Penetration Testing Tools: 30 Tools Pentesters Use (2026)

Penetration testing tools are the scanners, proxies, password crackers and attack frameworks testers use to find weaknesses and prove they can be exploited: Nmap and Nessus for discovery, Burp Suite for web applications and APIs, BloodHound, Impacket and NetExec for Active Directory, Hashcat for passwords, and Metasploit or a command-and-control (C2) framework for exploitation. Most are free and open source. What you pay for in a penetration test is the senior person deciding where to point them and what the output means.

Below are the 30 pen testing tools that come up most on real engagements, grouped by phase of the penetration testing process: what each answers, what a hit means for you and how your logs would show it. Each category maps to one of our penetration testing services, run to our published methodology at fixed prices on our penetration testing pricing page.

How we chose these 30

Each tool is used on real engagements as of November 2026 (where one was archived, we list the successor: NetExec, not CrackMapExec). A tool made the list if it passed three tests:

• Current. It is in use on engagements now, and it either still receives updates or still works as last released, as Kerbrute and Mimikatz do.
• A distinct question. We list one or two tools per job, not every alternative, which is why overlapping tools such as Hydra and Nikto are left out.
• Something a defender can act on. Its use leaves evidence you can log, or its findings map to a specific fix.

NIST’s SP 800-115 separates target identification and analysis (network discovery, port and service identification, vulnerability scanning), generally automated, from target vulnerability validation (password cracking, penetration testing, social engineering), which corroborates that a vulnerability exists, manually or with tools depending on the technique and the test team’s skill.

Network penetration testing tools: discovery and scanning

#	Tool	Free or paid	What it answers	What a hit means for you
1	Nmap	Free, open source	Which hosts, ports, services and versions answer	Services nobody meant to expose, or versions with known flaws
2	Masscan	Free, open source	What is open across huge address ranges, fast	Forgotten hosts in space you assumed was empty
3	OWASP Amass	Free, open source	Which domains, subdomains and ranges belong to you	An attack surface larger than your asset register
4	Wireshark	Free, open source	What is actually crossing the wire	Cleartext credentials and legacy protocols
5	Nessus	Commercial; 30-day non-commercial Essentials license	Which known CVEs and missing patches each host carries	Patch debt, before anyone proves it is exploitable
6	Nuclei	Free, open source	Whether a target matches thousands of community detection templates	A known exposure, often a newly published one

Our network penetration testing guide shows how these fit a full engagement, from scoping to report.

Shopping for free scanning software? As of November 2026 Tenable describes Nessus Essentials as a 30-day license for up to 5 IPs, strictly non-commercial, so a business needs Nessus Professional or the free, open-source Greenbone Community Edition (OpenVAS). Our Invadel vs Nessus page covers what a scanner proves, and our vulnerability scanning service runs one with an analyst validating every result, from $1,500 for up to 250 devices.

Web penetration testing tools

#	Tool	Free or paid	What it answers	What a hit means for you
7	Burp Suite	Community free; Professional paid	Every request between browser and server, readable and modifiable	Whatever the tester proves: broken access control, injection, logic flaws
8	ZAP	Free, open source	The same proxy model, plus scans that fit a CI pipeline	Regressions caught between manual tests
9	ffuf	Free, open source	Unlinked content, and whether IDs and forms survive thousands of attempts	Backup files, staging hosts, old API versions, missing rate limits
10	Gobuster	Free, open source	Hidden directories, subdomains and virtual hosts	Content you thought was private because nothing linked to it
11	sqlmap	Free, open source	How far a suspected SQL injection reaches	The database behind the parameter, sometimes the server

Burp Suite from PortSwigger is the standard. The free Community Edition lacks the scanner, the full Intruder and saved projects, so professionals buy Professional; we use it on nearly every web engagement, as our Burp Suite comparison explains. ZAP, now branded ZAP by Checkmarx and still open source, is a common pick for pipeline scanning. See also our guides to DAST tools and web application security testing.

