Why Only 10 Tools?
Kali Linux ships with over 600 tools. That's overwhelming for beginners — and honestly, most pentesters only use 10–15 tools regularly. The rest are situational: forensic tools, niche reverse engineering utilities, or legacy software that's been replaced by something better.
This list covers the tools you'll actually use 80% of the time. Master these, and you can complete most CTF challenges, perform basic web app testing, audit a WiFi network, and crack hashes from a compromised system. Each tool is broken down by what it does, when to use it, the install command (most are pre-installed on Kali), and a working example you can try in a lab.
If you've just installed Kali, work through the 25 things to do after install first, and if the terminal still feels unfamiliar, spend an hour with the commands every beginner should know. Both make the tools below much easier to follow.
TL;DR — The 10 tools and what they do
1. Nmap — network scanning | 2. Metasploit — exploitation framework | 3. Burp Suite — web app testing | 4. Wireshark — packet analysis | 5. Aircrack-ng — WiFi cracking | 6. Hashcat — GPU password cracking | 7. John the Ripper — CPU password cracking | 8. Hydra — online brute-force | 9. SQLMap — SQL injection | 10. Gobuster/FFUF — directory brute-force
Nmap The first tool you run on any engagement
Nmap (Network Mapper) is the universal first step in any pentest. It tells you what hosts are alive on a network, what ports are open, what services are running on those ports, and even guesses the operating system. Every other tool you'll use depends on the information nmap gives you first.
If aircrack-ng is the gateway tool that brings WiFi people into security, nmap is the gateway tool for everyone else. It's been actively maintained for over 25 years and still gets regular updates — version 7.95 dropped in 2024 with new NSE scripts and improved IPv6 support.
Install
Quick start
When to use it: Always first. Before you can attack anything, you need to know what's there. The output of an nmap scan tells you which subsequent tools to reach for — see SSH? Try Hydra. See a web server? Open Burp Suite. See SMB? Try Metasploit's auxiliary modules.
Read full nmap tutorial →Metasploit Framework The exploitation framework that runs the industry
Metasploit is what turned penetration testing from a PhD-level skill into something you can actually do systematically. It's a framework for organizing exploits, configuring payloads, and running post-exploitation tasks. The Kali version (msfconsole) gives you access to thousands of exploits, hundreds of payloads, and a giant library of auxiliary modules for enumeration and scanning.
Beginners often expect Metasploit to be an "auto-hack" button. It's not. It's a framework that organizes complex attacks into searchable, configurable modules. The skill is in knowing what exploit applies to what target — that's where your nmap output feeds in.
Install
Quick start
When to use it: When nmap shows you a vulnerable service version. EternalBlue (MS17-010) on Windows 7? Metasploit. Vulnerable Samba version? Metasploit. Outdated CMS plugin? Often Metasploit. The framework is the difference between knowing a vulnerability exists and actually exploiting it.
Full tutorial coming soonBurp Suite The web app testing standard
More than 70% of modern penetration tests involve web applications, and Burp Suite is the tool that makes web testing tractable. It's an intercepting proxy — it sits between your browser and the target web app, letting you capture, inspect, modify, and replay every HTTP/HTTPS request.
The Community Edition is free and ships with Kali. It covers most learning use cases. The Professional edition unlocks the active scanner and full-speed Intruder, and at $449/year is worth it once you're doing real client work or bug bounty hunting.
Install
Core features
- Proxy: Intercept and inspect every request your browser makes
- Repeater: Manually resend and tweak requests — essential for testing SQLi, XSS, IDOR
- Intruder: Automated payload insertion (brute force, fuzzing, parameter manipulation)
- Scanner: Automated vulnerability detection (Pro only)
- Decoder/Comparer: Encode/decode data and diff requests
When to use it: Any time you're testing a web application or API. Configure your browser proxy to 127.0.0.1:8080, install Burp's CA certificate, and every request flows through Burp where you can inspect or modify it before it hits the server.
Wireshark Network packet analysis at its best
Wireshark is the most widely-used packet analyzer in the world. It captures network traffic in real time and lets you dissect individual packets at every protocol layer. For attackers, it's how you sniff cleartext credentials, analyze captured handshakes, and confirm what your tools are actually sending. For defenders, it's how you investigate incidents and understand normal vs anomalous traffic.
One of the best learning exercises: open Wireshark, telnet to a test server, and watch your username and password fly by in plaintext. That visceral "oh, that's why HTTPS matters" moment never leaves you.
