# Penetration testing tools: what each type does, its limits and when to use it

Source: https://penetrationtestservices.com/guides/penetration-testing-tools/
Publisher: Excession Labs (penetrationtestservices.com)
Last updated: 2026-11-09

Penetration testing tools grouped by job: recon, web proxies, scanners, exploitation frameworks, password audit. What each does, its limits, and why output is a lead.

> **Short answer:** Penetration testing tools fall into groups by job: recon and mapping (Nmap), web proxies and scanners (Burp Suite, OWASP ZAP, sqlmap), exploitation frameworks (Metasploit), traffic analysis (Wireshark) and password audit (John the Ripper). Use them only on systems you own or have written permission to test. Tool output is a lead, not a finding, until a tester proves the effect with evidence.

Penetration testing tools are programs that map a target, send test requests, capture traffic or check passwords. A pentester picks a tool for each job in the test. This page groups the well-known tools by that job, says what each category cannot do, and explains why a tool's output is a lead until someone proves it.

## Authorization first: use tools only with written permission

Use these tools only on systems you own or have written permission to test. The same scan that is a test with permission can be an attack without it.

In the US, 18 U.S.C. 1030(a)(2) covers anyone who "intentionally accesses a computer without authorization or exceeds authorized access" ([18 U.S.C. 1030](https://www.law.cornell.edu/uscode/text/18/1030)). NIST SP 800-115 says legal advisors should "always be involved for intrusive tests such as penetration testing" ([NIST SP 800-115](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf)). This page is not legal advice.

A pre-test checklist for a learner or a team:

1. Write down the exact hosts, URLs and accounts in scope.
2. Get the system owner's written permission, with dates.
3. Use a lab you own, or a test environment, if you only want to learn.
4. List what is forbidden: denial of service, real customer data, paid third-party services.
5. Agree who to call if something breaks.

The [rules of engagement guide](/guides/penetration-testing-rules-of-engagement/) covers this in full. If a third party hosts part of the system, check that party's testing policy too.

## Penetration testing tools in one table

Each tool does one job in one phase of the test. This table lists the well-known free and open tools by job, with each project's own description.

| Job | Tool | What the project says it is | What it cannot do alone |
|---|---|---|---|
| Recon and mapping | Nmap | "free and open source utility for network discovery and security auditing" | Judge your application logic |
| Web proxy and manual testing | Burp Suite | Web application security testing tools from PortSwigger | Decide which findings matter to your business |
| Web scanner | OWASP ZAP | "free and open source" web app scanner | Hold two accounts and compare their data on its own |
| SQL injection | sqlmap | "automatic SQL injection and database takeover tool" | Test anything that is not SQL injection |
| Exploitation framework | Metasploit Framework | "free, open-source" framework | Find your custom application flaws |
| Traffic analysis | Wireshark | "network protocol analyzer" | Show a flaw if the traffic is encrypted and you hold no keys |
| Password audit | John the Ripper | "Open Source password security auditing and password recovery tool" | Test a live login without rate-limit rules set |

Descriptions are quoted from each project's home page, checked on 9 November 2026. Burp Suite has a free Community Edition and paid editions; see [PortSwigger's page](https://portswigger.net/burp) for current editions.

## Which recon and mapping tools do testers use?

Recon tools answer "what is there?" before anyone tests how it fails. Nmap is the standard example: it discovers hosts and services on a network and reports which ports are open.

For a web app, recon also means listing pages, API endpoints, roles, inputs and technologies. A tester reads the app, its JavaScript and its API description. The output is an inventory, and a reviewer can compare it to the written scope to catch anything out of bounds.

Recon has limits. An open port is a fact about exposure, not a flaw. A port scan says nothing about whether the service behind it is configured safely, and a service that is not listed is not proof that nothing runs there. Treat recon output as the map for the next phase.

Recon traffic is also visible. Port scans can set off alerts or load a fragile host. Agree rate limits and time windows before you run them, and run them from the source address you gave your provider.

## What do web proxies and application scanners do?

A web proxy sits between the browser and the app so the tester can see and change each request. A scanner automates checks against the pages it finds. Most web application testing uses both.

Burp Suite and OWASP ZAP are the two names that come up most. ZAP calls itself "the world's most widely used web app scanner" and is free and open source; Burp has a free Community Edition and paid editions. With a proxy, a tester can replay a request with a different session cookie, change an ID, remove a parameter or send a field the form did not show.

The proxy is where the tester does the work a scanner cannot. Here is the shape of one manual check on a demonstration app:

> **Demonstration only:** This is a demonstration. No real customer system was tested. "Harbor Notes" is a fictional app on example.com.
> 
> 1. In the proxy, the tester captures Alice's request: `GET /api/notes/4021` with Alice's token.
> 2. The tester sends the same request again with Bob's token, from a second test account.
> 3. If the response is 200 with Alice's note, the tester records both requests and responses as evidence.
> 4. The tester runs controls: a nonexistent ID and a request with no token.
A scanner cannot run step 2 unless someone gives it two sessions and a rule about ownership. For the difference between running scanners and running a pentest, read [SAST vs DAST](/guides/sast-vs-dast/).

sqlmap belongs in this group. It automates testing for SQL injection, and its own tagline says it detects and exploits those flaws. Run it only against a target in scope and on test data, and set limits first, because it sends many requests.

## What are exploitation frameworks for?

An exploitation framework packages known exploit code and helper tools so a tester can check whether a known vulnerability is exploitable in a given system. Metasploit Framework is the best-known example and is free and open source.

