Here are 12 popular tools widely used by pentesters worldwide, helping to identify security vulnerabilities and promptly address them. For convenience, let's divide them into 4 categories: comprehensive tools, bruteforcers, network scanners, and traffic analyzers. Some of these tools come pre-installed in Kali Linux, while others are available for download.
Comprehensive Tools
These are programs characterized by extensive functionality that provide comprehensive vulnerability checks.
Burp Suite
A popular platform for testing web application security, available on Kali Linux out of the box. Essentially, it's a set of interconnected components that provide a complete security audit.
Its functionalities extend beyond file searching, application content viewing, password cracking, fuzzing, intercepting, and modifying requests. Additional extensions for Burp Suite, capable of enhancing the program's functionality, can be found in the BApp Store.
Users can choose from three available plans.
OWASP ZAP
A cross-platform open-source tool supported by security experts worldwide and sharing many similarities with Burp Suite. OWASP ZAP is user-friendly, featuring multiple windows in its interface. It supports 13 languages, including English.
It automatically detects security vulnerabilities in web applications during development and testing. Thus, the program is useful not only for pentesters but also for web developers themselves.
Metasploit
Metasploit Framework is a popular open platform for creating and debugging exploits for various operating systems. It includes a vast opcode database and allows attacks to be hidden from IDS/IPS systems, making vulnerability testing closely resemble real-world scenarios.
At the time of writing, the project boasts over 700 contributors. Metasploit Framework operates on Windows, Linux, and other UNIX-like systems.
Bruteforcers
Bruteforcers specifically aid in gaining unauthorized access to accounts, websites, and computer systems by systematically trying different combinations of characters. Some may argue that bruteforcing is outdated. However, this type of attack remains relevant, with the transition of the world to remote work only increasing the number of bruteforce attacks.
John the Ripper
A cross-platform open-source tool used for auditing weak passwords. Despite its provocative name, John the Ripper has established itself well in the pentesting sphere. The program supports multiple attack methods:
Dictionary-based brute force
Full brute force
Hybrid method
John the Ripper comes with a convenient GUI called Johnny, which can be installed separately. However, Linux users will either have to compile it from source themselves or settle for the console version.
THC-Hydra
THC-Hydra is a user-friendly multifunctional password bruteforcer that has gained popularity among pentesters worldwide. Hydra supports a wide range of services, boasts high speed, reliability, and open-source code. It operates through a command-line interface using dictionaries.
RainbowCrack
A popular hash cracker characterized by its high speed. Unlike many bruteforcers, RainbowCrack employs a different method of cracking: instead of brute-forcing combinations and computing and comparing the hash with the desired value, RainbowCrack compares the hash with values from a precomputed table. This means time is only spent on comparison, facilitating quick results.
On the official website of the program, one can find demos and ready-made rainbow tables for LM, NTLM, MD5, and SHA1 hashing algorithms.
Network Scanners
Such programs are intended for scanning local and external networks to map them and search for potential vulnerabilities.
Nmap
A free utility for network scanning and security auditing. The tool is widely used for node scanning, obtaining a list of open ports, scanning running services, and identifying hosts on the network. Network Mapper supports various methods of concealing the scanning process, parallel scanning, bypassing IDS systems, and firewalls.
The product has a cross-platform GUI called Zenmap.
ZMap
ZMap stands out for its high speed. Initially created as a faster alternative to Nmap for scanning entire networks rather than individual fragments. To achieve a speed of 1.4 million packets per second, an ordinary computer with a gigabit connection is sufficient.
The question arises: why then use Nmap? The thing is, ZMap has a significant drawback: very high load, which can disrupt network equipment. Therefore, for pinpoint scanning and small networks, it is preferable to use Nmap.
Masscan
Another mass asynchronous scanner that operates at speeds of up to 25 million packets per second. Useful for scanning vast networks such as the Internet. The syntax of Masscan is similar to Nmap, and its speed exceeds that of ZMap. However, the main disadvantage is the same as the latter: a huge network load.
Traffic Analyzers
These are programs that allow for intercepting and analyzing one's or others' traffic.
tcpdump
tcpdump is a command-line sniffer that allows you to see which packets are passing through the network interface at any given moment. It is most often used for network debugging and educational purposes, but the utility's capabilities also allow for network attacks and host scanning.
Over its existence, the report format of this tool has become a kind of standard for other analyzers, so tcpdump works seamlessly with other programs.
Wireshark
Wireshark is a cross-platform network protocol analyzer that captures network packets in real-time, views their contents, sorts and filters the received information, displays network traffic load statistics, and much more. Its capabilities are similar to those of tcpdump, but Wireshark benefits from a user-friendly interface, sorting, and filters. The tool is open-source.
The analyzer is widely used in government and educational institutions, commercial and non-commercial enterprises.
mitmproxy
A console utility for debugging, testing, evaluating privacy levels, and penetration testing. With mitmproxy, you can intercept, test, modify, and replay HTTP traffic streams. Thanks to this functionality, the utility is widely used not only by hackers and pentesters but also by web application developers for timely debugging.