21 Best Kali Linux Tools for Hacking and Penetration Testing

Kali Linux is an open-source distribution designed for information security tasks, including computer forensics, penetration testing and security research. It includes hundreds of pre-installed security hacking tools that make it indispensable for ethical hackers and cyber security professionals.¹

In addition to web applications, you can hack an iPhone with Kali Linux. You can also take advantage of Android hacking tools for Kali Linux. Of course, given the nature of penetration testing, it’s critical for you to use these tools ethically and with explicit permission. Otherwise, you could be subject to legal fines and penalties.²

Of all the tools available in Kali Linux, this article will explore the top 21 for hacking and penetration testing and give you an overview of how they work.

Nmap helps you improve your network security and perform assessments to identify vulnerabilities. It’s a command-line network-scanning tool that discovers networks, services and hosts. With Nmap, you send out a data packet to a port and IP address. When it gets a response, it analyzes it and generates a report. It identifies network hosts by IP address or port and uses TCP/IP stack fingerprinting to discover a device’s operating system and hardware components.³

The Metasploit penetration testing tool is a platform on which you can create your own security tools and exploits. It includes everything you need to create and deploy an exploit within a single environment.

Inside, you’ll find an extensive library of exploits, payloads and auxiliary models that support functions such as remote code execution and privilege escalation. You can choose from numerous security assessment options. Post-exploitation modules let you further exploit the compromised system through monitoring, data extraction or lateral movement.⁴

This all-in-one web application security testing tool is widely used by security researchers to automate repetitive tasks and test target environments deeper with semi-automated and manual testing tools. It acts as a proxy server, scanner and intruder for comprehensive functionality. It scans single-page applications and application programming interfaces (APIs) and supports HTTP/2-based testing. The free Burp Suite Community Edition offers basic features and you can upgrade for professional and enterprise features.⁵

Wireshark is one of the best Kali tools for capturing and analyzing network traffic. You can use it to gain access to and analyze real-time traffic or previously captured traffic. This analysis gives you insight into network behavior and can help you identify security threats. You can read data from ethernet, IEEE 802.11, PPP and loopback networks. Wireshark offers display filters, plug-in support, VoIP call detection and raw USB data capture.⁶

Designed to help protect against wireless attacks, this suite for wireless network security testing helps you discover, capture and analyze Wi-Fi network traffic. It includes a detector, a packet sniffer, a password cracker and a wireless local area network (LAN) analysis tool. You can use it for cracking WEP, WPA/WPA2 and WPA2 keys and automating other means of breaking wireless networks. It also has an injector and frame replay tool, so you can launch deauthentication attacks.⁷

John the Ripper is a password-cracking tool that helps identify vulnerabilities in password security through a simple command-line interface. You can use it for password security auditing and recovery. It supports various cipher and hash types, including passwords for Linux, BSD, macOS and Windows. It also works with database and web application passwords and encrypted private keys. It’s a free application, but you can opt for paid versions tailored to specific operating systems.⁸

Hydra is another Kali Linux password-cracking tool that helps identify security vulnerabilities in various protocols. It supports attacks on multiple protocols and parallelized connections. You can use it for multiple types of brute-force attacks and combine it with wordlist generators. Its modular architecture supports website forms and protocols such as FTP, SSH, POP3, and IMAP. It also lets you create custom scripts.⁹

With SQLMap, you can detect and exploit SQL security vulnerabilities in databases and web applications. This automated SQL injection tool includes support for database management systems, including MySQL, PostgreSQL, MariaDB, SQLite and many more for database takeovers. You can use it to execute six database techniques:¹⁰

• Error-based
• Union query-based
• Boolean-based blind
• Time-based blind
• Stacked queries
• Out-of-band

Nessus is a comprehensive vulnerability scanner that lets you identify security vulnerabilities, misconfigurations, and other potential threats in applications and systems. It comes equipped with a database of regularly updated vulnerability checks. You can use it to discover sensitive data, audit configurations, and detect malware. Nessus is available in a free version, and there are two paid options with additional modules and features.¹¹

