigurations and default credentials. Credentialed scans — where you give it valid host credentials — produce dramatically better results than unauthenticated ones, and that is the mode most engagements should use.

Nessus Essentials is free for up to 16 IP addresses, which is enough to scan a home lab and learn the tool properly before you ever have to justify a licence. Above that you are into commercial pricing.

Best for: breadth — establishing the patch and configuration state of a whole estate. Watch out for: confusing a vulnerability scan with a penetration test. A scanner lists potential issues; a test demonstrates what an attacker could actually chain together. Clients conflate the two constantly, and it is worth being explicit in your reports.

Compare Ethical Hacking Courses →

Exploitation and command-and-control

9. Metasploit Framework

Metasploit is the best-known exploitation framework: a large, maintained library of exploit modules, payloads and auxiliary tools behind a consistent interface, plus Meterpreter for post-exploitation. Rapid7 maintains the open-source Framework alongside a commercial Pro edition, and for learning how a vulnerability becomes access, nothing else has the same breadth of worked examples.

There is a native Windows installer, but be honest about the experience: it is a Ruby application with a lot of dependencies, and the native build is slower and more prone to breaking after updates than the same framework under WSL2 or in a Kali VM. Unless you have a specific reason to run it natively, do not. Defender will also object strenuously to the payload files, which is a reason to keep it on an isolated machine.

Best for: learning exploitation systematically, and for validating that a known vulnerability is genuinely exploitable in this environment. Watch out for: module reliability — a fair number of exploit modules can crash the target service. Know which ones before you point them at anything that matters.

10. Sliver

Sliver, from Bishop Fox, is an open-source adversary emulation and command-and-control framework, and it has become the default free answer to “what do we use now that Cobalt Strike costs what it costs”. It is written in Go, cross-compiles cleanly, supports multiple transport protocols, and handles multi-operator engagements — which matters if you work on a team rather than alone.

Sliver belongs on a Windows list because Windows hosts are what red teams most often emulate against, and because the server and client both run on Windows. It is genuinely current software — the repository sees commits weekly — which distinguishes it from several C2 frameworks that still appear on tool lists years after their last real update.

Best for: authorised red-team engagements and purple-team exercises where you need realistic post-exploitation tradecraft. Watch out for: scope. C2 frameworks establish persistent access to systems; that requires explicit written authorisation and a documented plan to remove every implant at the end of the engagement.

Active Directory tooling — where Windows genuinely wins

This is the section that justifies a Windows testing machine rather than a Kali VM. Most enterprise networks are Active Directory networks, most of the interesting attack paths run through Kerberos, SMB, LDAP and AD Certificate Services, and the best tools for assessing those are written in C and C# by people who work on Windows. You can drive some of this from Linux; you cannot drive all of it.

11. Mimikatz

Mimikatz, by Benjamin Delpy, is the tool that taught the industry how Windows credential handling actually works. Its own description — “a little tool to play with Windows security” — undersells a project that has driven more Microsoft hardening work than any other piece of security research tooling. In an authorised assessment it demonstrates, concretely, what an attacker with local administrator rights can recover from a compromised host, and that demonstration is what moves a client from “we know in principle” to “we are funding the fix”.

It is Windows-only by nature — it interacts with Windows authentication internals that have no Linux equivalent. Every endpoint protection product in existence detects it, including the well-known Defender signature, and modern mitigations such as Credential Guard, LSA protection and the removal of cleartext WDigest storage have closed much of what made it devastating a decade ago. That reduced effectiveness is itself the finding: if Mimikatz still works freely across an estate in 2026, the estate is missing a decade of Microsoft hardening.

Best for: evidencing credential-hygiene and host-hardening gaps during an authorised internal test. Watch out for: this is genuine dual-use software. Running it against systems you are not authorised to test is a criminal offence in most jurisdictions, not a grey area.

12. BloodHound Community Edition

BloodHound takes Active Directory relationship data and turns it into a graph, then answers the question that matters: from this account, what is the shortest path to Domain Admin? It surfaces the accumulated permission mistakes — nested group memberships, unconstrained delegation, ACL misconfigurations — that no individual audit catches because each one looks reasonable in isolation.

