100+ tools · updated for Kali & Parrot 2026

The ethical hacker’s
command library, explained.

Stop memorising flags from scattered cheat-sheets. Every offensive-security command in one searchable, expert-written reference — syntax, real examples and honest trade-offs — then run the recon tools live against a target you control.

Explore the arsenal →Open the live lab

244 commands15 categories20 runnable liveFree & education-first

244+

Documented commands

15

Tool categories

20

Tools you can run live

7

Guided recon stages

// start here

Learning paths

Not sure where to begin? Follow a track. Each one curates the right tools, in the right order, for a discipline.

Information Gathering

Map the attack surface — DNS, subdomains, ports and services.

nmapmasscanamassdnsenum

Start the path →

Web Application

Fuzz, enumerate and exploit web apps end to end.

ffufsqlmapnucleidalfox

Start the path →

Vulnerability Analysis

Surface known CVEs, misconfigs and weak TLS fast.

niktonucleisearchsploittestssl-sh

Start the path →

Password Attacks

Online and offline cracking, hashes and wordlists.

hydrahashcatjohncrunch

Start the path →

Wireless Attacks

Capture handshakes and audit Wi-Fi security.

aircrack-ngairodump-ngreaverwifite

Start the path →

PowerShell

Windows recon, privesc checks and automation.

get-processresolve-dnsnameget-acl

Start the path →

// the arsenal

Browse every command

Search by name or tag, or filter by category. Each card opens a full page with syntax, examples and pros & cons.

All (244)Information Gathering (45)Vulnerability Analysis (14)Web Application (27)Database Assessment (8)Password Attacks (17)Wireless Attacks (17)Exploitation (12)Social Engineering (3)Sniffing & Spoofing (15)Post-Exploitation (17)Forensics (19)Reverse Engineering (17)Reporting & Collaboration (4)PowerShell (12)Core Linux (17)

Information Gathering

Reconnaissance, OSINT, DNS, network discovery and fingerprinting.

Nmap

The de-facto network mapper and port/service scanner.

KaliParrotLinux

Masscan

Internet-scale asynchronous TCP port scanner.

KaliParrotLinux

whois

Query domain/IP registration records.

KaliParrotLinux

dig

Flexible DNS lookup utility.

KaliParrotLinux

dnsenum

DNS enumeration: records, zone transfers, brute force.

dnsrecon

Scriptable DNS reconnaissance and enumeration.

theHarvester

Gather emails, subdomains and hosts from public sources.

Recon-ng

Modular OSINT reconnaissance framework.

OWASP Amass

In-depth attack-surface mapping & subdomain enumeration.

subfinder

Fast passive subdomain discovery.

Sublist3r

Subdomain enumeration via search engines.

netdiscover

Active/passive ARP host discovery on a LAN.

arp-scan

Fast ARP-based host discovery and MAC fingerprinting.

KaliParrotLinux

enum4linux

Enumerate information from Windows/Samba (SMB) hosts.

smbclient

FTP-like client for SMB/CIFS shares.

KaliParrotLinux

snmpwalk

Walk an SNMP tree to extract device data.

KaliParrotLinux

WhatWeb

Identify web technologies behind a site.

wafw00f

Detect and fingerprint web application firewalls.

fierce

DNS reconnaissance to locate non-contiguous IP space.

fping

Fast, parallel ICMP host sweeping.

KaliParrotLinux

DMitry

Deepmagic information gathering tool.

SpiderFoot

Automated OSINT collection with 200+ modules.

Maltego

Visual link-analysis OSINT platform.

Sherlock

Hunt usernames across social networks.

assetfinder

Find domains/subdomains related to a target.

gau (getallurls)

Fetch known URLs from web archives.

waybackurls

Pull a domain’s URLs from the Wayback Machine.

gowitness

Headless-Chrome web screenshotting.

EyeWitness

Screenshot sites and group by similarity.

onesixtyone

Fast SNMP community-string scanner.

KaliParrotLinux

snmp-check

Human-readable SNMP enumeration.

smtp-user-enum

Enumerate valid users via SMTP.

Swaks

Swiss-army knife for SMTP testing.

KaliParrotLinux

nbtscan

Scan NetBIOS name information.

KaliParrotLinux

rpcclient

Query MS-RPC on Windows/Samba hosts.

KaliParrotLinux

ldapsearch

Query LDAP / Active Directory.

KaliParrotLinux

hping3

Custom TCP/IP packet crafter & scanner.

KaliParrotLinux

p0f

Passive OS/network fingerprinting.

KaliParrotLinux

wig

WebApp Information Gatherer (CMS detect).

Metagoofil

Harvest metadata from public documents.

httpx

Fast, multi-purpose HTTP probing toolkit.

naabu

Fast SYN/CONNECT port scanner in Go.

dnsx

Fast, multi-purpose DNS toolkit.