This web server scanner tool allows you to identify potential security vulnerabilities such as misconfigurations and security risks in web servers. Nikto is a command-line tool that uses IP addresses and domain names as arguments. It analyzes the server and gives you a report that includes information about the server and its vulnerabilities. You can use Nikto to identify more than 7,000 dangerous files and CGIs. It offers full SSL and HTTP proxy support.¹²

Snort is a network intrusion detection and prevention system (NIDS/NIPS) that performs real-time traffic analysis and packet logging. Its rule-based detection capabilities let you identify many types of threats by defining specific rules or signatures. You can use it in different modes depending on your needs. By analyzing packet headers, content patterns and payloads, Snort can detect threats in protocols such as IP, TCP, UDP and ICMP.¹³

ZAP is an open-source web application security scanner with automated vulnerability scanning features. It automatically detects many security flaws. It functions as a man-in-the-middle proxy to intercept and analyze traffic between your browser and the application you’re visiting, and works by scanning both actively and passively and includes advanced features for experts. You can embed ZAP into your continuous integration/continuous delivery (CI/CD) pipeline to integrate security into your DevOps process.¹⁴

Maltego is an open-source intelligence (OSINT) tool used by security researchers that provides a graphical analysis of relationships through data mining. It allows you to uncover relationships and patterns by analyzing data from different sources. You can view up to a million visible entities on the map, and the pattern recognition includes block, hierarchical, circular and organic layouts. You can also automatically combine and link map information for deeper insights.¹⁵

You can use Gobuster to discover hidden resources on web servers and identify potential security vulnerabilities. Hidden paths can sometimes expose forgotten backup locations, sensitive files and unsecured administrator areas. This directory and file brute-forcing tool is fast and efficient. It’s built in the Go language and lets you specify custom wordlists, file extensions and request headers.¹⁶

THC-Hydra is a fast network log-on cracker that supports numerous protocols and services. It performs brute-force attacks on network services to find weak or default passwords. Hydra uses parallel attacks to automatically test multiple username-and-password combinations on a target service.¹⁷

With SET, you can create believable social-engineering attacks to identify security vulnerabilities in human behavior. SET allows you to determine how susceptible a person or organization is to manipulation, phishing or credential harvesting. It includes infectious media generation and lets you generate phishing websites and email-based attacks.¹⁸

BeEF lets you test security vulnerabilities through real-time attacks against web browsers. It identifies exploitable weaknesses in a browser and lets you check for vulnerabilities such as cross-site scripting and HTML injection. You can also create custom browser-based attacks to target specific weaknesses. Its other features include keystroke logging, browser proxying and plug-in detection.¹⁹

Empire is a PowerShell post-exploitation framework built in Python that helps identify vulnerabilities in compromised systems. It’s similar to Metasploit and lets you easily run scripts to establish persistent connections back to your machine. You can use Empire to maintain control over compromised systems and take advantage of them for attacks such as privilege escalation and extracting password hashes.²⁰

Recon-ng is a web reconnaissance framework that uses OSINT data for penetration testing. Its modular design operates on a command line with syntax similar to Metasploit. Each module is designed to perform specific tasks such as domain enumeration, contact information gathering and vulnerability assessment. You can also create your own modules to expand its functionality.²¹

This disk encryption software lets you protect sensitive data during testing. It supports strong encryption algorithms, including AES, Serpent and TwoFish. You can choose multiple algorithms for additional security. With VeraCrypt, you can create encrypted volumes to protect system drives and use it alongside your penetration testing tools so your data isn’t accidentally compromised.²²

Cuckoo Sandbox is an automated malware analysis system that lets you analyze suspicious files and behaviors. It provides an isolated environment in which you can execute suspicious files. Cuckoo Sandbox observes the files and gives you a detailed report on their activities so you can identify and understand the potential threat. You can also use the sandbox to develop and test security measures against emerging threats.²³

Like Parrot, Kali Linux is a valuable resource for ethical hacking and implementing your organization's cybersecurity framework. The online Master of Science in Cybersecurity at Yeshiva University’s Katz School of Science and Health will equip you with the foundational technical knowledge and strategic skills to effectively evaluate cybersecurity risks and management tools, as well as to lead cybersecurity teams. Speak to an admissions outreach advisor today to find out how the curriculum can help you develop and refine the technical and management skills needed to accelerate your cybersecurity career.