Install
Essential filters
When to use it: Capturing WPA2 handshakes (analyze the .cap file in Wireshark to confirm a clean 4-way handshake before cracking). Investigating what a tool is actually sending. Analyzing traffic from a malware sample in a lab. Understanding any protocol you're new to.
Read full Wireshark tutorial →Aircrack-ng The complete WiFi auditing suite
Aircrack-ng isn't one tool — it's a suite of WiFi auditing utilities that work together. Use airmon-ng to put your adapter in monitor mode, airodump-ng to capture packets, aireplay-ng to send deauth frames and force handshakes, and aircrack-ng to crack the captured handshake.
For modern WPA2 cracking, the workflow is: capture the handshake with airodump-ng, then use hashcat (not aircrack-ng) for the actual cracking — hashcat on a modern GPU is roughly 185x faster than aircrack-ng on CPU.
Install
WPA2 capture workflow
When to use it: Any wireless engagement. The hardware requirement is real — you need a USB WiFi adapter that supports monitor mode and packet injection. See my guide to the best WiFi adapters for Kali.
Read full WPA2 cracking tutorial →Hashcat GPU-accelerated password cracking
Hashcat is the world's fastest password recovery tool. It uses GPU compute (CUDA on NVIDIA, OpenCL on AMD) to test billions of password candidates per second. On an RTX 4090, it cracks MD5 at ~164 GH/s — meaning the entire 14-million-entry RockYou wordlist runs in under a millisecond.
The killer feature is rules. A rules file like best64.rule tells hashcat to automatically generate variations of each wordlist entry — appending years, capitalizing letters, substituting characters. A 14M wordlist with best64 becomes 900M+ candidates without storing them on disk.
Install
Common attacks
When to use it: Whenever you have a hash to crack — password databases, /etc/shadow, NTLM dumps, WPA2 handshakes, KeePass databases, ZIP files. Always pair with a good wordlist; see my wordlists guide.
Read full hashcat tutorial →John the Ripper The classic password cracker
John the Ripper has been the standard password cracker since 1996, and it's still indispensable for one specific reason: it auto-detects hash types. Throw it any hash file and it figures out the format and starts cracking. Hashcat is faster but pickier about format flags. John is more forgiving and has unique modes hashcat doesn't (like --single mode that uses GECOS info from /etc/passwd).
For learning, John is easier. For maximum performance on big jobs, hashcat wins. Most pros use both.
Install
Common usage
When to use it: Quick hash-type identification, cracking encrypted files (ZIP/PDF/Office/KeePass have helper scripts that ship with John), or when you want format auto-detection. For long-running cracks on big hash sets, switch to hashcat.
Full tutorial coming soonHydra Online brute-force across 50+ protocols
Hydra (THC-Hydra) is the standard tool for online brute-force attacks. While hashcat and John work on captured hashes offline, Hydra attacks live services — SSH, FTP, RDP, MySQL, web login forms, and 50+ other protocols. It's the tool you reach for when you've enumerated a service with nmap and want to test its credential strength.
Real-world fail2ban and modern rate limiting will block Hydra attacks within seconds, which is exactly why pentests catch this. If your client's SSH server lets you brute-force forever, that's a finding.
Install
Common attacks
When to use it: Testing the strength of authentication on any service. Always start with a small, targeted wordlist (default credentials, common admin passwords) before throwing all of rockyou.txt at it.
Full tutorial coming soonSQLMap Automated SQL injection testing
SQL injection is still on the OWASP Top 10 in 2026, and SQLMap is the tool that automates exploiting it. Point it at a parameter you suspect is vulnerable and it'll detect the injection type, identify the database, dump tables, extract data, and even pop a shell on the underlying OS in some cases.
Don't run sqlmap blindly against production targets without authorization. It's noisy, it generates a lot of traffic, and aggressive flags (--risk=3 --level=5) can crash the target database. Most CTFs and bug bounty programs explicitly require slower, targeted use.
Install
Common usage
When to use it: When you find any parameter that interacts with a database. Pair it with Burp Suite — save a suspicious request from Burp, feed it to sqlmap with -r.
Gobuster & FFUF Directory and subdomain brute-force
When you find a web server, the first question is "what's actually here?" Gobuster and FFUF answer that question by brute-forcing common paths against a wordlist. Hidden admin panels, backup files, API endpoints, dev environments — all the things developers forget to remove.
FFUF is the modern replacement for Gobuster (faster, more flexible). Both ship on Kali, both work the same way conceptually. Use whichever feels right.
Install
Common usage
When to use it: Right after nmap finds a web server. Use it before Burp Suite — directory enumeration tells you what URLs to investigate manually. Pair with the SecLists wordlists for best results.