Get the version right, because this is a live trap. The original BloodHound repository has been renamed to BloodHound Legacy and is no longer the project you want; the current free release is BloodHound Community Edition, which SpecterOps ships as a containerised application with a Neo4j back end. Guides that tell you to download the old Electron app and import into a standalone Neo4j instance are describing the legacy product. The old repository URL still resolves perfectly — it just redirects to a repository with “Legacy” in the name, which is easy to miss if you are copying a command rather than reading the page.

Best for: making AD risk legible to people who do not read AD. The graphs are the most persuasive artefact you can put in a report. Watch out for: collection volume — on a large domain, data collection is noisy and slow, and it should be planned with the blue team rather than sprung on them.

13. SharpHound

SharpHound is BloodHound’s data collector, and it is listed separately because it is the half that has to run on Windows. It is a C# application that queries the domain over LDAP and SMB, gathers users, groups, computers, sessions, ACLs and trust relationships, and writes them out for BloodHound to ingest. Domain-joined or not, it needs a Windows host and a set of domain credentials.

Collection scope is the decision to get right. A full collection including session enumeration gives the richest graph but touches every machine in the domain and takes hours on a large estate; a targeted collection of just the directory objects is fast and quiet and still produces most of the useful attack paths. Match the collection method to the BloodHound version you are running — Community Edition expects a current SharpHound release, and mismatched versions produce ingest errors that look like tool bugs.

Best for: gathering the AD dataset that everything downstream depends on. Watch out for: the output files, which contain a complete map of the client’s directory. Encrypt and destroy them per your engagement’s data-handling terms.

14. Impacket

Impacket is a collection of Python classes for working with network protocols, which undersells it considerably. In practice it is the toolkit that lets you speak SMB, MSRPC, LDAP and Kerberos programmatically, and the example scripts bundled with it — for remote execution, ticket manipulation, and directory queries — are staples of internal testing.

Note the maintainer: Impacket is now maintained by Fortra, having previously been a SecureAuth project. The repository is active, with commits landing regularly. On Windows, install it inside WSL2 — the Python dependency chain behaves far better there than under native Windows Python, and the scripts assume a POSIX environment in places.

Best for: anything involving Windows protocols where you need scriptable, precise control. Watch out for: the example scripts are examples — read what one does before running it, because several make changes on the target.

15. NetExec (formerly CrackMapExec)

NetExec automates the tedious middle of an internal test: enumerating hosts across SMB, WinRM, LDAP, MSSQL and other services, validating credentials at scale, and telling you where a given account has local administrator rights. It is the tool that turns one working credential into a map of what that credential opens.

This entry carries the most important correction on the page. If you have read about pentesting at any point in the last decade you know this tool as CrackMapExec — but the CrackMapExec repository was archived in December 2023 and has received nothing since. NetExec is the maintained community fork and the one under active development, with commits landing daily. The archived CrackMapExec repository still loads normally and still has over nine thousand stars, so nothing about visiting it signals that it is dead. Install nxc, not cme.

Best for: rapidly establishing the blast radius of a compromised credential. Watch out for: account lockout policies. Spraying credentials across a domain without checking the lockout threshold first is how testers cause outages.

16. Rubeus

Rubeus is a C# toolset for raw Kerberos interaction — requesting tickets, examining them, and testing the specific weaknesses that Kerberos deployments accumulate, including Kerberoasting and AS-REP roasting against accounts with weak configuration. Because it works directly with the Windows Kerberos implementation, it is Windows-only, and it is the reference tool for this class of testing.

One honest caveat on currency: Rubeus is stable rather than actively developed. Its GitHub page shows recent repository activity, but the newest commit on the code itself is from late 2025. That is fine — Kerberos does not change quickly and the tool still works — but it is worth knowing you are running mature software rather than something under weekly development, and worth checking the repository yourself rather than trusting the “last pushed” date GitHub displays.

Best for: Kerberos-specific assessment on an internal AD engagement. Watch out for: ticket requests are logged. Coordinate with the client’s detection team so your activity is attributable rather than mistaken for a real intrusion.

17. Certipy

Certipy enumerates and tests Active Directory Certificate Services, which is the AD component most organisations deployed once and never audited. Misconfigured certificate templates are a recurring route to privilege escalation, and until AD CS tooling matured this whole surface went largely unexamined on internal tests.