Active Directory and internal network tools

#	Tool	What it does	What it means when it works
12	Responder	Answers LLMNR, NBT-NS and mDNS lookups to capture credential hashes	Legacy name resolution is still on
13	Kerbrute	Confirms usernames and tests passwords through Kerberos	Usernames can be enumerated and weak passwords sprayed, unseen unless someone watches 4768 and 4771
14	NetExec	Tests where a credential works across hosts and protocols	Credentials are reused or over-privileged
15	Impacket	Relay, Kerberoasting, remote execution and credential dumping over Windows protocols	SMB signing is off or admin rights are too broad
16	BloodHound	Graphs Active Directory and finds the shortest path to Domain Admin	Ordinary permissions chain into full control
17	Rubeus	Requests and abuses Kerberos tickets	Kerberoastable accounts or delegation flaws
18	Certipy	Finds misconfigured AD Certificate Services templates	A low-privilege user can get a certificate that logs in as someone else
19	Mimikatz	Extracts credentials from Windows memory	Credentials sit where an admin-level attacker can read them
20	Evil-WinRM	Opens a shell over Windows Remote Management	A stolen credential carries remote-management rights

All nine have free, open-source editions, and most of the time they exploit no missing patch: they use Windows as designed, with credentials or permissions they should not have. Most serve one goal: privilege escalation from an ordinary account to one that controls the domain. The fixes are structural (disable LLMNR and NBT-NS, enforce SMB signing, retire RC4, tier admin accounts, lock down certificate templates); our Active Directory hardening checklist and explainers on Kerberoasting, NTLM relay and PetitPotam, golden and silver tickets and lateral movement go deeper.

Attackers use them too. As of November 2026, MITRE ATT&CK lists 52 threat groups using Mimikatz and 20 using Impacket, including Volt Typhoon and Scattered Spider, and CISA’s LockBit advisory (AA23-165A) names BloodHound, Impacket and Mimikatz among the tools LockBit affiliates used.

Password cracking tools

#	Tool	Free or paid	What it answers	What a hit means for you
21	Hashcat	Free, open source	Which captured hashes crack offline on GPUs	Passwords that meet policy and still fall to a wordlist
22	John the Ripper	Free, open source; Pro edition paid	The same, with wide support for protected files and keys	Weak passwords on documents, archives and private keys

Cracking happens offline, so your environment never sees it; what you can see is the hash being captured or the ticket requested. A good report lists the password patterns that fell, not the passwords.

Exploitation and command-and-control frameworks

#	Tool	Free or paid	What it answers	What a hit means for you
23	Metasploit Framework	Free, open source (Rapid7 and community); Pro edition paid	Whether a known vulnerability becomes code execution	A missing patch is exploitable, not theoretical
24	Cobalt Strike	Commercial (Fortra)	Whether an implant can operate for weeks unnoticed	Endpoint detection, egress filtering and the SOC missed sustained activity
25	Sliver	Free, open source (Bishop Fox)	The same, with an open-source C2	As above

Metasploit’s payload generator has its own msfvenom explainer. Cobalt Strike is sold for adversary simulation and widely abused: ATT&CK lists 30 groups using Cobalt Strike, and in 2023 Microsoft’s Digital Crimes Unit, Fortra and Health-ISAC obtained a court order against cracked legacy copies that Microsoft linked to more than 68 ransomware attacks on healthcare organizations in more than 19 countries. ATT&CK lists APT29 among the groups using Sliver. Our explainers on C2 servers and red team tools cover the rest of the kit.

Phishing, wireless, cloud and mobile tools

#	Tool	Free or paid	What it answers	What a hit means for you
26	GoPhish	Free, open source	Who clicks, submits credentials or reports, by department	Reporting habits, measured instead of assumed
27	Evilginx	Free, open source; Pro edition paid	Whether an adversary-in-the-middle page steals a session past MFA	Your MFA is phishable; passkeys or FIDO2 fix it
28	Aircrack-ng	Free, open source	Whether a Wi-Fi pre-shared key can be recovered	A weak key that puts an outsider on the network
29	Prowler	Free, open source; paid cloud edition	Which settings fail checks across AWS, Azure, Google Cloud, Kubernetes and Microsoft 365	Misconfigurations, before anyone shows which chain together
30	Frida	Free, open source	What an app does at runtime with its client-side protections off	Secrets and logic the app trusted the device to protect

Frida, usually paired with MobSF, is how a tester strips certificate pinning and root detection to reach the API behind an app, which is why those controls never replace server-side checks. Our Android penetration testing guide walks through that work.

