by: Hacking
Categories
Information Gathering
Vulnerability Analysis
Exploitation Tools
Wireless Attacks
Forensics Tools
Web Applications
  • apache-users
  • Arachni
  • BBQSQL
  • BlindElephant
  • Burp Suite
    • Burp Suite is a scanner and analyzer for vulnerabilities. It uses a proxy, and as a man-in-the-middle edits and repeats requests, decodes data, and more to the traffic [Link]. FoxyProxy is an add-on that automates setting up the proxy on and off on the browser [Link].
  • CutyCapt
  • DAVTest
  • deblaze
  • DIRB
  • DirBuster
    • Multi-threaded Java application designed to brute force directories and file names on web/application servers [Link].
  • fimap
  • FunkLoad
  • Gobuster
    • a tool to brute-force and discover directories, files, and subdomains [Link].
  • Grabber
    • spider/crawler canner and test for SQLi (SQL Injection) and XXS (Cross-Site Scripting).
  • hURL
  • jboss-autopwn
  • joomscan
  • jSQL Injection
  • Maltego Teeth
  • Nikto
    • Webserver scanner for vulnerabilities [Link].
  • PadBuster
  • Paros
  • Parsero
  • plecost
  • Powerfuzzer
  • ProxyStrike
  • Recon-ng
    • It is a web reconnaissance framework designed exclusively for web-based open source [Link].
  • Skipfish
    • a web site spider/crawler that can also test for various vulnerable parameters and configurations.
  • sqlmap
    • automates the process of detecting and exploiting SQL injection flaws and taking over database servers [Link].
  • Sqlninja
    • a SQL injection tool that exploits web applications that use a SQL server as a database server [Link].
  • sqlsus
    • another open-source SQL injection tool and is basically a MySQL injection and takeover tool [Link].
  • ua-tester
  • Uniscan
  • w3af
  • WebScarab
  • Webshag
  • WebSlayer
  • WebSploit
  • Wfuzz
    • Another fuzzing tool for testing web applications [Link].
  • WhatWeb
    • Gets the fingerprint of the website. It recognizes web technologies blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, embedded devices, and more [Link].
  • WPScan
    • WordPress security scanner [Link].
  • XSSer
    • an automatic framework to detect, exploit and report XSS vulnerabilities in web-based applications.
  • zaproxy
    • The OWASP Zed Attack Proxy (ZAP) is an easy-to-use integrated penetration testing tool for finding vulnerabilities in web applications [Link].
Stress Testing
Sniffing & Spoofing
Password Attacks
Maintaining Access
Hardware Hacking
Reverse Engineering
Reporting Tools
New Release Tools on Kali 2021.1
  • Airgeddon
    • Audit wireless networks.
  • AltDNS
    • Generates permutations, alterations, and mutations of subdomains and then resolve them.
  • Arjun
    • HTTP parameter discovery suite.
  • Chisel
    • A fast TCP/UDP tunnel over HTTP + WebSocket [Link].
  • DNSGen
    • Generates a combination of domain names from the provided input.
  • DumpsterDiver
    • Search secrets in various file types.
  • GetAllUrls
    • Fetch known URLs from AlienVault’s Open Threat Exchange, the Wayback Machine, and Common Crawl.
  • GitLeaks
    • Searches Git repo’s history for secrets and keys.
  • HTTProbe
    • Take a list of domains and probe for working HTTP and HTTPS servers.
  • MassDNS
    • A high-performance DNS stub resolver for bulk lookups and reconnaissance [Link].
  • PSKracker
    • WPA/WPS toolkit for generating default keys/pins.
  • WordlistRaider
    • Preparing existing wordlists.

New Release Tools on Kali 2022.1

  • dnsx
    • A multi-purpose DNS toolkit that allows users to run multiple DNS queries
  • email2phonenumber
    • An OSINT tool for discovering a target’s phone number if you have just their email address
  • naabu
    • A simple and reliable port scanner
  • nuclei
    • Targeted scanning based on templates
  • PoshC2
    • A proxy-aware C2 framework with post-exploitation and lateral movement
  • proxify
    • A Swiss Army knife Proxy tool for HTTP/HTTPS traffic capture, manipulation, and replay

New Release Tools on Kali 2023.1

New Release Tools on Kali 2024.1

  • blue-hydra
    • Bluetooth device discovery service
  • opentaxii
    • TAXII server implementation from EclecticIQ
  • readpe
    • Command-line tools to manipulate Windows PE files
  • snort
    • Flexible Network Intrusion Detection System

The list of tools was taken from Kali’s official website [Link] but any comment or observation is personal and may not reflect the truth.