Penetration testing tools

 Here is a categorized list of popular penetration testing tools along with their primary uses, organized by phases of the penetration testing lifecycle:

---

🧭 1. Reconnaissance (Information Gathering)

Tool	Use
Nmap	Network scanner to discover hosts, open ports, services, and operating systems.
Recon-ng	Web-based reconnaissance using modules to gather info from various sources.
theHarvester	Email, subdomain, and name collection via OSINT from search engines and databases.
Maltego	Graph-based link analysis for mapping relationships between people, companies, domains, etc.
Shodan	Search engine for Internet-connected devices; finds exposed services.
FOCA	Extracts metadata from documents found on web servers.

---

🕵️ 2. Scanning & Enumeration

Tool	Use
Nikto	Scans web servers for known vulnerabilities and outdated software.
Dirb / Gobuster	Directory brute-forcing to find hidden files/folders on websites.
Netcat (nc)	Banner grabbing, port scanning, backdoor creation, and more.
Enum4linux	Linux tool for enumerating information from Windows systems using SMB.
LDAPenum	Enumerates data from LDAP directories.

---

💥 3. Vulnerability Assessment

Tool	Use
Nessus	Enterprise-grade vulnerability scanner for network and systems.
OpenVAS	Open-source vulnerability scanning and management tool.
Nexpose	Rapid7’s vulnerability scanner to assess and manage risks.
Burp Suite (Community/Pro)	Identifies vulnerabilities in web apps; powerful with Pro version for scanning.
OWASP ZAP (Zed Attack Proxy)	Free web app scanner; detects common vulnerabilities (OWASP Top 10).

---

🔓 4. Exploitation

Tool	Use
Metasploit Framework	Framework for developing, testing, and executing exploits.
BeEF (Browser Exploitation Framework)	Targets web browsers to gain control of victim systems.
SQLmap	Automates SQL injection attacks to retrieve DB info.
Hydra / Medusa / Ncrack	Brute force tools for various protocols (SSH, FTP, HTTP, etc.).
ExploitDB	Online repository of publicly known exploits and vulnerabilities.

---

📡 5. Post-Exploitation

Tool	Use
Mimikatz	Extracts plaintext passwords, hashes, PINs from Windows memory.
Empire	Post-exploitation and adversary emulation tool using PowerShell.
PowerSploit	PowerShell scripts for post-exploitation on Windows.
BloodHound	Maps Active Directory relationships to identify privilege escalation paths.
LaZagne	Retrieves stored passwords from popular applications.

---

🧪 6. Wireless Attacks

Tool	Use
Aircrack-ng	Cracks WEP and WPA/WPA2-PSK keys using captured packets.
Kismet	Wireless network detector, sniffer, and IDS.
Reaver	Bruteforces WPS PIN to recover WPA/WPA2 passphrases.
WiFi-Pumpkin	Rogue access point framework for wireless network attacks.

---

📈 7. Web Application Testing

Tool	Use
Burp Suite	Manual and automated web vulnerability testing.
OWASP ZAP	Web application scanner, similar to Burp Suite.
Wfuzz	Web application brute forcer (for parameters, directories, etc.).
XSStrike	Detects and exploits XSS vulnerabilities.
Nikto	Web server scanning for misconfigurations, insecure files, etc.

---

🖥️ 8. Social Engineering

Tool	Use
Social-Engineer Toolkit (SET)	Performs phishing, credential harvesting, and other social engineering attacks.
Gophish	Phishing simulation tool for training and assessment.
Evilginx2	Man-in-the-middle phishing attacks using session hijacking.

---

🔧 9. General Utilities & Frameworks

Tool	Use
Kali Linux / Parrot OS	Linux distributions preloaded with hundreds of pen-testing tools.
Netcat	Network debugging, port scanning, reverse shells.
Wireshark	Packet sniffer and analyzer.
Tcpdump	Command-line packet analysis.
ProxyChains	Forces applications to connect through a proxy like TOR.

---

🧠 Bonus: AI-Assisted & Modern Tools

Tool	Use
ChatGPT + Burp Suite plugin	AI-assisted web application vulnerability explanation.
PentestGPT (GitHub)	LLM-based helper for pentest note-taking, enumeration planning, etc.
AutoRecon / LinPEAS / WinPEAS	Automated recon & privilege escalation enumeration scripts.