Kali Linux ships with hundreds of tools, which is overwhelming when you're starting out. You don't need all of them. Master these five and you'll cover reconnaissance, traffic analysis, web testing, exploitation and password security — the core of practical ethical hacking.
1. Nmap — the network mapper
Nmap is how you discover what's on a network and which services are running. Host discovery, port scanning, service and version detection, and scriptable checks via the Nmap Scripting Engine make it the universal first step of any assessment. Learn to read its output and you understand a target's attack surface fast.
2. Wireshark — see the traffic
Wireshark captures and dissects network packets so you can see what's actually happening on the wire. It's invaluable for understanding protocols, spotting cleartext data, and debugging — and it builds the deep networking intuition that separates good testers from button-pushers.
3. Burp Suite — the web hacker's workbench
If you want to test web applications, Burp Suite is non-negotiable. As an intercepting proxy it lets you inspect and modify the requests between your browser and a site — the foundation for finding the OWASP Top 10 issues like injection, broken access control and authentication flaws. Start with the free Community Edition.
4. Metasploit — the exploitation framework
Metasploit ties exploitation together: a huge library of modules, payloads and post-exploitation tooling in one framework. For learners it's the best way to understand how a vulnerability becomes a foothold — practised, of course, against intentionally vulnerable lab targets like Metasploitable.
5. John the Ripper — password security
John the Ripper tests password strength by attempting to crack hashes you're authorised to assess. It teaches you why weak and reused passwords are catastrophic and why hashing, salting and MFA matter — turning an "attack" tool into a powerful defensive lesson.
How to practise legally
Build a home lab with virtual machines, attack deliberately vulnerable apps (DVWA, OWASP Juice Shop, Metasploitable), and use legal platforms like Hack The Box and TryHackMe. Progress to real bug-bounty programs strictly within their scope. The tools don't make you a hacker — disciplined, ethical practice does.
When it's your real product on the line, BytePatch runs authorised penetration tests with these tools — and the experience to use them well.
Explore cyber security →