Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Free knowledge
A reference guide to the operating systems, reconnaissance tools, testing proxies, exploitation frameworks, and analyzers most used across the industry, what each one is, why it's used, and where to go to learn it properly.
Purpose-built Linux distributions that ship with hundreds of security tools pre-installed and configured, so testers aren't assembling a toolkit from scratch on every engagement.
The most widely used penetration testing distribution, maintained by Offensive Security. Ships with Nmap, Metasploit, Burp Suite, Wireshark, and hundreds of other tools preinstalled, the default starting environment for most professional testers.
A Debian-based alternative to Kali, popular for its lighter resource footprint and additional privacy/anonymity tooling, used interchangeably with Kali by many testers depending on hardware constraints and personal preference.
The information-gathering phase, mapping a target's attack surface (subdomains, live hosts, exposed services) before any testing begins.
The standard network scanner for host discovery, port scanning, and service/version detection, often the very first command run against a new target in any network assessment.
A widely-adopted open-source suite built for fast, scriptable reconnaissance at scale: subfinder enumerates subdomains, httpx probes which are live, naabu scans ports quickly, and nuclei runs template-based vulnerability checks against what's found.
OWASP's in-depth attack-surface mapping tool, combining DNS enumeration, certificate transparency logs, and other open-source data to build a comprehensive picture of an organization's external assets.
Gathers emails, subdomains, hostnames, and employee names from public sources (search engines, certificate transparency, PGP key servers), a standard first step in social-engineering-focused reconnaissance.
Tools for probing how a web application actually behaves under manipulated input, the layer automated network scanners don't reach.
The industry-standard intercepting proxy for web application testing, inspecting and modifying HTTP requests in transit, automating scans, and manually probing for logic flaws that automated tools miss.
A free, open-source alternative to Burp Suite maintained by OWASP itself, widely used both by security teams and by developers integrating security scanning directly into CI/CD pipelines.
Tools for validating that a discovered vulnerability is actually exploitable, the difference between a theoretical finding and a proven, real-world risk.
The most widely used exploitation framework, maintained by Rapid7. Provides a structured library of known exploits, payloads, and post-exploitation modules, used to confirm a vulnerability is genuinely exploitable, not just theoretically present.
Capturing and inspecting network traffic, essential for both offensive testing and incident response.
The standard packet-capture and protocol-analysis tool, used to inspect network traffic at the byte level, as valuable during incident response (working out what actually happened) as it is during testing.
The command-line packet capture tool most network and server environments already have installed, often the fastest way to capture traffic on a remote system before analyzing it in Wireshark.
Testing how well an organization's credential and hashing practices would hold up if a password database were ever exposed.
The fastest widely-used password recovery tool, using GPU acceleration to test password hash strength, a standard way to demonstrate the real-world risk of weak hashing algorithms or password policies.
One of the longest-standing password-cracking tools, supporting a huge range of hash formats, often used alongside Hashcat depending on the specific hash type and available hardware.
Automated scanning to establish a baseline of known vulnerabilities before manual testing goes deeper.
A free, open-source vulnerability scanner maintained by Greenbone, checking systems against a continuously updated feed of known CVEs and misconfigurations, a solid baseline scanner, though see our note on what these tools structurally can't catch.
Knowing what Nmap or Burp Suite does is one thing. Running a structured, business-logic-aware engagement with them is another, that's what we do.