Penetration testers are white hat hackers who try any means possible to break into a system
Although hacking is manual labor, it requires specialist utilities to explore and document a target system. The information gathered by those scanners provides input for an attack.
Here is our list of the ten best penetration testing tools:
- CrowdStrike Penetration Testing Services EDITOR’S CHOICE This service removes all tedious manual tasks from your shoulders and even eradicates the need for tools because it provides a remote team to do the penetration testing for you. Access a 15-day free trial.
- Intruder (FREE TRIAL) A cloud-based automated scanner that can be set to run continuously or launched on demand for penetration testing investigations. Start a 30-day free trial.
- Metasploit An open-source penetration testing framework available in free and paid versions and offers a range of attack strategies. Available for Windows, Windows Server, macOS, RHEL, and Ubuntu.
- Wireshark A highly respected packet sniffer that can capture track on LANs and wireless networks. Available for Windows, Linux, Unix, and macOS.
- Burp Suite A system tests Web applications by capturing and injecting packets between a browser and a Web server. Available for Windows, macOS, and Linux.
- Aircrack-ng A competent packet sniffer for wireless networks that includes some password cracking support. It runs on Linux.
- Autopsy and The Sleuth Kit, Sleuth Kit, is a forensic investigation utility that explores hard disks and can recover deleted content. Autopsy is a GUI front end for the tool. Available for Windows, macOS, and Linux.
- Sqlmap A command-line system can perform a range of attacks on database-supported applications, such as Web pages, and includes password cracking features. Available for Windows, macOS, and Linux.
- Zenmap A GUI version of the widely used Nmap, which is also called Network Mapper. This is a free utility that is available for Windows, Linux, BSD Unix, and macOS.
- Ettercap A traffic capture tool that implements a range of man-in-the-middle attacks. Available for Linux, Unix, Mac OS X, and Windows 7 and 8.
Where there are tools that save time, a hacker will use them because much of the success experienced by hackers is the result of dogged determination. For example, consider brute force attacks. With this strategy, you try every possible combination of username and password to guess the credentials for a user account. Even with relatively shortlists of possible values for each variable, permutations can quickly reach the thousands. But, of course, you wouldn’t want to have to type all of those in, so an automated tool for credentials cracking is necessary for any hacker’s toolkit.
A great benefit of following in the footsteps of cybercriminals is that they don’t like to pay for anything, so many of the tools they use are free. Many excellent paid tools have a free version and, it is probably the edition that costs nothing that attracts the hackers. However, if you consider buying the higher edition, you could steal a march on any hacker that might one day attack your system.
Fully automated testing
When looking for automated penetration testing tools, you wouldn’t be in the market for a fully automatic system tester – that’s a vulnerability scanner. The difference between a vulnerability scanner and penetration testing is that a vulnerability will work through a list of known system weaknesses and check on the status of each. Still, a penetration tester is a human, performing a series of probes manually. Eventually, the hacker will work through all of the exact system searches that the vulnerability manager uses.
Automated penetration testing tools don’t automate the entire test plan. Instead, they just provide fast programmatic services that save a great deal of time in each research exercise.
The best Automated Penetration Testing tools
In the search for automated penetration testing tools, you need to focus on the types of tools that cut out many repetitive tasks. There are many valuable services available and, as has already been explained, many of them are free. However, hackers are not too fussy about user-friendly interfaces, so the most frequently-used hacker tools tend to be command-line utilities.
Our methodology for selecting automated penetration testing tools
We reviewed the market for automated pen-testing systems and analyzed tools based on the following criteria:
- A tool that cuts out a lot of data entry and repetitive runs of commands
- A specialist service that can quickly attack one aspect of system security
- A utility that can perform both the research and launch an attack without the need to transpose data
- A system that can record all activities for assessment
- Tools that offer several attack strategies
- A free tool or a free trial or demo for a paid tool
- A free tool that is worth using or a paid tool that is worth the price
With these selection criteria in mind, we produced various options to suit businesses of all sizes.
CrowdStrike Penetration Testing Services is the right choice for you if your main requirement from an automated penetration testing tool is to get something to do all of the penetration testing for you. This package isn’t actually a tool – it is a consultancy service.
A big benefit of automated penetration testing tools is that they not only provide utilities for research and attacks, they also integrate workflows. Those tools know what steps follow on from each other and flow research data through to attack mechanisms. Pushing that aim to its logical conclusion, a penetration testing service is the ultimate in automated testing systems. You specify what you need testing and a little while later, you get a report that shows it was done. That is a totally hands-free penetration testing strategy.
