Most penetration testing tool lists are inventories. They name forty tools, describe each in a sentence, and leave you no better placed to run a test. This guide covers the ones that earn their place in a working engagement, what each is actually for, and where teams misuse them.
If you are still deciding whether you need a test at all, start with how penetration testing works. If you are budgeting for one, our penetration testing cost guide covers the ranges.
The five stages, and which tool belongs where
Tools only make sense against the stage they serve. A scanner used in the wrong phase produces noise that costs a tester hours.
The stage most teams skip is the first. Reconnaissance decides scope, and a test scoped from an outdated asset list will thoroughly examine the wrong estate.
Reconnaissance: know the estate before you scan it
Reconnaissance answers one question: what is actually exposed? Not what the architecture diagram says, what DNS and certificate transparency logs say.
Amass performs subdomain enumeration by combining passive sources with active resolution. It is the tool that finds staging-api.example.com that nobody remembered leaving public.
theHarvester collects email addresses, subdomains and hostnames from public sources. Useful for establishing the social engineering surface without sending anything.
Spiderfoot automates OSINT collection across dozens of sources and correlates results. Heavier than the other two, and worth it on a large estate.
Everything in this stage is passive or near-passive. That matters legally: passive reconnaissance touches public records, active scanning touches the target. Know which one you are authorised to do before you run it.
Scanning: Nmap is still the answer
Nmap remains the standard for host discovery and service enumeration, and the reason is the Nmap Scripting Engine rather than the port scan itself.
# Service and version detection with default scripts, timing tuned for a lab
nmap -sV -sC -T4 -oA scan-results 10.0.0.0/24
# Full TCP port range, which the default scan does NOT cover
nmap -p- -sV --open -oA full-tcp 10.0.0.5
# UDP, slow and usually skipped, which is exactly why services hide there
nmap -sU --top-ports 100 -oA udp-top100 10.0.0.5The default Nmap scan covers the 1,000 most common TCP ports. That is the single most common cause of a missed finding: a service on port 8443 or 9200 that the default scan never looked at. Use -p- when the engagement window allows it.
Masscan exists for scale. It can sweep a large address range far faster than Nmap, at the cost of accuracy. The usual pattern is Masscan to find open ports across a wide range, then Nmap against just those ports for version detection.
Web application testing: Burp Suite and ZAP
Both are intercepting proxies. You route browser traffic through them, then inspect, modify and replay requests.
Burp Suite Professional costs $499 per user per year, per PortSwigger's published pricing. The Community edition is free but throttles Intruder and omits the active scanner, which is most of what you would pay for.
ZAP is free and open source, maintained under the Software Security Project. Its automation framework, Docker packaged scans and GitHub Actions integration make it the easier of the two to put into a pipeline.
The honest comparison: Burp is better for manual exploration, ZAP is better for automation you own. Most teams that can afford Burp use Burp for the engagement and ZAP in CI.
The mistake that wastes the licence
Teams buy Burp Professional, run the active scanner, and treat the output as the test. The scanner finds what scanners find: reflected XSS, missing headers, known-pattern injection. It does not find broken access control between two tenants, because it does not know your business rules.
Manual testing through Repeater and Intruder is what the licence is for. If your engagement is scanner output with a logo on it, you bought a vulnerability scan at penetration testing prices.
Exploitation: proving the finding is real
A finding nobody can reproduce gets deprioritised. Exploitation tools exist to turn "this looks vulnerable" into "here is the data I extracted".
Metasploit provides a framework of exploit modules, payloads and post-exploitation tooling. Its value in a professional engagement is less the exploits and more the consistency: a repeatable module, a documented payload, a session you can demonstrate.
sqlmap automates SQL injection detection and exploitation. It is aggressive by default and will happily dump a production database, so scope and rate-limit it deliberately.
# Test a single parameter, no data extraction, low risk level
sqlmap -u "https://target/api/user?id=1" --level=2 --risk=1 --batch
# Enumerate databases only after the injection is confirmed
sqlmap -u "https://target/api/user?id=1" --dbs --batchUse exploitation tools only within written authorisation. The technical capability and the legal permission are separate things, and only one of them is in the tool.
Kali Linux: a distribution, not a tool
Kali is a Debian-based distribution that ships the above pre-installed and configured. Its tool catalogue is organised by stage: reconnaissance, web scanning, exploitation, forensics.
Running Kali does not make an engagement a penetration test, any more than owning a compiler makes you a developer. It removes setup friction. That is genuinely valuable and it is the whole of the value.
Where automation stops
Every tool above automates discovery. None of them automates judgement, and the findings that matter most in our experience are judgement findings:
- Broken object-level authorisation. User A retrieves user B's record by changing an id. A scanner cannot know that the record should not be visible.
- Business logic abuse. A discount applied twice, a refund exceeding the payment, a workflow step skipped. These are only visible to someone who understands the intended flow.
- Multi-tenant isolation failure. Tenant separation enforced at the application layer but not the database. Automated tools test one tenant at a time.
- Chained low-severity findings. Three informational issues that together produce account takeover. Scanners score findings individually.
This is the argument for manual testing, and it is also why tool-count is a poor proxy for engagement quality. A tester with Nmap, Burp and patience will out-find a pipeline running six scanners.
Common mistakes, and what they cost
These are the failures we see most often when reviewing someone else's engagement or tooling setup. Each one produces a test that looks complete and is not.
The second row is the expensive one. An engagement priced as a penetration test that delivers scanner output has cost the full price and returned a fraction of the value.
Getting a proxy to see mobile traffic
Mobile applications are where the CA trust mistake bites hardest. An app using certificate pinning will refuse the proxy certificate entirely, and the tester sees an empty traffic log rather than an error.
The options are to test a build with pinning disabled, use a patched build, or accept that the network layer is out of scope and say so in the report. What matters is that the limitation appears in the report rather than being quietly omitted.
Putting tools in the pipeline
Engagement tooling and continuous tooling are different jobs. An engagement is a human with Burp for two weeks. A pipeline is a scan that runs on every merge and fails loudly.
ZAP is the usual choice for the pipeline because it automates without a per-seat licence. A baseline scan against a staging deployment catches regressions in headers, cookie flags and obvious injection points, which is not everything but is the class of finding that should never reach production twice.
# ZAP baseline scan, suitable for CI: passive only, fails on new findings
docker run -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
-t https://staging.example.com -r report.htmlKeep expectations proportionate. A baseline scan is a regression guard. It is not a substitute for an engagement, and presenting it as one is how teams end up believing they are tested when they are monitored.
Choosing a starting set
For a team running its first internal assessment, four tools cover most of the ground: Nmap for enumeration, ZAP for the web layer, sqlmap for injection confirmation, and a notes tool you will actually use. Add Burp Professional when manual web testing becomes regular work rather than an occasional exercise.
Buy tools in the order your findings demand them, not in the order a listicle presents them.
If you would rather have this run by people who do it daily, our security testing services cover scoping, execution and retesting.