It earns a place on a 2026 list precisely because it covers ground the older, better-known tools do not, and because AD CS findings are consistently high-severity when they appear. It is Python and belongs in WSL2. The project is current, with releases through mid-2026.

Best for: the AD CS portion of an internal assessment, which many tests still skip entirely. Watch out for: requesting certificates changes state on the CA and leaves an audit trail — keep a record of what you issued so it can be revoked at the end.

18. Responder

Responder answers LLMNR, NBT-NS and mDNS name-resolution broadcasts, demonstrating a weakness that is nearly universal on internal networks: when a Windows client cannot resolve a name through DNS, it asks the whole local segment, and by default it will authenticate to whoever answers. The finding it produces — disable LLMNR and NBT-NS — is one of the highest-value, lowest-cost recommendations in internal testing.

Of everything on this list, Responder is the one that fits worst on Windows. It needs to receive broadcast traffic on the local segment, and WSL2’s default NAT networking does not give it that. Use a VM with a bridged adapter, or WSL2 configured for mirrored networking. If it appears to run but never captures anything, the tool is fine and your network configuration is the problem.

Best for: demonstrating a name-resolution weakness that most internal networks still have. Watch out for: it is intrusive by design — it responds to real users’ traffic. Run it in agreed windows, and never on a network outside your authorised scope.

Privilege escalation and host survey

19. winPEAS

winPEAS, part of the PEASS-ng suite, enumerates a Windows host for local privilege escalation opportunities and colour-codes what it finds by likely significance. It checks service permissions, unquoted service paths, scheduled tasks, registry autoruns, stored credentials, installed software versions and a long list besides — the checks a competent tester would run by hand, executed in seconds.

It is Windows-only, actively maintained with commits landing regularly, and it is the standard answer to “I have a low-privileged shell, now what”. Read the output rather than skimming the highlights; the colour coding is a heuristic, and the finding that matters is often an unremarkable-looking line about a service binary’s permissions.

Best for: fast, thorough local enumeration once you have any foothold. Watch out for: it is loud on disk and in process telemetry, and endpoint detection flags it readily — which is expected on an authorised test.

20. Seatbelt

Seatbelt is a C# project that runs a long list of host-survey safety checks, gathering the security-relevant configuration of a Windows machine: security settings, credential material locations, installed products, browser and RDP artefacts, and more. Where winPEAS is oriented toward “how do I escalate here”, Seatbelt is oriented toward “what is the security posture of this host”, and the two overlap usefully rather than redundantly.

Like Rubeus it comes from GhostPack and like Rubeus it is mature rather than fast-moving — the newest commit dates to January 2025. It works, it is widely used, and its checks remain relevant, but treat it as stable software rather than something receiving new checks each month.

Best for: systematic host posture assessment, and for the defensive side of a purple-team exercise. Watch out for: the output includes credential-adjacent material and should be handled as sensitive.

Password and authentication testing

21. Hashcat

Hashcat is the fastest password recovery tool available and it is GPU-accelerated, which is precisely why it belongs on a Windows machine: gaming-class GPUs are common on Windows desktops, drivers are straightforward, and the performance difference over CPU cracking is orders of magnitude. It supports an enormous number of hash types, including the Windows NTLM and Kerberos formats you will actually encounter on an AD engagement.

The point of cracking on a test is not the passwords themselves but the statistics: what proportion of the domain’s hashes fall in an hour, how many users share a password, whether the corporate name plus a year is the dominant pattern. That is the evidence that changes a password policy. The project is under constant development — commits land daily — and the Windows binaries are first-class rather than an afterthought.

Best for: offline cracking of hashes recovered during an authorised engagement. Watch out for: cracked passwords are the most sensitive artefact you will produce. Report statistics; do not circulate plaintext lists.

22. John the Ripper

John the Ripper is the older sibling to Hashcat and still worth having. The community “jumbo” build supports a huge range of formats, including many that Hashcat does not, and its bundled conversion utilities — the various *2john scripts that extract crackable hashes from encrypted documents, archives and key files — are frequently the reason it stays installed even on machines where Hashcat does the heavy lifting.

