Whether you’re a new cybersecurity professional or an expert ethical hacker, there’s a good chance that Kali Linux plays a big role in your exploits.
Kali is based on Debian and offers a stable experience with the latest cybersecurity software. The distro supports hundreds of security-oriented tools that facilitate penetration testing and digital forensics.
Here’s a shortlist of 20 of the best tools available on Kali Linux
#1 Aircrack-ng
If you want to discover nearby wireless networks and then capture and analyze their data, Aircrack-ng is the best tool to use.
The network security assessment tools include a detector, wireless LAN analysis tool, packet sniffer, and password cracker. If used skillfully, the tool can crack WPA and WPA2 keys, and it is free to use as it is open-source.
Features
- Packet sniffer
- Wireless card server
- Automatic WEP cracking and WPA handshake logging
- Packet injector and a frame replay tool that supports de-authentication attacks
- Virtual tunnel interface creator
#2 Autopsy
Autopsy is one of the most interesting web browsers out there. It comes equipped with a digital forensics tool. You can use it to extract information from websites and devices.
Law enforcement agencies and cyber forensics professionals typically use it to examine and recover data from various systems. The browser is an open-source project, so you can install it without paying right away.
Features
- Timeline analysis tool to track user activity on a website.
- Hash databases that allow you to verify file integrity.
- Hash filtering to flag bad files.
- Powerful keyword search tool.
- Discovering deleted or hidden information on a website.
#3 BeEF
BeEF is short for Browser Exploitation Framework. It is a tool for assessing the protection that web browsers offer. By helping you identify the weaknesses in a browser, BeEF aids in building secure web apps.
The tool is typically used as a command-line-powered attack point that hooks into a web browser. This way, you can take limited control over a browser tab and carry out an attack.
This free and open-source tool allows you to carry out HTML injection and cross-site scripting attacks. It also comes with restful API and an extension API.
Features
- Browser proxying
- Plugin detection
- Metasploit integration
- Keystroke logging
#4 Burp Suite
Burp Suite is a tool you should check out if you’re not as interested in hacking browsers as in hacking web apps. It enables you to discover the vulnerabilities of web apps, automating the repetitive tasks in tests. It also features many semi-automated testing tools.
What’s interesting is that the tool can act as a proxy server, scanner, and intruder. But that’s not all. You can also use it as a sequencer, decoder, or repeater.
The community edition of this tool is free to use if you sign up for a trial. However, the free version has a limited feature set.
Features
- Supports HTTP/2-based testing
- Scans APIs and single-page applications
- Several authentication sequences are available
- Out-of-band application security testing helps minimize false positives
- Smart automation
#5 Fluxion
If you’re conducting a security audit, Fluxion is a must-have. With it, you can attack Wi-Fi access points with a simple interface that can set up a fake wireless network, making it an excellent social engineering tool.
You can also use this open-source tool to simulate Man-in-the-Middle attacks.
Features
- De-authentication attacks
- Handshake snooper and captive portal for MITM attacks
- Credential harvesting
- Evil twin attacks
#6 John the Ripper
You can use John the Ripper with simple lines on a terminal and do a full password security audit. The freemium tool also allows you to carry out password recovery.
The paid version of the tool comes with some interesting features tailored for specific distros, and the licensing fees depend on the type of package you need.
Features
With John the Ripper, you can crack various hash and cipher types:
- Windows, BSD, macOS, and Linux user passwords.
- Encrypted private keys.
- Captured network traffic.
- Database and web app user passwords.
- Archives, documents, and filesystems.
#7 King Phisher
If you want to simulate a phishing campaign to promote cybersecurity awareness, King Phisher is the best tool to use. Organizations typically use it to determine their susceptibility to phishing attacks.
One of the best things about the tool is that it can simulate both simple and complex phishing campaigns.
The open-source King Phisher tool also boasts a versatile architecture that gives you full control over the emails and other files available on a server.
Features
- 2FA
- Allows running multiple phishing campaigns
- Integrated SPF checks
- Webpage cloning
- Credential harvesting from landing pages
- Supports emails with embedded images
#8 Lynis
Looking to perform a comprehensive scan of your system’s health? Look no further than Lynis.
It is a compliance testing and system hardening tool used by web developers and IT security professionals. Not to mention, sysadmins often use it to find weaknesses in their machines.
With Lynis, you can perform scans of the available system tools or carry out custom-made system tests. For this reason, Lynis doesn’t require any dependencies.
Though the tool is free, you must pay a monthly subscription if you want to use the full array of available features.
Features
- Custom test support
- Hardening index
- Plugin support
- 300+ built-in tests
- Detailed logs
#9 Maltego
Gathering and analyzing data from various sources and finding patterns and relationships becomes easy with Maltego.
It is a data visualization tool with a library of transforms to facilitate data discovery. It also features a graph-formatted visualization of data, enabling link analysis and data mining.
You can use Maltego for free, but you must register on the official site. It’s also worth noting that you can get additional features if you pay for the Pro or Enterprise versions of Maltego.
The paid versions allow you to deploy the tool on multiple devices, including virtual machines. They also provide access to additional transforms.
Features
- Easy information gathering from several data sources.
- Pattern recognition of circular, block, organic, and hierarchical layouts.
- Up to one million viewable entries on the map.
- Auto linking of information on the map.
#10 Metasploit Framework
The Metasploit Framework is a well-known tool amongst pen testers and an excellent choice for building both exploits and security tools. What’s more, you can create and deploy exploits within this framework itself – you don’t need to use other tools.