- Internal penetration testing to attempt lateral movement around your network
- External testing from any points on the globe
- Tests for Web applications, mobile apps, and APIs
- A range of tests to attempt hijacking and corruption of your systems
- Tests to assess current security software
- Classing this service as an automated penetration testing tool is stretching the definition of “tool”
CrowdStrike Penetration Testing Services is able to attack LANs, wireless networks, internet-based systems, and cloud resources. It isn’t an off-the-peg solution, so there is no price list or free trial for the service. You have to contact CrowdStrike and negotiate a quote. You can also access a 15-day free trial of CrowdStrike Falcon Prevent.
CrowdStrike Penetration Testing Services is our top pick for an automated penetration testing tool even though it is a consultancy service and not actually a tool. Hiring in experts to perform your penetration testing gives you the experience of experts who know exactly how hackers think and can do a better job at testing your system security than you could with an automated tool. The consultants are able to tailor their tests to suit your specific requirements and cover all types of platform, including wireless and mobile systems.
Official Site: https://go.crowdstrike.com/try-falcon-prevent.html
OS: Cloud-based Service
Intruder is a vulnerability scanner, which is an automated penetration testing service. The system is delivered from the cloud and it can be set to run continuously for testing development or for operations security monitoring. The service can also be launched on demand. The system performs both internal and external checks and has a battery of more than 11,000 tests.
The vulnerability scans need to be repeated frequently because changes to components in your system or additions, represent extra potential security vulnerabilities both individually and in combination with existing systems. New hacker strategies emerge all of the time and so systems that were validated as secure can suddenly be revealed as vulnerable.
The benefit of a hosted system is that the user doesn’t have to keep updating the software. The SaaS package includes all of the services of a maintenance technician team, leaving customers of the system to just use the software.
- Both continuous and on-demand scanning
- A routine of more than 11,000 vulnerability checks
- Works for both development testing and operations security monitoring
- Continuous, scheduled, and on-demand
- More of a vulnerability scanner than a penetration testing tool
Pricing is based on the number of targets that need to be scanned and each target gets the same level of scrutiny. That means that the system is affordable and scaleable. You can experience the system with a 30-day free trial.
Metasploit is available in free and paid versions. This package creates a platform that allows you to research attacks and then launch them. Hackers widely use it. The free version is called Metasploit Framework, and the paid version is called Metasploit Pro. Although Metasploit is an open-source project, the cybersecurity company, Rapid7 supports the development of the systems, supplying funds and facilities to the team. In return, Rapid7 gets the right to produce its version that has more features plus professional support.
Both systems can detect more than 1,500 exploits to use in attacks. The Pro version is aimed at businesses, but the Framework edition lends itself to manual attacks. Although the Pro edition leans more towards being a vulnerability scanner, it does have a few valuable automated services that the users of the Framework version could do with, such as an automated brute force password cracking tool.
Metasploit offers free and paid versions with enough attack strategies to test any system’s security thoroughly. The tool lets you gather intelligence about your system and spot exploits. It then assists in tricks such as password cracking to help you break in and act like a hacker.
- A choice of free and paid versions
- The option of full professional support from Rapid7
- Tools to investigate systems and identify 1,500 exploits
- Links through from investigation tools to attack systems
- Many automated tools in the system
- Each edition has some good tools, and neither has the complete set
You can download the Metasploit Framework for free onto Windows, macOS, and Linux. Then, get a 14-day free trial of Metasploit Pro to check out the extra features. Also, check out a companion tool called Armitage. This sits in front of Metasploit Framework and helps you to gather intel and plan attacks.
Operating system: Windows, Windows Server, macOS, RHEL, and Ubuntu
Wireshark is a packet sniffer. It lets you capture traffic and examine packet headers for intel. If you catch some unencrypted payloads, you can even get lucky and steal some passwords. Wireshark is an essential part of any hacker’s toolkit, and, unlike most hacker tools, it has a very pleasing GUI interface. The installer will also leave you with a command-line version called TShark.
The capabilities of Wireshark extend to wireless networks, such as WiFi and Bluetooth. Use Wireshark to collect packets and then sort and filter them in the packet viewer. Then, scour for information that you can use in attacks.
Wireshark is available for Windows, Linux, Unix, and macOS.
- Useful for research
- Extracts traffic from LANs and wireless networks
- Captured traffic can be exported to file
- It doesn’t have any integrated attack tools
Burp Suite, from PortSwigger, is a paid tool but is also available for free in the form of a Community Edition. The paid version is called the Professional Edition. There is a lot of process automation in Burp Suite Community Edition and more in the Professional Edition. That paid tool has vulnerability scanning sections in it, which you can see in the Community Edition, but you can’t use it. The entire Home screen of the Burp Suite interface is inoperative for those who don’t pay.
The lack of those highly automated systems means that you keep away from the temptation of using a vulnerability scanner. Instead, there is a third edition, called Enterprise, which is a full-on vulnerability scanner.