It is CPU-first by design, so it is slower than Hashcat on the formats both support. Openwall maintains it and offers a commercial Pro edition; for testing purposes the free jumbo build is what you want. Windows binaries are available directly from Openwall.

Best for: unusual hash and file formats, and for the extraction utilities. Watch out for: reaching for it by habit when Hashcat would finish in a fraction of the time.

23. THC Hydra

THC Hydra tests authentication against live network services rather than offline hashes — SSH, RDP, FTP, SMB, HTTP forms, databases and dozens more. Its role on a modern test is narrower than it once was, but it remains the standard way to demonstrate that a service accepts default or weak credentials, or that it has no rate limiting or lockout at all.

Run it from WSL2 on Windows. And use it carefully: online attempts against real accounts trigger lockouts, and a careless run can lock out a department and turn your assessment into an incident. In practice the professional pattern is a small, targeted credential set against a known-safe threshold, agreed with the client in advance — not a large wordlist against a production directory.

Best for: proving weak or default credentials on an exposed service. Watch out for: lockout policies, and the availability impact of getting them wrong.

Reverse engineering and built-in Windows tooling

24. Ghidra

Ghidra is the NSA’s software reverse engineering framework, released as free open source in 2019, and it broke a market where the credible option cost several thousand dollars per seat. It disassembles and decompiles binaries across many processor architectures, and the decompiler output — readable C-like pseudocode — is what makes it accessible to testers who are not full-time reverse engineers.

On a Windows pentest it earns its place when you meet a thick client or a custom service and need to understand what it does — how it authenticates, where it stores secrets, what its network protocol looks like. It is a Java application that runs natively on Windows, it is actively developed by the agency, and the community has built a substantial plugin ecosystem around it.

Best for: thick-client and custom-binary assessment. Watch out for: the learning curve, which is real. Budget days, not hours, before it is useful to you.

Bonus: the Sysinternals Suite

The Sysinternals Suite is Microsoft’s own set of Windows internals utilities, and it is the most under-appreciated entry on this list. Process Explorer and Process Monitor show you exactly what a process is doing to the filesystem, registry and network; Autoruns enumerates every persistence location Windows offers; AccessChk reports effective permissions on files, registry keys and services; Sigcheck verifies binary signatures.

These are Microsoft-signed tools that raise no alarms, work on any Windows host, and answer a lot of the questions that dedicated offensive tooling answers more loudly. Autoruns in particular is as much an incident-response tool as a testing one. If you are building a Windows testing machine and want a single free download that pays for itself immediately, this is it.

Running Linux-first tools on Windows with WSL2

Roughly a third of the tools above are Linux-first, and the single decision that makes a Windows testing machine workable is installing WSL2 early rather than fighting native ports one at a time. WSL2 runs a real Linux kernel in a lightweight virtual machine with tight filesystem and network integration — Impacket, NetExec, Nikto, Hydra, sqlmap and Metasploit all behave there the way their documentation says they should.

Kali publishes an official WSL distribution, and its WSL documentation covers installation and the metapackage choices that decide how much of the toolset you pull in. If you want a graphical Kali desktop rather than a terminal, Win-KeX provides one in windowed, seamless or full-screen modes — which closes most of the remaining gap between “testing from Windows” and “testing from Kali”.

Know the limit, though. WSL2’s default NAT networking means the Linux environment does not present as a first-class device on your LAN, which breaks any tool that needs to receive inbound connections or see broadcast traffic — Responder is the classic casualty, and raw layer-2 work has the same problem. Mirrored networking mode addresses much of this on current Windows builds, but when a network-level tool behaves strangely under WSL2, suspect the networking mode before you suspect the tool. For that class of work, a bridged VM remains the reliable answer.

Tools that no longer belong on a 2026 Windows list

Security tool listicles rot in a specific way. The tool gets archived, renamed or absorbed, but its old page keeps returning a healthy HTTP 200 with a familiar logo and a five-figure star count, so nothing about visiting it tells you it is finished. We checked each of the following against its newest commit rather than its “last updated” badge, because those two dates can differ by years.