Shodan CLI

Query the Shodan internet-scan database.

Knockpy

Subdomain scanner via brute force + sources.

Vulnerability Analysis

Scanners that surface known weaknesses, CVEs and misconfigurations.

Nikto

Classic web server vulnerability scanner.

KaliParrotLinux

Nuclei

Template-based vulnerability scanner.

WPScan

WordPress vulnerability scanner.

Lynis

Host security auditing & hardening tool.

KaliParrotLinux

searchsploit

Offline search of the Exploit-DB archive.

sslscan

Quickly enumerate SSL/TLS ciphers and protocols.

KaliParrotLinux

SSLyze

Fast, programmatic TLS configuration analyzer.

KaliParrotLinux

testssl.sh

Thorough TLS/SSL testing shell script.

KaliParrotLinux

OpenVAS / GVM

Full-featured network vulnerability scanner.

Wapiti

Black-box web vulnerability scanner.

Skipfish

High-speed active web recon scanner.

Legion

GUI network pentest framework (SPARTA successor).

LinPEAS

Linux privilege-escalation auditing script.

WinPEAS

Windows privilege-escalation auditing tool.

Web Application

Content discovery, fuzzing, SQL injection and web exploitation.

Gobuster

Fast directory/DNS/vhost brute-forcer.

ffuf

Fuzz Faster U Fool — high-speed web fuzzer.

DIRB

Classic recursive web content scanner.

feroxbuster

Fast, recursive content discovery in Rust.

Wfuzz

Web application fuzzer for content & parameters.

sqlmap

Automatic SQL injection detection & exploitation.

Commix

Automated command-injection exploitation.

Dalfox

Fast parameter-analysis XSS scanner.

XSSer

Automated framework to detect & exploit XSS.

JoomScan

Joomla vulnerability/enumeration scanner.

CMSeeK

Detect CMS and enumerate version/plugins.

Burp Suite

The industry-standard web proxy & testing suite.

OWASP ZAP

Free, full-featured web app scanner & proxy.

dirsearch

Advanced web path brute-forcer.

Katana

Next-gen crawling & spidering framework.

hakrawler

Fast web crawler for endpoint discovery.

Arjun

HTTP parameter discovery tool.

ParamSpider

Mine parameters from web archives.

XSStrike

Advanced XSS detection with payload fuzzing.

jwt_tool

Test and tamper JSON Web Tokens.

droopescan

Scanner for Drupal, SilverStripe & more.

gospider

Fast Go web spider.

gf (grep-friendly)

Pattern wrapper to find interesting URLs.

qsreplace

Replace query-string values in URLs.

anew

Append only new, unique lines to a file.

CRLFuzz

Scan for CRLF injection vulnerabilities.

Jaeles

Signature-based web vulnerability scanner.

Database Assessment

Discover and exploit weaknesses in SQL and NoSQL databases.

sqlmap (DB mode)

Enumerate & dump databases via SQL injection.

NoSQLMap

Automated NoSQL injection (MongoDB et al).

jSQL Injection

GUI SQL injection & data-extraction tool.

mdb-tools

Read Microsoft Access (.mdb) databases.

KaliParrotLinux

tnscmd10g

Probe the Oracle TNS Listener.

Oscanner

Oracle assessment framework.

Sqlninja

Exploit SQL injection on MS-SQL Server.

SIDGuesser

Guess Oracle database SIDs.

Password Attacks

Online/offline cracking, hash analysis and wordlist generation.

Hydra

Fast online brute-force for many protocols.

John the Ripper

Versatile offline password hash cracker.

KaliParrotLinux

hashcat

World’s fastest GPU password recovery.

KaliParrotLinux

Medusa

Parallel, modular online brute-forcer.

crunch

Generate custom wordlists by pattern.

KaliParrotLinux

CeWL

Spider a site to build a custom wordlist.

hash-identifier

Guess the algorithm behind a hash.

Ncrack

High-speed network authentication cracker (Nmap project).

KaliParrotLinux

CrackMapExec

Swiss-army knife for AD/SMB networks.

Evil-WinRM

WinRM shell for Windows post-exploitation.

smbmap

Enumerate SMB shares and permissions.

Kerbrute

Brute/enumerate AD accounts via Kerberos.

Patator

Modular, multi-protocol brute-forcer.

CUPP

Build targeted wordlists from a profile.

fcrackzip

Crack password-protected ZIP files.

KaliParrotLinux

pdfcrack

Recover passwords from PDF files.

KaliParrotLinux

SecLists

The collection of security wordlists.

Wireless Attacks

Wi-Fi monitoring, capture, deauth and WPA/WPS attacks.

