1. Information Gathering: Crucial for reconnaissance and understanding the target.
Nmap: The king of network scanning. Essential for host discovery, port
scanning, service identification, and OS fingerprinting.
Wireshark: A powerful packet analyzer. Capture and inspect network traffic to
understand communication protocols and identify vulnerabilities.
TheHarvester: Gathers email addresses, subdomains, and other information related to
a target organization from public sources.
DNSRecon: Performs DNS enumeration to discover DNS records, zone transfers, and
other DNS-related information.
Whois: Retrieves registration information for a domain name.
2. Vulnerability Analysis: Identifying weaknesses in systems and applications.
Nessus (Essentials/Professional): A comprehensive vulnerability scanner (the
Essentials version is free for home use). While not pre-installed in Kali, it's
highly recommended.
OpenVAS: An open-source vulnerability scanner. A good alternative to Nessus.
Nikto: A web server scanner that checks for known vulnerabilities,
misconfigurations, and outdated software.
wpscan: A WordPress vulnerability scanner. Essential for assessing WordPress sites.
3. Exploitation: Taking advantage of identified vulnerabilities.
Metasploit Framework: A powerful penetration testing framework with a vast
collection of exploits, payloads, and modules. A must-have.
Searchsploit: A command-line search tool for Exploit-DB, a database of publicly
available exploits.
sqlmap: An open-source penetration testing tool that automates the process of
detecting and exploiting SQL injection vulnerabilities.
4. Post-Exploitation: Actions taken after gaining access to a system.
Meterpreter (Metasploit): An advanced payload within Metasploit that provides
interactive control over a compromised system.
Empire: A post-exploitation framework for Windows environments.
PowerSploit: A collection of PowerShell modules that can be used for post-
exploitation tasks.
5. Wireless Attacks: Testing the security of wireless networks.
Aircrack-ng suite: A set of tools for capturing and cracking WEP and WPA-PSK
keys.
Reaver: A tool for exploiting WPS vulnerabilities.
6. Web Application Security: Focusing on web-related vulnerabilities.
Burp Suite (Community/Professional): A comprehensive platform for performing
web application security testing. The Community Edition has some limitations.
OWASP ZAP: An open-source web application security scanner.
dirb: A web directory brute-forcer. Useful for discovering hidden directories and
files.
7. Forensics: Analyzing digital evidence.
Autopsy: A digital forensics platform based on The Sleuth Kit (TSK).
The Sleuth Kit (TSK): A command-line toolset for analyzing disk images and file
systems.
8. Social Engineering Tools:
SET (Social-Engineer Toolkit): A framework for creating social-engineering
attacks, such as phishing campaigns.
9. Password Cracking:
John the Ripper: A fast password cracker.
Hashcat: A powerful password cracker that supports various hashing algorithms.
10. Reporting Tools:
MagicTree: A tool for organizing and managing penetration testing reports.
Customization:
Prioritize: This list is extensive. Focus on the tools most relevant to your
specific penetration testing needs.
Practice: The key to effective penetration testing is practice. Set up a
virtual lab environment to hone your skills.
Updates: Keep your tools updated! Use sudo apt update and sudo apt upgrade
regularly within your persistent Kali live USB.