Two of these deserve a note because the gap between appearance and reality is so wide. Covenant’s repository shows activity in 2024 but its newest actual code commit is from April 2021 — a three-year difference between what the page suggests and what the code says. Nishang shows a similar, smaller gap. GitHub’s “pushed” timestamp updates for events that are not commits, so it is not a liveness signal; the commit history is. It is a two-click check and it is worth doing before you build a workflow around any tool.

We also removed a tool from our own previous version of this list. Cyver Core appeared here as a Windows pentesting tool; it is a live, well-regarded product, but it is a browser-based pentest reporting and delivery platform — workflow software for managing engagements and producing client deliverables. That is a useful category and a genuinely different one. It is not a Windows pentesting tool and it should not have been listed as a peer of Nmap.

Authorisation: the part that is not optional

Everything above is dual-use. The same binaries that evidence a client’s credential-hygiene problem are the binaries that appear in real intrusions, and the law does not distinguish between them on the basis of your intent. What separates a penetration test from a computer crime is documented authorisation from someone with the authority to grant it — nothing else.

In the United States, unauthorised access to a computer system is prosecuted under the Computer Fraud and Abuse Act, codified at 18 U.S.C. § 1030. In the United Kingdom the equivalent is the Computer Misuse Act 1990, under which unauthorised access is an offence regardless of whether any damage results. Most other jurisdictions have close analogues. Scanning a system you do not own, without permission, is not research and it is not a grey area.

A professional engagement is defined before any tool runs. At minimum you need a signed statement of work naming the client, a scope document listing exactly which IP ranges, domains and applications are in and out of bounds, the testing window, named emergency contacts on both sides, agreed rules on destructive testing and data handling, and confirmation that the person signing actually has authority over the assets. If the target is hosted, the hosting provider’s testing policy applies too. Get all of it in writing before you install anything.

What the defenders see — and why that is part of the test

Almost everything on this list is detectable, and treating that as a feature rather than an obstacle produces a better engagement. Mimikatz, winPEAS and the C2 frameworks are heavily signatured; Kerberos ticket requests, LDAP enumeration and credential validation all leave events in the Windows security log; Responder’s activity is visible to any network monitoring worth the name.

The professionally useful move is to record precise timestamps for every significant action you take, then compare that timeline against the client’s alerts at the end of the engagement. The gaps are findings in their own right, and often the most valuable ones in the report. If you ran SharpHound across the domain at 14:20 and nothing fired, the client has a detection gap that matters more than most of the individual vulnerabilities you found. That is a stronger deliverable than a longer list of missing patches, and it is the reason purple-team exercises — where the testing and defending teams work in the open together — increasingly replace pure black-box testing for mature organisations.

Building a Windows pentesting lab

Because most people already own a Windows machine, a capable practice lab costs nothing beyond hardware you have. A workable setup is a Windows host with 32GB of RAM if you can manage it and 16GB at minimum, virtualisation enabled in firmware, WSL2 with the Kali distribution installed, and Hyper-V or VMware Workstation for full guests.

Inside that, build a small Active Directory environment: a Windows Server domain controller on an evaluation licence, a couple of joined Windows client VMs, and an isolated internal-only virtual switch so nothing you do can reach your real network. Deliberately misconfigure it — a service account with a weak password and a service principal name, a certificate template with permissive enrolment rights, LLMNR left enabled — and then find those misconfigurations with the tools above. Building the vulnerable environment teaches you at least as much as attacking it, because you learn which settings create the exposure.

Keep the lab genuinely isolated, keep the offensive tooling off any machine you use for daily work, and snapshot the VMs before each exercise so you can reset in seconds rather than rebuilding. If you would rather not build the environment yourself, the hosted practice platforms provide pre-built vulnerable Windows and AD targets with explicit permission to attack them.

Frequently asked questions

Can you do penetration testing on Windows, or do you need Kali Linux?

You can do penetration testing on Windows. Many core tools — Nmap, Wireshark, Burp Suite, Nessus, Hashcat, Ghidra — ship native Windows builds, and the Active Directory tooling that matters most on enterprise engagements is Windows-only by design. Linux-first tools run through WSL2. Kali remains convenient because everything is pre-installed, but it is a packaging advantage, not a capability one.

What are the best free pentesting tools for Windows?