Full tutorial coming soonNow What?
If you're new to all of this, don't try to learn all 10 tools at once. Pick a category that interests you and go deep:
- Network/system pentesting: Master Nmap → Metasploit → Hydra in that order. Practice on Metasploitable 2 or HackTheBox.
- Web application testing: Master Burp Suite → SQLMap → FFUF. Practice on DVWA, Juice Shop, or PortSwigger Web Security Academy (free).
- Wireless: Master Aircrack-ng → Hashcat together. You'll need a USB WiFi adapter — see my adapter guide.
- Password cracking: Master Hashcat → John together. Stock up on wordlists.
- Network defense / blue team: Master Wireshark + Nmap. These are also defender tools.
- Radio / SDR: Branch into the wireless-signal world with a cheap software-defined radio — see my RTL-SDR on Kali guide to decode sensors and track aircraft.
Set Up a Practice Lab
You can't (legally) use these tools without targets you control. The standard beginner lab is:
- Kali Linux VM — your attack box (install guide)
- Metasploitable 2 — intentionally vulnerable Linux for Metasploit/Nmap practice
- DVWA (Damn Vulnerable Web Application) — for Burp Suite/SQLMap practice
- OWASP Juice Shop — modern web app vulnerabilities
- All on a host-only or NAT network — never expose vulnerable VMs to the internet
For online practice without setting up VMs, TryHackMe and HackTheBox are the standard. TryHackMe is more beginner-friendly with structured learning paths; HackTheBox is harder but closer to real-world targets.
Knowing the tools is step one; learning to chain them into a real assessment is what these books teach:
- Linux Basics for Hackers (OccupyTheWeb) — shore up the Linux fundamentals every tool above assumes. View on Amazon →
- The Hacker Playbook 3 (Peter Kim) — real engagement playbooks using Nmap, Metasploit, Burp and the rest. View on Amazon →
- The Web Application Hacker's Handbook — the deep reference behind Burp Suite and SQLMap web testing. View on Amazon →
Affiliate links — I may earn a small commission at no extra cost to you. Full disclosure.
Frequently Asked Questions
Are all 10 tools really pre-installed on Kali Linux?
Yes — all 10 ship with the standard Kali Linux installation. If you used the Kali Light variant, some might be missing; install them with sudo apt install kali-tools-top10 to get the full set, or install individually as needed.
Which tool should I learn first?
Nmap, without question. Every other tool depends on the information nmap gives you about the target. Once you can run scans and read the output fluently, you'll know which other tools to reach for in any given scenario.
Do I need to pay for any of these tools?
Not really. All 10 have a fully functional free version. Burp Suite Professional ($449/year) is the only one with a meaningful paid tier, and the Community version is enough to learn and even do basic bug bounty work. Once you're earning from the work, the Pro upgrade pays for itself quickly.
What's the difference between Hashcat and John the Ripper?
Hashcat uses GPU compute and is dramatically faster — typically 100-185x faster than John on the same hash type. John is easier to use (auto-detects hash format), has unique modes like --single that use GECOS data from /etc/passwd, and has helper scripts for cracking encrypted files (zip2john, office2john, etc.). Most pros use Hashcat for speed and John for convenience and format detection.
Is it legal to practice with these tools?
The tools themselves are 100% legal. What's illegal is using them on systems you don't own and don't have permission to test. Stick to: your own hardware, intentionally vulnerable VMs (Metasploitable, DVWA), and authorized platforms (TryHackMe, HackTheBox, formal pentest engagements). Unauthorized access — even "just to look" — is a crime under the CFAA and equivalent laws.
Can I run these tools on Windows or macOS instead of Kali?
Most of them, yes. Nmap, Wireshark, Burp Suite, Hashcat, and John all run natively on Windows and macOS. But Kali bundles all of them together with sane defaults, ships with helpful wordlists pre-installed, and is the platform tutorials and CTF write-ups assume. If you're learning, just use Kali in a VM — it removes a layer of friction.
What about AI-powered tools like PentestGPT and HexStrike?
They're emerging and worth watching. Kali 2025.4 added the hexstrike-ai package, and the Kali team is experimenting with LLM-driven natural-language pentesting workflows. They're not replacements for the fundamentals though — you still need to know what nmap does to evaluate whether an AI's recommendation is sensible. Learn the classic tools first, then layer AI on top. If you want to try that layering yourself, I walk through running Claude Code on Kali as an AI pentesting assistant — including how to vet an agent skill for malware before you run it.