Aircrack-ng

Crack WEP/WPA-PSK keys from captures.

airmon-ng

Enable monitor mode on wireless interfaces.

airodump-ng

Capture 802.11 frames and WPA handshakes.

aireplay-ng

Inject frames — deauth, fake auth, replay.

Reaver

Brute-force WPS PINs to recover WPA keys.

Wifite

Automated wireless auditing wrapper.

Kismet

Passive wireless detector & sniffer.

Wifiphisher

Rogue-AP framework for phishing Wi-Fi creds.

Fluxion

Evil-twin WPA handshake-capture attack.

airgeddon

All-in-one wireless auditing menu.

hcxdumptool

Capture PMKID/handshakes for hashcat.

coWPAtty

Offline WPA-PSK dictionary cracking.

Bully

WPS brute-force (Reaver alternative).

Pixiewps

Offline WPS PIN brute-force (Pixie Dust).

EAPHammer

Evil-twin attacks against WPA2-Enterprise.

MDK4

Wi-Fi stress/DoS and attack tool.

hcxtools

Convert Wi-Fi captures for hashcat.

Exploitation

Frameworks and payload generators for gaining access.

Metasploit (msfconsole)

The premier exploitation framework.

msfvenom

Generate and encode payloads.

Social-Engineer Toolkit (SET)

Framework for social-engineering attacks.

BeEF

Browser Exploitation Framework.

RouterSploit

Exploitation framework for embedded devices.

Armitage

Graphical front-end for Metasploit.

getsploit

Search & download exploits from many sources.

Veil

Generate AV-evading payloads.

Shellter

Inject payloads into legit Windows EXEs.

Sliver

Modern open-source C2 framework.

PowerShell Empire

PowerShell/Python post-exploitation C2.

Donut

Convert EXE/DLL into position-independent shellcode.

Sniffing & Spoofing

Packet capture, MITM, ARP/DNS spoofing and traffic analysis.

Wireshark

The reference graphical packet analyzer.

KaliParrotLinux

tcpdump

Command-line packet capture.

KaliParrotLinux

TShark

Wireshark’s power in a terminal.

KaliParrotLinux

Ettercap

Classic suite for MITM on a LAN.

bettercap

Modern, modular MITM & network attack swiss-army knife.

Responder

LLMNR/NBT-NS/MDNS poisoner & credential capture.

mitmproxy

Interactive HTTPS intercepting proxy.

KaliParrotLinux

dsniff

Classic suite for password sniffing on a LAN.

KaliParrotLinux

arpspoof

Redirect LAN traffic via ARP poisoning.

KaliParrotLinux

macchanger

View and spoof network MAC addresses.

KaliParrotLinux

mitm6

Abuse IPv6 to MITM Windows networks.

Scapy

Interactive packet manipulation in Python.

KaliParrotLinux

sslstrip

Downgrade HTTPS to HTTP in a MITM.

KaliParrotLinux

ngrep

grep for network packets.

KaliParrotLinux

tcpreplay

Replay captured packets onto a network.

KaliParrotLinux

Post-Exploitation

Pivoting, tunnelling, shells and credential harvesting.

Netcat (nc)

The TCP/IP “swiss-army knife”.

KaliParrotLinux

socat

Multipurpose relay — “netcat on steroids”.

KaliParrotLinux

proxychains

Force any TCP tool through a proxy chain.

KaliParrotLinux

Chisel

Fast TCP/UDP tunnel over HTTP/SSH.

Mimikatz

Extract Windows credentials from memory.

Weevely

Stealthy PHP web shell & manager.

Impacket

Python toolkit of Windows/AD attack scripts.

BloodHound

Map Active Directory attack paths.

PowerSploit

PowerShell post-exploitation modules.

sshuttle

Transparent VPN-over-SSH for pivoting.

KaliParrotLinux

Ligolo-ng

Fast tunneling/pivoting via a TUN interface.

pwncat

Supercharged reverse-shell handler.

pspy

Watch processes/cron without root.

Linux Exploit Suggester

Suggest kernel/privesc exploits for a host.

Certipy

Attack Active Directory Certificate Services.

Rubeus

Kerberos abuse toolkit for Windows.

SharpHound

BloodHound data collector for AD.

Forensics

Carving, memory & disk analysis, steganography and metadata.

Binwalk

Analyse & extract embedded files from firmware.

KaliParrotLinux

Foremost

Recover files by header/footer carving.

KaliParrotLinux

Volatility

Memory (RAM) forensics framework.

KaliParrotLinux

ExifTool

Read/write file metadata (EXIF and beyond).

KaliParrotLinux

Steghide

Hide/extract data inside images and audio.

KaliParrotLinux

Autopsy

GUI digital-forensics platform (Sleuth Kit).