API and cloud penetration testing tools

Four more tools sit outside the 30 but come up whenever the scope is an API or a cloud account:

Tool	Free or paid	What it answers	What a hit means for you
Postman	Free plan; paid tiers	What each documented endpoint returns when requests from an imported API definition are replayed as a different user	Endpoints that trust the client to ask only for its own records
Kiterunner	Free, open source (Assetnote)	Which API routes and endpoints exist that the documentation never mentions	Old versions and internal endpoints reachable from the internet
Pacu	Free, open source (Rhino Security Labs)	How far one set of AWS credentials can be pushed	Over-broad IAM permissions, shown as a working path
Scout Suite	Free, open source (NCC Group)	Which settings look risky across AWS, Azure and Google Cloud	The same class of misconfiguration Prowler reports, from a second engine

Route discovery looks like web fuzzing in your logs: bursts of 404s on API paths from one client. Pacu works through the AWS API with the credentials it is given, so AWS CloudTrail records what it enumerates and changes. Our AWS penetration testing guide covers the cloud side in depth.

How to detect penetration testing tools in your environment

Every tool above leaves traces. Wire up these signals before a test, the cheapest time to learn which alerts fire.

Activity (tools)	Log source	Event or signal	What it indicates
Port scanning (Nmap, Masscan)	Firewall, NetFlow, IDS	One source touching many ports or hosts within minutes	Discovery underway
Web fuzzing (ffuf, Gobuster, sqlmap)	Web server, CDN and WAF logs	Bursts of 404s or database errors from one client; default tool User-Agents	Content discovery or injection testing
Poisoning (Responder)	Network monitoring	LLMNR or NBT-NS replies from a host that is not a name server	Credential capture on the segment
Spraying (Kerbrute)	Domain controller Security log	4768 failures with code 0x6; 4771 with code 0x18 across many accounts	Username enumeration and password spraying
Kerberoasting (Rubeus, Impacket)	Domain controller Security log	Bursts of 4769 for many services from one account; type 0x17 (RC4) tickets, which since Microsoft’s 2026 RC4 changes go only to accounts still set to allow RC4	Service-account hashes requested for cracking
Lateral movement (NetExec, Impacket, Evil-WinRM)	Endpoint Security, System and PowerShell logs	4624 logon type 3 across many hosts; 7045 service installs; 4698 scheduled tasks; 4104 script blocks	A credential used to execute remotely
DCSync (Mimikatz, Impacket)	Domain controller Security log	4662 showing replication rights used by an account that is not a domain controller	The password database being copied
Memory credential theft (Mimikatz)	Sysmon, EDR	Sysmon Event ID 10 targeting lsass.exe	An attempt to read credentials from LSASS
Certificate abuse (Certipy)	CA Security log and database; domain controller Security log	4886 and 4887 (request received, certificate issued), written only when the CA’s own audit filter is on; an alternative name may not show in the event text, so check issued names against requesters in the CA database; 4768 certificate logons by privileged accounts	A certificate that impersonates another user
C2 traffic (Cobalt Strike, Sliver)	Proxy, DNS, Sysmon	Regular-interval callbacks to young domains; Sysmon 3, 17, 18 and 22	An implant checking in
Session theft (Evilginx)	Identity provider sign-in logs	One session used from a new IP or country minutes after sign-in	A stolen session cookie replayed

Microsoft’s Sysmon documentation says Event ID 10 enables detection of tools that read LSASS memory to steal credentials (filter it, or it gets noisy). The domain controller events need advanced audit policies switched on. On RC4, Microsoft’s CVE-2026-20833 guidance sets out the change: with updates released from April 2026 the domain controller defaults to AES for accounts with no explicit encryption setting, and honors RC4 only where an administrator has explicitly configured it. On the certificate authority, 4886 and 4887 are written only when both the Audit Certification Services subcategory and the CA’s own audit filter (the Auditing tab of its properties) are enabled, as our Certipy guide explains. A test that raises no alerts is a finding in its own right, and our purple team assessment runs these techniques with your defenders watching.

Open source and free penetration testing software you can run yourself

Tool	Run it in-house?	What it will not tell you
Nmap	Yes, on ranges you own	Whether an exposed service is exploitable
A vulnerability scanner (OpenVAS, Nessus Professional)	Yes, on a schedule	Chains, logic flaws, false positives
ZAP	Yes, against staging in CI	Authorization and business logic
Prowler	Yes, read-only	Which misconfigurations chain into account takeover
BloodHound	Yes, with security team sign-off	Proof that a path works
Responder, Mimikatz, C2 frameworks	Only inside an authorized engagement	They trip EDR, can disrupt production and need written rules of engagement

Run tools only against systems you own or have written permission to test: unauthorized access is a crime under the federal Computer Fraud and Abuse Act (18 U.S.C. 1030) and state law. And a scan you run on yourself is not the independent evidence auditors and enterprise customers usually ask for.