Defensive use is the point. A tester uses it to confirm that a patch level or exposed service is a real risk, so the team can fix it with priority. A finding then says which version was exploitable, how the tester checked, and how to fix it.

Frameworks cover known issues in known products. They do not test your own application's logic, such as whether one tenant can read another's records. For a web app or API, most real findings come from manual testing in a proxy, not from a framework module.

Exploit tools also change state on the target. Agree beforehand what a tester may run on production, and prefer a staging copy. The scope should say which proofs are allowed and where the tester must stop after first proof. [Rules of engagement](/guides/penetration-testing-rules-of-engagement/) lists the questions to settle.

## What are credential and password audit tools?

Credential audit tools test password strength or check how a login behaves under repeated guesses. John the Ripper describes itself as "an Open Source password security auditing and password recovery tool".

There are two different uses, and the scope must say which one you agree to. Offline audit means checking exported password hashes for weak passwords, which needs a hash file you are authorized to hold. Online testing means guessing against a live login, which risks locking real users out and sending alerts.

For online testing, agree on the number of attempts, the accounts used and the time window. Use test-owned accounts. Pair it with a check of whether the application slows or blocks repeated attempts; see [rate limiting and credential stuffing](/guides/rate-limiting-and-credential-stuffing/) for what testers look for and how to fix it.

A short word on Wireshark: it captures and reads network traffic, which helps with transport and protocol checks. Capture only on networks you are authorized to monitor, because captured traffic can include other people's data.

## Why is tool output not a finding?

Tool output is a lead. A finding is a lead that a tester confirmed with evidence of a real effect, ranked by how bad it is, with a fix.

Scanners report possible issues, and some are false positives. The same output can also hide real problems the tool cannot see. A tester checks each lead, reproduces it, and runs controls: requests that should fail, such as a nonexistent ID or no token.

| Step | Tool output | Finding |
|---|---|---|
| Source | A scanner line or a framework result | A tester's confirmed result |
| Evidence | Often a signature match | Requests and responses, reproduced |
| Impact | Not judged | Shown, for example another account's record read back |
| Controls | None | Controls that held and controls that failed |
| Fix guidance | Generic text | Specific to your code and stack |

For example, a proxy shows that a write returned "success". That alone is not proof. The tester reads the record back through another session to show the data changed. A report that holds only tool output pushes the triage work onto your developers. See [how to read a penetration testing report](/guides/how-to-read-a-penetration-testing-report/) for what a proven finding looks like.

The OWASP Web Security Testing Guide is a free list of web test cases that testers use as a checklist. Tools help run a test case, but the guide's cases are what define the work.

## How do tools fit into a pentest?

Tools help in each phase: planning needs none, discovery uses recon tools, the attack phase uses proxies and frameworks, and the report records evidence the tools captured. The [methodology guide](/guides/penetration-testing-methodology/) names the phases, and [what is penetration testing](/guides/what-is-penetration-testing/) gives the overview.

To compare providers on method, tool use and evidence, use the neutral listings on [pentestcompare.com](https://pentestcompare.com/). At Excession Labs, the lab's AI testing agents use tools under rules Excession Labs sets for each scope. Each tool runs on its own, waits for approval or is blocked. Excession Labs checks the evidence for each finding and writes the report; see our [methodology](/methodology/).

## Questions

### What are the most common penetration testing tools?

The names that come up most are Nmap, Burp Suite, OWASP ZAP, Metasploit, Wireshark, sqlmap and John the Ripper. Each does one job. No single tool is a pentest, because a pentest needs a plan, authorization, judgment and a written report.

### Are free penetration testing tools good enough?

Several widely used tools are free, including Nmap, OWASP ZAP and Wireshark, and Burp Suite has a free Community Edition. Price does not decide the result. Skill, scope and the evidence a tester collects decide it.

### Is it legal to use penetration testing tools?

Owning or downloading the tools is not the issue. Using them against a system without permission can break computer misuse law. In the US, 18 U.S.C. 1030(a)(2) covers access without authorization or beyond it. Get written permission first, and ask a lawyer about your case.

### Can a tool do a penetration test for me?

A tool can run checks and list leads. It cannot decide your scope, hold two accounts and compare their data, or judge your business rules. The finding needs a person to confirm it and show the effect.

### Do I need Kali Linux?

No. Kali is a Linux distribution that bundles many of these tools in one install. Every tool on this page can also be installed on its own. What you need first is written authorization and a scope.

## Sources

- [Nmap: free and open source utility for network discovery and security auditing](https://nmap.org/)
- [ZAP (Zed Attack Proxy)](https://www.zaproxy.org/)
- [PortSwigger: Burp Suite](https://portswigger.net/burp)
- [Metasploit documentation](https://docs.metasploit.com/)
- [sqlmap: automatic SQL injection and database takeover tool](https://sqlmap.org/)
- [Wireshark](https://www.wireshark.org/)
- [John the Ripper password cracker (Openwall)](https://www.openwall.com/john/)
- [NIST SP 800-115: Technical Guide to Information Security Testing and Assessment (2008, final)](https://csrc.nist.gov/pubs/sp/800/115/final)
- [NIST SP 800-115 (PDF), Appendix B on rules of engagement](https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf)
- [18 U.S.C. 1030: Fraud and related activity in connection with computers](https://www.law.cornell.edu/uscode/text/18/1030)
- [OWASP Web Security Testing Guide](https://wstg.owasp.org/)