arsenal/
30 open-source tools worth learning, grouped by where they fit in a real assessment. Each tool has its own field guide: how it works, the commands, real output, the tricks people miss, and how to harden against it. Jump to a category below, or browse the whole arsenal.
Each guide's install block lists the package for Gentoo (emerge), for Debian, Ubuntu and Kali (apt), and for Fedora and RHEL (dnf). Where a tool is not in a distribution's repositories, the correct upstream method is shown instead: pipx, go, gem, Flatpak, or the official installer.
Authorized use only
The tools and techniques in these guides are for defending, testing, and understanding systems you own or have explicit written permission to assess. Unauthorized access to computers, networks, accounts, or data is a criminal offense in nearly every jurisdiction, and the penalties are real.
A few of the laws that apply, by way of example:
- Philippines: Cybercrime Prevention Act of 2012 (Republic Act No. 10175)
- United States: Computer Fraud and Abuse Act (18 U.S.C. § 1030)
- United Kingdom: Computer Misuse Act 1990
- European Union: Directive 2013/40/EU on attacks against information systems, as implemented by each member state
- Most other countries have equivalent computer-misuse laws
Wherever you are, the rule is the same: get authorization in writing, stay within the agreed scope, and never touch a system that is not yours to test. If you are unsure whether something is permitted, treat it as not permitted until you have clear authorization.
This is general information, not legal advice.
Recon & Discovery 4
Find what is out there before you touch it: live hosts, open ports, running services, and the names that map an organization's attack surface.
nmap
The map you draw before anything else: which hosts are alive, which ports are open, and what services sit behind them.guide ready02masscan
An asynchronous port scanner that sweeps enormous address ranges in minutes, then hands the live hosts to nmap for the detailed work.guide ready03theHarvester
Gathers subdomains, hostnames, emails, and IPs from public sources to map a target's footprint before a single packet is sent.guide ready04amass
OWASP's deep subdomain enumeration and DNS mapping tool, for building a thorough picture of an external attack surface.guide readyWeb Applications 6
Test the security of websites and web apps, from discovering hidden content and parameters to finding injection and known vulnerabilities.
ffuf
A fast web fuzzer for finding hidden directories, files, parameters, and virtual hosts by swapping a wordlist into any part of a request.guide ready06nikto
A fast web server scanner that checks for thousands of known misconfigurations, dangerous files, and outdated software in one pass.guide ready07sqlmap
Automates finding and exploiting SQL injection, from a single vulnerable parameter all the way to dumping databases and shells.guide ready08nuclei
A fast, template-driven scanner that checks hosts against a huge community library of known vulnerabilities and misconfigurations.guide ready09OWASP ZAP
An intercepting proxy and active web scanner: capture, inspect, and tamper with HTTP traffic, with a headless mode for the console and automation.guide ready10wpscan
Enumerates WordPress cores, plugins, themes, and users, and flags known vulnerable versions. (Not an OSI-approved license; free for non-commercial use.)guide readyExploitation & Shells 4
Turn a confirmed weakness into access, and manage the connection once you have it: frameworks, listeners, relays, and exploit search.
metasploit
Turn a known weakness into a proven, repeatable finding. The framework that standardised exploits, payloads, and post-exploitation.guide ready12netcat / ncat
Reads and writes raw network connections: listeners, port checks, file transfers, and reverse shells. The duct tape of networking.guide ready13socat
A more capable netcat: bidirectional relays, encrypted tunnels, and stable upgraded shells between almost any two endpoints.guide ready14searchsploit
Command-line search over the Exploit-DB archive, so you can find and read local exploit code without leaving the terminal.guide readyCredentials & Cracking 3
Attack passwords and hashes, online and offline, to prove just how weak a credential really is before an attacker does.
hydra
Brute-forces network logins: SSH, FTP, RDP, databases, and web forms. The standard way to prove weak or default credentials, with permission.guide ready16john the ripper
Prove how weak a password really is, before someone with worse intentions does. The classic cracker, strong on format breadth and CPU work.guide ready17hashcat
The GPU-accelerated cracker: the fastest way to test hashes at scale, with a deep attack-mode system of wordlists, rules, and masks.guide readyActive Directory & Internal 4
Work inside a Windows network the way a real intruder would: enumerate, move laterally, and capture credentials, so you can close the gaps.
impacket
Python tools and classes for working directly with SMB, Kerberos, and MSRPC: secretsdump, psexec, wmiexec, and the Kerberos attacks.guide ready19netexec
The maintained successor to crackmapexec: sprays and executes across SMB, WinRM, and LDAP to find and use valid credentials at scale.guide ready20responder
Answers LLMNR, NBT-NS, and mDNS requests to capture NetNTLM hashes on a local network. A classic internal first move.guide ready21BloodHound
Maps Active Directory relationships into a graph to reveal privilege-escalation and lateral-movement paths. Collectors run from the host; the analyzer is a GUI.guide readyWireless & Wardriving 7
Audit wifi end to end: capture handshakes and PMKIDs, crack them offline, attack WPS, and harden the networks around you.
kismet
A passive wireless detector, sniffer, and intrusion-detection system. Kismet listens without transmitting, maps every device and network in range, and logs it all for later analysis.guide ready23aircrack-ng
The classic wifi security suite: put a card in monitor mode, capture a WPA handshake, and test how long your passphrase would survive an offline attack.guide ready24bettercap
The swiss-army knife for active network attacks: ARP spoofing, traffic sniffing, wifi handshake capture, and BLE and HID work, all from one interactive console.guide ready25hcxdumptool
The modern way to capture WPA material. It grabs PMKIDs and handshakes efficiently, often without needing a connected client, and writes a file ready for conversion and cracking.guide ready26hcxtools
The companion to hcxdumptool. It turns raw captures into hashcat-ready hashes, filters them down to what matters, and tells you what a capture actually contains.guide ready27reaver
Attacks the WPS PIN, a design flaw that can hand over a WPA passphrase regardless of how strong it is. If you find WPS enabled on your own router, this shows you why to turn it off.guide ready28wifite
The automation layer over the whole wireless toolkit. It scans, picks targets, and runs the right attack for each, driving aircrack-ng, hcxdumptool, and reaver for you.guide readyTraffic & Sniffing 2
Capture and read what crosses the wire, and see plainly what should never be travelling in the clear.