Advanced Kali Linux Tool Documentation
By Roshan Shrestha
This comprehensive documentation is designed strictly for cybersecurity education, ethical hacking training, and professional penetration testing. Using these tools against systems without explicit authorization is illegal and violates computer fraud and abuse laws. Always practice in controlled, authorized environments and follow responsible disclosure protocols.
Kali Linux is a Debian-derived Linux distribution designed for digital forensics and penetration testing. It is maintained and funded by Offensive Security Ltd, featuring over 600 preinstalled penetration-testing programs.
This advanced documentation provides detailed information on 100 essential cybersecurity tools available in Kali Linux and how they can be used in a controlled, ethical environment for learning cybersecurity concepts, preparing for certifications, and conducting authorized security assessments.
The tools are categorized by their primary function and include detailed command syntax, usage examples, and practical applications. Each tool also includes a complexity rating to help you understand the learning curve.
Select a category from the navigation menu above to explore different security tools and their commands. Use the search function to find specific tools by name or functionality.
Network analysis tools allow security professionals to inspect, analyze, and manipulate network traffic. These tools are essential for understanding network vulnerabilities, performing reconnaissance, and testing network security controls.
Network Mapper is a utility for network discovery and security auditing. It uses raw IP packets to determine available hosts, services, OS details, and more.
Wireshark is a network protocol analyzer that lets you capture and interactively browse the traffic running on a computer network. It has deep inspection capabilities for hundreds of protocols.
TCPDump is a powerful command-line packet analyzer that can be used to capture or filter TCP/IP packets received or transferred over a network. It's lightweight and works on systems where graphical tools aren't available.
Netcat (nc) is a versatile networking utility that reads and writes data across network connections using TCP or UDP protocols. It's known as the "Swiss Army knife" of networking tools.
Masscan is an Internet-scale port scanner, designed for scanning the entire Internet in under 5 minutes. It can transmit up to 10 million packets per second.
Zenmap is the official GUI for Nmap, providing a more user-friendly way to run Nmap scans. It includes scan comparison, visualization, and profile management features.
hping3 is a command-line TCP/IP packet assembler/analyzer that allows security professionals to craft and send custom packets and analyze network responses.
Bettercap is a powerful, modular and portable Swiss Army knife for network attacks and monitoring. It allows for WiFi, Bluetooth, and ethernet network reconnaissance and MITM attacks.
Ettercap is a comprehensive suite for man-in-the-middle attacks. It features content filtering, active and passive dissection of protocols, and many network and host analysis capabilities.
Arpwatch is a computer software tool for monitoring Address Resolution Protocol traffic on a network. It generates logs of observed pairing of IP addresses with MAC addresses along with timestamps.
Important: Using these tools to access networks without authorization is illegal. Only practice on networks you own or have explicit permission to test.
Wireless security tools allow for the analysis, assessment, and testing of wireless network security. These tools can identify vulnerabilities in wireless implementations, test encryption strength, and analyze wireless traffic.
Aircrack-ng is a network software suite consisting of a detector, packet sniffer, WEP and WPA/WPA2-PSK cracker and analysis tool for 802.11 wireless LANs.
Kismet is a wireless network detector, sniffer, and intrusion detection system. It works with any wireless card that supports raw monitoring mode and can sniff 802.11a/b/g/n traffic.
Wifite is an automated wireless attack tool designed to simplify the process of auditing wireless networks. It automates the use of various tools from the aircrack-ng suite.
Reaver implements a brute force attack against WiFi Protected Setup (WPS) registrar PINs to recover WPA/WPA2 passphrases.
Airgeddon is a multi-use bash script for Linux systems to audit wireless networks. It automates various wireless attacks and has an interactive menu system.
Bully is a new implementation of the WPS brute force attack, written in C. It has several advantages over previous tools, including multi-threading and session resumption.
PixieWPS is a tool implementing the pixie dust attack and can be used to find the WPS PIN of a vulnerable router in seconds, resulting in the recovery of the WPA/WPA2 passphrase.
Fern WiFi Cracker is a GUI-based wireless security auditing application that can crack and recover WEP/WPA/WPA2 keys and perform other network-based attacks.
mdk3 is a proof-of-concept tool to exploit common IEEE 802.11 protocol weaknesses, including beacon flooding, authentication DoS attacks, and deauthentication attacks.
Wifite2 is an improved version of the original Wifite with more features, better error handling, and enhanced automation for wireless network auditing.
Web application security tools help identify and exploit vulnerabilities in web applications. These tools are essential for testing security controls, identifying vulnerabilities, and ensuring web applications are secure against common attack vectors.
Burp Suite is an integrated platform for performing security testing of web applications. It functions as a proxy server and can be used to intercept, inspect, and modify traffic between your browser and the target application.
