Kali Linux

Burp Suite

portswigger.net

Popular

PortSwigger's intercepting proxy and scanner; the standard toolkit for web application pentesting.

ZAP

zaproxy/zaproxy

Popular

Free open-source web app scanner and intercepting proxy (formerly OWASP ZAP), now backed by Checkmarx.

Nuclei

projectdiscovery/nuclei

Popular

Fast template-based vulnerability scanner with thousands of community YAML templates for CVEs and misconfigs.

Nmap

nmap/nmap

Popular

Classic network discovery and port scanner with a scripting engine for service and vulnerability detection.

Metasploit

rapid7/metasploit-framework

Popular

Rapid7's exploitation framework with thousands of modules for exploits, payloads and post-exploitation.

Caido

caido.io

Rising

Modern, lightweight Rust-based web security auditing toolkit; a rising Burp Suite alternative.

sqlmap

sqlmapproject/sqlmap

Automates detection and exploitation of SQL injection flaws across major database engines.

ffuf

ffuf/ffuf

Fast web fuzzer for discovering hidden content, parameters and virtual hosts.

Wireshark

wireshark/wireshark

Popular

The standard network protocol analyzer for capturing and inspecting packets.