Ethical Hacking Arsenal — Use Responsibly
The gold standard for penetration testers. Kali Linux is a Debian-based OS pre-loaded with 600+ security tools covering everything from network analysis to forensics. It's the foundation of any serious ethical hacking lab — run it live, in a VM, or on bare metal.
Network Mapper — the essential tool for network discovery and security auditing. Nmap uses raw IP packets to determine hosts on a network, services they're running, OS versions, firewalls in use, and dozens of other characteristics. Indispensable for any recon phase.
The world's most used penetration testing framework. Metasploit contains thousands of pre-built exploits, payloads, and auxiliary modules. It enables security professionals to simulate attacks, test defenses, and validate remediation efforts in a controlled environment.
The world's foremost network protocol analyzer. Wireshark lets you capture and interactively browse network traffic, drilling into packet-level detail across hundreds of protocols. Essential for diagnosing network issues, studying protocol behavior, and spotting anomalies.
The definitive wireless network security toolkit. Aircrack-ng covers monitoring, attacking, testing, and cracking Wi-Fi security protocols. Capable of cracking WEP keys and WPA/WPA2-PSK passphrases through captured handshakes and dictionary attacks. jT's personal wireless testing staple.
A powerful wireless network detector, sniffer, and IDS. Kismet works passively — detecting networks without sending any packets — making it ideal for wardriving and covert wireless surveillance. Supports Wi-Fi, Bluetooth, RF, and more via software-defined radio. Featured in pwnHACKER's dedicated guide.
The industry-standard web application security testing platform. Burp Suite's intercepting proxy lets you examine and manipulate every HTTP/S request and response between browser and server. Ideal for finding XSS, SQL injection, IDOR, and authentication flaws.
The search engine for Internet-connected devices. Shodan continuously crawls the internet and indexes open ports, banners, and services exposed on billions of devices — from routers and cameras to industrial control systems. Invaluable for external attack surface mapping and target research.
A fast, free, and open-source password security auditing and recovery tool. John the Ripper supports hundreds of hash and cipher types, automatically detects password hash types, and can run dictionary, brute-force, and hybrid attacks. The go-to tool for cracking password hashes.
An open-source web server scanner that performs comprehensive tests against web servers — checking for dangerous files, outdated server software, version-specific problems, and common misconfigurations. Fast and noisy — not stealthy, but thorough.
A Python-based OSINT tool that extracts metadata from public Google Documents — including author names, account IDs, creation dates, and sharing permissions. Surprisingly powerful for deanonymizing document creators who share files carelessly. Featured on pwnHACKER.
A social engineering tool that — with user consent — can access a target device's camera, microphone, and geolocation through a crafted link. Used in controlled security demonstrations and training to illustrate how browser permissions can be abused. For ethical use and security awareness only.
The Zed Attack Proxy — OWASP's flagship web security scanner. ZAP is both an intercepting proxy and an automated vulnerability scanner for web applications. Designed for both beginners and seasoned professionals, it integrates easily into CI/CD pipelines for automated security testing.
The world's fastest and most advanced GPU-accelerated password recovery tool. Hashcat supports over 300 hash types and five attack modes — dictionary, combinator, brute-force, mask, and rule-based. With modern GPUs it can test billions of candidates per second.
The premier visual link analysis and OSINT investigation platform. Maltego maps relationships between people, organizations, domains, IPs, infrastructure, and social networks using graph-based visualizations. Transforms automate data gathering from hundreds of sources in a single workspace.