Penetration testing software vs a penetration test

Pentest tools are good at breadth: known CVEs, open ports, default paths, failed benchmarks. They are poor at findings that need context, often the most serious ones:

• Authorization. A tool cannot tell whether user A should see user B’s invoice; an IDOR vulnerability takes two accounts and a person who understands the product.
• Business logic. Skipping a payment step, reusing a single-use coupon, approving your own request.
• Chains. Three medium findings that together reach Domain Admin. BloodHound draws the path; a tester proves it and stops where the rules of engagement say.

Our guides to manual vs automated penetration testing and penetration testing vs vulnerability scanning go deeper, and we compare autonomous penetration testing vendors separately. Online “automated pentest” platforms mostly sit closer to the scanner. One buyer check: if a “penetration test” report is mostly scanner output under a cover page, you bought a scan.

How Invadel uses these tools, and what it costs

What you buy from us is a senior in-house tester, never a subcontractor, driving these tools inside a written scope, and every finding verified by hand with a CVSS rating, reproduction steps and the fix. Source addresses and testing windows are agreed in advance, so your team can match its alerts to our timeline.

Engagement	Tools from this list that fit the scope	From
External network	Nmap, Masscan, Amass, Nuclei, a vulnerability scanner	$4,200
Web application	Burp Suite Professional, ffuf, Gobuster, sqlmap	$5,200
API	Burp Suite Professional, ffuf	$4,000
Internal network	Responder, Kerbrute, NetExec, Impacket, BloodHound, Evil-WinRM	$6,000
Active Directory assessment	BloodHound, Rubeus, Certipy, Impacket, Hashcat	$6,000
Cloud	Prowler-style configuration checks plus manual attack paths	$6,800
Mobile application	Frida, MobSF, Burp Suite Professional	$6,000
Wireless	Aircrack-ng suite	$3,800
Phishing	Campaign tooling, adversary-in-the-middle pages	$3,600 (no retest)
Red team	A C2 framework, phishing, and the external and internal network tools above	$12,500

Each price is a published starting point, fixed in writing from the details you send through our scoping questionnaire, with no sales call. Every penetration test includes executive and technical reports, an attestation letter, the findings platform and a free retest of remediated findings, and onboarding begins within 24 hours of a signed proposal. The pricing page shows the size tiers, the cost calculator adds tests together, and the sample report shows a finished finding.

Frequently asked questions

What are the top 10 tools for pentesting? For most engagements: Nmap, Burp Suite, a vulnerability scanner such as Nessus, Metasploit, BloodHound, Impacket, NetExec, Responder, Hashcat, and ffuf or Gobuster. Which ones matter depends on the scope.

Which penetration testing tools are free? Almost all of them. Of the 30 here, only Cobalt Strike has no free edition. The tightest limits are on Burp Suite Community (no scanner, a throttled Intruder) and Nessus Essentials (30 days, 5 IPs, non-commercial); Metasploit, Prowler, Evilginx and John the Ripper keep extra features for paid editions.

Which penetration testing software do you have to pay for? Of the 30, Cobalt Strike and Nessus are commercial products, and Burp Suite Professional is the paid edition most web testers need. Metasploit Pro, John the Ripper Pro, Evilginx Pro and Prowler’s cloud edition are optional paid tiers. Everything else is free and open source.

What is the difference between a vulnerability scanner and a penetration testing tool? A scanner such as Nessus or OpenVAS checks hosts against a database of known flaws and reports what might be exploitable. Tools such as Burp Suite, Impacket and Metasploit are driven by a person to prove what is exploitable. A penetration test uses both.

Is it legal to use penetration testing tools? In the US, owning them is legal; using them against systems you do not own or have written authorization to test is not. Professional tests run under a signed scope and rules of engagement.

Do penetration testers use Kali Linux? Often, for convenience: Kali and Parrot OS bundle most of the free tools here. The operating system matters far less than the scope, the tester’s judgment and the evidence.

Can a tool replace a penetration test? No. Tools find known patterns at scale but miss broken authorization, business logic and chained attack paths.

The short version

Penetration testing tools are mostly free, and attackers have the same ones. What separates a real test from a tool run is the person steering them, the chaining and the evidence. For that at a fixed price with a free retest, see our penetration testing services and published prices, or scope a test and get a written number the same day.