The great thing about the Burp Suite system is that the interface ties together your tests’ research and attack phases. Use the Intercept service to gather information and get that automatically available in the Intruder screen to set up attacks.
- Both free and paid versions use the same GUI interface
- Research tools feed data straight into attack systems
- Has an excellent password cracker
- The paid edition could lead you into just using a vulnerability scanner
Aircrack-ng gathers intelligence on wireless networks and provides the ability to capture packets in transit. This tool lets you see different channels currently in use and all wireless access points within range.
The service shows the name of each AP and presents tools that could help you run attacks. The type of attacks that you can implement with this command-line tool includes deauth injection, man-in-the-middle attacks, and replay capacity overload attacks. It also has some password cracking abilities.
Aircrack-ng is free to use, and it installs on Linux.
- Known to be frequently used by hackers
- Useful for setting up fake WiFi hotspots
- Could get you into an entire network through its wireless segment
- No graphical user interface
The Sleuth Kit is a helpful tool for searching hard disks for deleted data. It is also able to recover files from a damaged disk. The system will also give you a complete copy of a disk for later examination so that this tool can be used for data exfiltration. Another helpful task you can perform with The Sleuth Kit is extracting deleted images from phone memory cards. This is a very effective system, and it is used by law enforcement agencies and data thieves, and spies.
The system is a command-line tool, and so you would probably want to install Autopsy, which provides a graphical front end to The Sleuth Kit. Both of these tools are free to use; law enforcement agencies and data thieves use them, and both are available for Windows, macOS, and Linux.
- Widely used by spies, data thieves, and law enforcement agencies
- Uncovers data that victims think they have got rid of
- Quickly receives a copy of an entire disk
- You need to break into the target computer before you can use these tools
Sqlmap is a command-line utility that focuses on extracting information from databases and also attacking them. Although this seems like a niche tool, there are an awful lot of systems that rely on a backend database, including just about every function on a website. Sqlmap also includes brute force username guessing and password cracking utilities.
The sqlmap service focuses on documenting and breaking into web servers to get at their databases and contents. A typical research run will try several different exploits in sequence. If you launch one of the many attack strategies built into the sqlmap system, it will conduct related research first and feed the results into the attack.
One problem with this otherwise excellent utility is that it isn’t possible to use its commands in a program and pass data from one command to another.
Sqlmap installs on Windows, macOS, and Linux.
- An extensive library of database attacks
- The ability to document and explore databases
- Username and password cracking utilities
- No graphical interface
- A programmable format with data handling constructs would be good
Zenmap is a graphical version of Nmap. When you install Zenmap, you also get Nmap to either use the graphical interface or dive to the command line. Having both options offers more flexibility. The pair will capture packets and display their headers and payload. The Zenmap display then interprets that information into an entire network discovery system.
The underlying Nmap is also called Network Mapper. This shows why you would use this tool as part of your hacking toolkit in a penetration testing exercise. The system can document an entire network, providing helpful information on the hostnames and addresses of connected devices. However, you need to break into an endpoint on the network before this tool is of use.
Zenmap and Nmap are helpful for research rather than for launching attacks. Both tools are free, and both will run on Windows, Linux, BSD Unix, and macOS.
- Quickly documents a network
- Presents helpful information on all endpoints
- Captures network packets
- This tool will only work from within a network
Ettercap is a packet capture tool that can inject traffic and masquerade as servers by faking SSL credentials. This is a command-line utility that has an extensive library of commands. Ettercap has a rudimentary interface. This is not a graphical interface, just a replacement for the Terminal window, so you would probably just end up using it at the command line.
The system works by ARP poisoning and can divert traffic from a server to the pen tester’s workstation. This allows you to then track all endpoints into disclosing important information. It is possible to use Ettercap to reap usernames and passwords in a network.
This tool needs to be inside the target network because its attack strategies all rely on manipulating traffic management systems, such as ARP and the domain name service. One option for its use would be to breach the system through an open RDP port and then transfer Ettercap onto it for remote execution.
Other attack strategies that are possible with Ettercap are DNS spoofing and Denial of Service. The tool itself would need to be supplemented by some other traffic generator if you wanted to use it to overwhelm a Web server completely. It could be possible to form a reflection attack with the Ettercap tool.
Ettercap is free to use, and it will run on Linux, Unix, Mac OS X, and Windows 7 and 8. Unfortunately, it will not work on macOS or Windows 10.
- Offers a range of attacks through ARP poisoning
- Executes system hijacking very quickly
- Facilitates man-in-the-middle attacks
- The interface is not very useful
- The system is out of date and won’t work on macOS or Windows 10
- Needs to be already inside a network