The framework allows you to configure exploit modules, offering the ability to pair a module with a payload. Of course, you can also use Metasploit to deploy the exploit on a target system.
The free version of Metasploit offers a nice range of supported modules and exploits. However, you can purchase Metasploit Pro to access additional features.
Features
- Easy development of custom payloads and exploits.
- Several security testing options.
- Supported exploits include privilege escalation and remote code execution, among others.
- Modules for recon, lateral movement, and data extraction are also available.
#11 Nessus
Finding potential threats, security gaps, and misconfigurations in systems and applications becomes much easier with Nessus. It is a vulnerability assessment tool boasting a large database of vulnerability checks, which are updated frequently.
You can use Nessus for free and check your devices for vulnerabilities. However, you must purchase the Professional version to access Nessus’ modules.
The Expert version of Nessus offers extra features such as prebuilt scanning policies, cloud infrastructure scanning, and external attack surface scanning.
Features
- Malware detection
- Quick asset discovery
- Sensitive data discovery
- Configuration audits
#12 Netcat
Netcat is another popular tool that enables you to tap into a network. You can use it in the command line to write and read data across a network connection. Netcat supports the TCP and UDP protocols, allowing you to scan and listen to ports.
Besides investigating networks, it allows you to debug and run scripts and programs on them. The tool offers several ways to communicate with websites and their ports.
The best part? Netcat is completely free to use!
Features
- Comprehensive DNS forward and reverse checking.
- Option to use locally configured source port or network source address.
- Loose source-routing capability.
- Support for TCP/UDP connections on any port.
- Randomized port scanning.
- TCP/UDP tunneling mode included.
#13 Nikto
If you want to protect a web app or server from attacks, Nikto is a tool worth checking out. It’s an excellent tool for scanning web environments for security risks and misconfigurations.
Bear in mind that Nikto is a command-line tool and accepts domain names and IPs as arguments.
If you give the tool these details, it will analyze the server of the address you supply. Then, it returns a detailed report with information about potential security risks.
You can download Nikto for free; this tool has no paid options.
Features
- Comprehensive SSL support.
- Scans ports using Nmap file input.
- Identifies over 6700 dangerous files and CGIs.
- Complete HTTP proxy support.
- Detects outdated software, misconfigured servers, and security issues.
#14 Nmap
Nmap is a famous open-source tool that allows you to find and map networks via the command line. It can also map services and hosts and detect any present vulnerabilities.
The tool does this by sending data packets to specific ports and IPs. When it gets a response, it analyzes it and gives you a report.
Features
- Conduct ping scans for host testing.
- Perform fast scans for rapid port scanning.
- Identify network hosts by protocol or port.
- Use TCP/IP stack fingerprinting to determine the OS and hardware elements of network devices.
#15 Skipfish
Skipfish offers dictionary-based and recursive crawl probes. With it, you can test a target’s security and create an interactive map of the site.
You can use this open-source application for free on your terminal.
Features
- Modular, customizable design.
- Enumeration tracking.
- Support for keep-alive connections, content compression, and range requests.
- Forced response size limiting.
- Identification of potential vulnerabilities like XSS and SQL injection.
#16 Social-Engineer Toolkit
The SET tool is a free, open-source pen-testing kit. It is built with Python and is one of the greatest tools for social engineering. You can use custom attack vectors to make a social engineering attack with it. SET makes it easy to evaluate how vulnerable a company is to manipulation, credential harvesting, and phishing.
Features
- Crafting malicious USB devices.
- Generation of infectious media.
- Execution of email-based attacks.
- Creation of phishing websites.
- Support for diverse attack vectors (e.g., spear phishing, credential harvesting, etc.).
#17 sqlmap
Databases and web apps need to be hardened against SQL injection attacks, and sqlmap is a great tool for it. This free-to-use tool can take over database servers and automate vulnerability scanning.
Features
- Automated and manual SQL injection testing.
- Compatible with various database management systems (DMS), including MySQL, MariaDB, Microsoft SQL Server, SQLite, PostgreSQL, and more.
- Enables you to dump database tables.
- Recognizes password hash formats automatically.
- Six supported SQL injection techniques: time-based blind, error-based, boolean-based blind, out-of-band, UNION query-based, and stacked queries.
#18 Tiger
Written in shell language, Tiger is used to conduct host-side intrusion detection and security audits. With Tiger, you can combine various tools such as intrusion detection systems, log checkers, integrity checkers, etc.
You can use this free tool to check various aspects of a UNIX system.
Features
- Easily expandable modular design.
- Shows security gaps in system logs, network settings, and password policies.
#19 Wireshark
Wireshark is perhaps the best-known tool for network analysis and troubleshooting. It can capture network traffic and analyze the packets. The GUI-based tool is free to use and easily identifies security threats.
Features
- Captures data in real time.
- Display filters.
- Captures raw USB data.
- Detects VoIP calls.
- Plugin support.
- Reads data from Ethernet, IEEE 802.11, PPP, and loopback networks.
#20 WPScan
WPScan is an essential tool for everyone with a WordPress site. Besides detecting security issues, it can also detect misconfigurations.
The free version of this tool offers all the features as the Enterprise version, except it limits the number of API requests you can make daily to 25.
Features
- Performs version checks for WordPress installation and plugins.
- Scans for outdated themes, plugins, and core files.
- Tests login credentials through brute-force attacks.
- Conducts security checks for weak passwords, exposed sensitive information, and potential entry points.