The OWASP Zed Attack Proxy (ZAP) is an integrated penetration testing tool for finding vulnerabilities in web applications. It provides automated scanners and tools for manual testing.
Nikto is an open source web server scanner which performs comprehensive tests against web servers for multiple vulnerabilities, including outdated software and dangerous files.
Dirb is a web content scanner that uses a dictionary-based approach to find hidden directories and files on web servers by sending requests and analyzing responses.
SQLmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over database servers.
WPScan is a black box WordPress vulnerability scanner that can identify vulnerabilities, enumerate users, and test password strength in WordPress installations.
Gobuster is a tool used to brute-force URIs (directories and files) in web sites, DNS subdomains, and virtual host names. It's known for its speed and efficiency.
Dirsearch is a mature command-line tool designed for brute forcing directories and files in webservers, with a modern Python implementation and many features.
Commix (Command Injection Exploiter) is an automated tool that can help detect and exploit command injection vulnerabilities in web applications.
XSSer is an automatic framework to detect, exploit and report XSS vulnerabilities in web applications. It contains multiple attack vectors and modern techniques.
Vulnerability assessment tools help identify security weaknesses in systems, networks, and applications. These tools scan for known vulnerabilities, misconfigured services, and security issues that could be exploited by attackers.
OpenVAS (Open Vulnerability Assessment System) is a framework of services and tools for vulnerability scanning and vulnerability management, offering a comprehensive solution for vulnerability assessment.
Nessus is a proprietary vulnerability scanner that helps identify vulnerabilities, configuration issues, and malware that hackers could use to penetrate your network.
Lynis is a security auditing tool for Unix/Linux systems. It performs an in-depth security scan and provides recommendations for hardening the system.
Nexpose is a vulnerability management solution that combines vulnerability and asset management capabilities with vulnerability checking, risk classification, and integrated remediation workflows.
Retina Network Security Scanner identifies known vulnerabilities, configuration issues, and missing patches across operating systems, applications, devices, and virtual environments.
OWASP Dependency-Check is a software composition analysis tool that detects publicly disclosed vulnerabilities in project dependencies, helping identify vulnerable components in your applications.
OSSEC is a host-based intrusion detection system (HIDS) that performs log analysis, integrity checking, Windows registry monitoring, rootkit detection, real-time alerting and active response.
Vuls is an agentless vulnerability scanner for Linux/FreeBSD that automatically detects security vulnerabilities and creates notifications. It's fast, reliable, and has minimal impact on system resources.
Metasploit Pro is a commercial penetration testing solution that helps security teams efficiently verify vulnerabilities, manage security assessments, and improve security awareness.
Vulners Scanner checks installed software packages against the Vulners database of vulnerabilities to identify security issues in your system packages and dependencies.
Important: These tools are designed for authorized security testing only. Using exploitation tools against systems without explicit permission is illegal and unethical.
Exploitation tools are used to leverage known vulnerabilities in systems, applications, or networks. These tools help security professionals validate vulnerabilities and assess the potential impact of successful exploitation in controlled environments.
Metasploit Framework is a powerful open-source platform for developing, testing, and executing exploits. It contains a database of ready-to-use exploits and a robust infrastructure for custom exploit development.
The Browser Exploitation Framework (BeEF) is a penetration testing tool that focuses on the web browser, allowing security professionals to assess the security posture of a target by exploiting browser vulnerabilities.
Armitage is a graphical cyber attack management tool for the Metasploit Framework that visualizes targets, recommends exploits, and exposes advanced post-exploitation features.
PowerSploit is a collection of PowerShell modules that can be used to aid penetration testers during all phases of an assessment, with a focus on post-exploitation techniques.
The Social Engineering Toolkit (SET) is an open-source penetration testing framework designed for social engineering. It contains various attack vectors that allow security professionals to test the effectiveness of user awareness.
Empire is a pure PowerShell post-exploitation agent with compatibility for Linux/macOS. It allows for stealthy communication and extensive post-exploitation modules for Windows targets.
RouterSploit is an open-source exploitation framework dedicated to embedded devices like routers and IoT devices. It contains various exploits, scanners, and brute force mechanisms specifically designed for these devices.
Koadic is a Windows post-exploitation rootkit similar to other penetration testing tools but utilizes Windows Script Host, providing an interface similar to Metasploit with a JavaScript-based agent.
Shellter is a dynamic shellcode injection tool that can be used to create stealth backdoors for Windows applications by re-engineering native executables to be undetectable by antivirus solutions.
Cobalt Strike is a commercial, full-featured penetration testing tool that leverages "Beacon" payloads to model advanced attackers. It's widely used for adversary simulation and red team operations.
Important: Password testing tools should only be used for recovering your own passwords or in authorized penetration testing environments. Unauthorized use is illegal.
Password security tools help assess the strength of password policies, test password hashing mechanisms, and recover passwords when authorized. These tools are essential for testing the security of authentication systems.