KaliParrotLinux

dd

Low-level block copy / disk imaging.

KaliParrotLinux

The Sleuth Kit

CLI toolkit for disk & filesystem forensics.

KaliParrotLinux

TestDisk

Recover lost partitions & fix disks.

KaliParrotLinux

PhotoRec

Carve files regardless of filesystem.

KaliParrotLinux

bulk_extractor

Scan images for emails, cards, URLs.

KaliParrotLinux

chkrootkit

Check a system for known rootkits.

KaliParrotLinux

rkhunter

Rootkit Hunter integrity checker.

KaliParrotLinux

Stegseek

Ultra-fast steghide passphrase cracker.

zsteg

Detect LSB steganography in PNG/BMP.

GNU ddrescue

Image failing disks with error recovery.

KaliParrotLinux

Scalpel

Fast, configurable file carver.

KaliParrotLinux

pdf-parser

Inspect PDF structure & embedded objects.

hashdeep

Recursively hash & audit file sets.

KaliParrotLinux

Reverse Engineering

Disassembly, debugging and binary inspection.

radare2

Powerful CLI reverse-engineering framework.

KaliParrotLinux

Ghidra

NSA’s open-source SRE suite with decompiler.

KaliParrotLinux

GDB

The GNU debugger.

KaliParrotLinux

strings

Extract printable strings from binaries.

KaliParrotLinux

strace

Trace system calls and signals.

KaliParrotLinux

ltrace

Trace library/function calls.

KaliParrotLinux

objdump

Disassemble and inspect object files.

KaliParrotLinux

Apktool

Decode & rebuild Android APKs.

KaliParrotLinux

jadx

Decompile Android APK/DEX to Java.

KaliParrotLinux

dex2jar

Convert Android DEX to JAR.

KaliParrotLinux

Cutter

GUI for Rizin/radare2 with decompiler.

KaliParrotLinux

Ropper

Find ROP/JOP gadgets in binaries.

pwntools

CTF/exploit-development framework.

checksec

Show binary exploit-mitigation flags.

Frida

Dynamic instrumentation toolkit.

KaliParrotLinux

ROPgadget

Search binaries for ROP gadgets.

readelf

Display info about ELF files.

KaliParrotLinux

Reporting & Collaboration

Organise findings, evidence and engagement reports.

Faraday

Collaborative pentest IDE & vuln manager.

Dradis

Reporting & collaboration framework.

CherryTree

Hierarchical note-taking for engagements.

KaliParrotLinux

Pipal

Analyse cracked-password patterns.

PowerShell

Windows administration, recon and automation cmdlets.

Get-Process

List running processes on Windows.

Get-Service

Enumerate Windows services and their state.

Get-NetTCPConnection

List active TCP connections (PowerShell netstat).

Test-NetConnection

Ping/port/traceroute diagnostics in one cmdlet.

Invoke-WebRequest

PowerShell’s curl/wget for HTTP.

Resolve-DnsName

DNS lookups from PowerShell.

Get-LocalUser

Enumerate local user accounts.

Get-FileHash

Compute file hashes (SHA256, etc.).

Get-EventLog / Get-WinEvent

Query Windows event logs.

Get-ChildItem

List files/dirs/registry (PowerShell ls/dir).

Get-Acl

Inspect permissions (ACLs) on objects.

Set-ExecutionPolicy

Control whether PowerShell scripts may run.

Core Linux

Everyday shell utilities every operator should master.

ssh

Secure remote shell and tunneling.

KaliParrotLinux

curl

Transfer data with URLs (HTTP and many protocols).

KaliParrotLinux

wget

Non-interactive downloader & site mirror.

KaliParrotLinux

grep

Search text with regular expressions.

KaliParrotLinux

find

Search the filesystem by criteria.

KaliParrotLinux

ss

Modern socket/connection statistics (netstat successor).

KaliParrotLinux

netstat

Classic network connection/route viewer.

KaliParrotLinux

ps

Report running processes.

KaliParrotLinux

tar

Archive and extract files.

KaliParrotLinux

chmod

Change file permission bits.

KaliParrotLinux

awk

Pattern-scanning & text-processing language.

KaliParrotLinux

sed

Stream editor for transforming text.

KaliParrotLinux

jq

Command-line JSON processor.

KaliParrotLinux

openssl

Crypto/TLS swiss-army knife.

KaliParrotLinux

tmux

Terminal multiplexer for persistent sessions.

KaliParrotLinux

xxd

Hex dump and reverse hex-to-binary.

KaliParrotLinux

iptables / nftables

Configure the Linux firewall.

KaliParrotLinux

Reading is good. Doing is better.

Verify a domain you own, then watch real tools execute stage by stage with live output and an automatic report.

Launch the lab →