The best ethical hacking tools for beginners

When you start out, the list of ethical hacking tools for beginners seems endless: Kali Linux ships hundreds and a new one shows up on GitHub every week. In reality, with a dozen learned well you can solve most beginner machines and understand how an audit works. Here are the ones we recommend learning first, ordered by the phase of the work where they are used.

Remember: all of these tools are legal, but using them against systems without authorisation is not. Always practise in your lab or on platforms such as TryHackMe and Hack The Box.

Reconnaissance and scanning: the first ethical hacking tools

Nmap

Nmap is the tool you will use the most. It discovers which hosts are up, which ports are open and which services and versions run on them. Its NSE scripts also detect insecure configurations and known vulnerabilities.

nmap -sC -sV -oN scan.txt 10.10.10.5

This command runs the default scripts (-sC), detects versions (-sV) and saves the result. Also learn -p- to scan every port.

Wireshark

Wireshark captures and displays network traffic packet by packet. It is not an attack tool as such, but it is the best way to understand what really happens on the network, and it will help you debug almost any problem.

Subfinder and theHarvester

For passive domain reconnaissance, Subfinder finds subdomains from public sources and theHarvester gathers emails, names and hosts. They are especially useful in bug bounty and external audits.

Web analysis

Burp Suite or Caido

An intercepting proxy is essential for web hacking: it sits between your browser and the application and lets you see and modify every request. Burp Suite is the industry standard and its Community edition is free. Caido is a lighter, more modern alternative with a free plan. Learn with whichever you prefer; the concepts are the same.

ffuf and Gobuster

ffuf and Gobuster discover hidden directories, files and parameters by trying wordlists. Combine them with the SecLists wordlists.

ffuf -u http://10.10.10.5/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt

sqlmap

sqlmap automates detecting and exploiting SQL injection. Use it only after understanding SQL injection by hand (the PortSwigger Academy labs are ideal for that); otherwise you will not know how to interpret what it does.

Exploitation

Metasploit

Metasploit is a framework with thousands of exploits, payloads and auxiliary modules. It is very useful to learn how an exploit is structured and to manage sessions, although you should not depend on it: some certifications restrict its use in the exam.

searchsploit

searchsploit searches a local copy of Exploit-DB. When Nmap gives you a specific service version, it is the first thing you check.

searchsploit vsftpd 2.3.4

Netcat

Netcat is the Swiss army knife of TCP and UDP connections: open a listening port, connect to a service or catch a reverse shell. To generate reverse shell commands in different languages, revshells saves you a lot of time.

Post-exploitation and privilege escalation

PEASS-ng

PEASS-ng includes LinPEAS and WinPEAS, scripts that review a compromised system looking for ways to escalate privileges: misconfigured permissions, credentials in files, scheduled tasks, SUID binaries...

GTFOBins and HackTricks

They are not tools you run, but you will check them daily. GTFOBins explains how to abuse Linux binaries to escalate privileges and HackTricks is an encyclopedia of techniques by service and technology.

John the Ripper and Hashcat

To crack password hashes in your labs: John the Ripper is simple and versatile, and Hashcat uses the GPU to go much faster.

In what order to learn these tools

1. Nmap and Netcat, alongside networking fundamentals.
2. Burp Suite or Caido, and ffuf, while you study web hacking.
3. searchsploit and Metasploit, when you start full machines.
4. PEASS-ng and GTFOBins, for privilege escalation.
5. sqlmap and Hashcat, once you understand the problem they automate.

Later on will come Active Directory tools such as BloodHound or NetExec, but there is no rush. You can browse every category from the exploitation or reconnaissance sections.

Tools you do not need yet

Some tools that are very popular on social media add little at the beginning. Command and control (C2) frameworks such as Cobalt Strike or Sliver make sense in red team exercises, not while you are still learning to enumerate. Automated vulnerability scanners such as Nessus or OpenVAS are useful in real audits, but they produce long lists you will not know how to prioritise without understanding what is behind them. And automation scripts that launch dozens of tools at once only save you time when you already know how to do each step by hand. Manual method first; automation comes later.

Tip: for each tool, write down in your notes the command you use most, what each option means and a case where it worked for you.

Frequently asked questions

Do I need Kali Linux to use these tools?

It is not mandatory, but Kali ships almost all of them preinstalled and saves you work. Learn to install it in our guide to Kali Linux for beginners.

Are they free?

Every tool on this list has a free version. Burp Suite also has a paid professional edition; check the current price on its website if you ever need it.

What is the most important tool for a beginner?

Nmap. Almost every audit starts by finding out what is exposed, and learning it well forces you to understand networking.

Can I use these tools against any website to practise?

No. Scanning or attacking systems without authorisation may be a crime. Use your lab, applications such as DVWA or authorised platforms.

If you want to learn these tools with an order and a methodology, in Spanish, we are preparing Ethical hacking from scratch ("Hacking ético desde cero"): 8 modules designed for beginners. The launch price will be 29 € (49 € afterwards) and the waitlist is already open.