Nmap, Wireshark, ZAP, Burp Suite Community, sqlmap, Metasploit Framework, Hashcat, Ghidra and the Sysinternals Suite are all free and cover most of the workflow. Nessus Essentials is free for up to 16 IP addresses. The Active Directory tooling — Mimikatz, BloodHound CE, SharpHound, Impacket, NetExec, Rubeus, Certipy, winPEAS, Seatbelt — is entirely free and open source.

Do I need WSL2 for Windows penetration testing?

Not for everything, but you will want it. Impacket, NetExec, Nikto, Hydra and Metasploit are all substantially easier to run under WSL2 than natively. The exception is tooling that needs raw network access or must receive inbound LAN connections — Responder in particular — where WSL2’s default NAT networking gets in the way and a bridged virtual machine is the better answer.

Will Windows Defender block these tools?

Yes, for a good portion of them — Mimikatz, Rubeus, winPEAS, Metasploit payloads and the C2 frameworks are all detected, correctly, because they are the same tools used in real attacks. The right response is a dedicated, isolated testing machine with documented exclusions, not disabling protection on a computer you also use for anything else. On client engagements, coordinate exclusions with the client rather than arranging them yourself.

Is CrackMapExec still maintained?

No. The CrackMapExec repository was archived in December 2023 and has received no updates since. NetExec is the maintained community fork and is under active development. The archived repository still loads normally and still carries its large star count, so the only reliable signal is the archive notice and the commit history — install nxc rather than cme.

Is ZAP still an OWASP project?

No. Zed Attack Proxy left OWASP and now describes itself on its own site as an independent open-source project, sponsored by Checkmarx. The software is still free, still open source, and still called ZAP. Articles that refer to “OWASP ZAP” are using an outdated name, which is a reasonable signal that the rest of the article is out of date too.

Is a vulnerability scan the same as a penetration test?

No, and the distinction is worth being explicit about with clients. A vulnerability scanner such as Nessus or Invicti compares systems against a library of known issues and produces a list of potential findings. A penetration test uses human judgement to chain findings together and demonstrate what an attacker could actually achieve. A scan is an input to a test, not a substitute for one.

What do I need before I can legally use these tools?

Written authorisation from someone with authority over the target systems: a signed statement of work, a scope document defining what is in and out of bounds, an agreed testing window, named contacts on both sides, and agreed rules on destructive testing and data handling. Without that, unauthorised access is an offence under the Computer Fraud and Abuse Act in the US and the Computer Misuse Act 1990 in the UK. For practice, use your own isolated lab or a platform that grants explicit permission.

Learning to use these tools properly

Downloading the tools is the easy part. Knowing which to reach for, how to interpret what comes back, and how to write it up so a client can act on it is the job, and that is what structured training buys you. If you are working toward this professionally, our guide to the best penetration testing courses compares the options on merit, and the ethical hacking courses roundup covers the broader foundations. For the networking knowledge that underpins all of it — and the lack of which is the most common reason people stall — start with computer networking courses.

Before any of that, read whether ethical hacking is legal and work through a structured penetration testing methodology, because a tester who runs tools without a method produces findings without a narrative — and the narrative is what the client is paying for.

Compare Penetration Testing Courses →

The bottom line

The Linux-only assumption about penetration testing is a decade out of date. Install WSL2, add the native Windows tools, and you have a testing machine that handles everything a Kali VM does plus a category — Active Directory and Kerberos assessment — where Windows is genuinely the better platform rather than a workaround.

If you are starting from nothing, install Nmap, Wireshark, Burp Suite Community and the Sysinternals Suite today, add WSL2 with Kali this week, and build the small Active Directory lab described above before you touch anything you do not own. The tools are free; the discipline around them is what makes you employable.

Related guides

• Kali Linux tools — the Linux counterpart to this list
• Web application pentesting tools — deeper coverage of the web testing category
• Network penetration testing — external, internal and Active Directory testing end to end
• Penetration testing methodology — the frameworks that structure an engagement
• Wi-Fi pentesting tools — wireless assessment tooling
• iOS penetration testing and mobile app security testing tools — the mobile side
• Hacking terminology — the vocabulary, defined
• Is ethical hacking legal? — the authorisation question in full
• Programming languages for hacking — where PowerShell and C# fit