Kali Linux Tools Explained: A Beginner’s Map of the Essential Toolkit

Kali Linux is not a single hacking program. It is a Linux distribution that packages a large, changing collection of security and forensics tools. The productive way to learn it is not to memorize hundreds of command names. Learn the assessment questions first, then learn one dependable tool for each question.

Kali’s official metapackages group tools into areas including information gathering, vulnerability analysis, web applications, databases, passwords, wireless, reverse engineering, exploitation, sniffing and spoofing, post-exploitation, forensics, and reporting.^[1]

This guide maps the toolkit into a practical learning order.

Start with a workflow, not a menu

A tool is useful only when its output changes your next decision. A typical authorized workflow looks like this:

Define scope
  → discover assets
  → enumerate exposed services
  → map application behavior
  → test a specific hypothesis
  → validate impact safely
  → preserve evidence
  → report and retest

Running every tool against every target creates noise, stability risk, and a mountain of output no one will interpret.

1. Information gathering and OSINT

These tools identify domains, records, hosts, technologies, and public exposure.

Learn first

• dig queries DNS records precisely.
• whois inspects registration and allocation data where available.
• theHarvester collects public names, hosts, and related data from supported sources.
• Amass supports broader attack-surface and subdomain discovery.
• WhatWeb identifies web technologies from observable responses.

Example DNS triage for a laboratory domain:

dig A lab.example.test
dig MX lab.example.test
dig TXT lab.example.test

Treat public data as a lead. Validate ownership before interacting with an address: cloud infrastructure and CDNs frequently serve unrelated tenants.

2. Network scanning and service enumeration

These tools answer which hosts respond, which ports are reachable, and what may be listening.

Learn first

• Nmap is the central network discovery and service-enumeration tool.
• arp-scan discovers local-layer hosts on an authorized LAN.
• Netcat/Ncat creates simple TCP or UDP connections and listeners.
• curl inspects HTTP behavior without a browser.
• smbclient, rpcclient, and ldapsearch query common enterprise services.

# Authorized lab host only
nmap --top-ports 1000 192.0.2.10 -oA tcp-common
nmap -sV -p 22,80,443 192.0.2.10 -oA service-check
curl -i https://lab.example.test/

Nmap’s own documentation stresses that its six port states describe what Nmap can observe from a particular vantage point; they are not permanent properties of a port.^[2]

3. Web application security

Web testing requires understanding requests, sessions, roles, objects, and state transitions.

Learn first

• Burp Suite intercepts, modifies, replays, and organizes HTTP traffic.
• OWASP ZAP provides an open-source intercepting proxy and scanner.
• ffuf, Gobuster, and Feroxbuster discover content using wordlists.
• Nikto checks for recognizable server issues and exposed files.
• sqlmap automates validation of suspected SQL injection.
• Nuclei runs template-based checks at scale.

The safest learning sequence is browser developer tools, then curl, then an intercepting proxy. Automation makes more sense once you can explain the underlying request.

# Send one explicit request and inspect headers
curl -i 'https://lab.example.test/api/profile'

# Content discovery with a conservative lab rate
ffuf -u 'https://lab.example.test/FUZZ' \
  -w /usr/share/seclists/Discovery/Web-Content/common.txt \
  -rate 10

Do not interpret every unusual status code as a vulnerability. Confirm the content, authentication state, and business meaning.

4. Vulnerability assessment

Assessment tools compare observed systems with known weaknesses or insecure configurations.

• Greenbone/OpenVAS performs broad vulnerability scanning.
• Nuclei applies targeted templates.
• Lynis audits Unix-like host configuration.
• Trivy scans containers, filesystems, repositories, and configuration.
• SearchSploit searches the local Exploit-DB archive.

Their output is a queue for investigation, not a finished report. Version detection can be wrong, distributors backport fixes, and a CVE may require a configuration the target does not use.

5. Password and credential testing

Learn first

• Hashcat performs high-performance offline password-hash recovery.
• John the Ripper supports many hash and encrypted-file formats.
• Hydra, Medusa, and Ncrack test supported online authentication services.
• CeWL derives candidate words from authorized web content.

Offline auditing is generally easier to control than online guessing. Online tools can lock accounts, flood logs, or disrupt authentication services. Define allowed accounts, rates, hours, and stopping conditions before use.

The objective is to measure policy and resistance—not to expose as many plaintext passwords as possible.

6. Active Directory and Windows

Windows domain assessments connect identity, delegation, host administration, and credentials.

• BloodHound represents identity relationships and potential attack paths.
• NetExec supports controlled enumeration and validation across common protocols.
• Impacket provides Python implementations of network protocols and focused utilities.
• GetUserSPNs.py and GetNPUsers.py support authorized Kerberos assessments.
• Responder and ntlmrelayx.py help evaluate name-resolution poisoning and NTLM relay exposure in tightly controlled scopes.

These tools can change the risk of an environment quickly. Begin with passive collection and read-only queries. Treat every credential and ticket as sensitive evidence.

7. Traffic inspection and spoofing

• Wireshark provides deep interactive packet analysis.
• TShark provides command-line packet analysis.
• tcpdump captures and filters traffic efficiently.
• Bettercap and Ettercap support active network manipulation.

Start by learning filters, protocol structure, and normal traffic. Active man-in-the-middle functions can disrupt a network and should never be an exploratory default.

# Capture only traffic to an authorized lab host
sudo tcpdump -i eth0 host 192.0.2.10 -w lab-host.pcap

# Read DNS queries from an existing capture
tshark -r lab-host.pcap -Y 'dns.flags.response == 0'

Packet captures can contain credentials, tokens, and personal data. Store them like sensitive evidence.

8. Exploitation and post-exploitation

• Metasploit Framework organizes exploit, payload, auxiliary, and post modules.
• msfvenom generates payload formats for approved tests.
• Chisel, Ligolo-ng, sshuttle, and ProxyChains support tunneling and controlled pivoting.
• PEASS-ng helps enumerate potential privilege-escalation paths.

Metasploit is valuable, but it should not be the first thing a beginner learns. Understand the service, weakness, prerequisites, and payload effect first. Kali documents that Metasploit’s database services do not run on boot by default and provides msfdb as the supported setup path.^[3]

A sensible first 12 tools

If you are starting, learn these deeply:

1. dig
2. curl
3. Nmap
4. Wireshark
5. tcpdump
6. Burp Suite or OWASP ZAP
7. ffuf or Gobuster
8. smbclient
9. ldapsearch
10. Hashcat or John
11. Git
12. a text editor and a consistent evidence system

Git and note-taking are not glamorous, but reproducibility is part of testing.

How to evaluate an unfamiliar tool

Before running it, answer:

• Is the upstream project active and authentic?
• What data will it send, store, or upload?
• Is it passive, read-only, state-changing, or disruptive?
• What credentials or privileges does it require?
• Can I test it in an isolated lab first?
• How do I limit targets, rate, and concurrency?
• What output format preserves evidence?

Kali’s official tools index tracks current packages and links to upstream sources, making it a safer starting point than copying commands from an undated blog.^[4]

The lesson that scales

Tool fluency means being able to predict what a command will do, recognize when output is ambiguous, and explain why the result matters. Ten tools understood deeply beat two hundred tools used as incantations.

The free CyberVault sample includes linked manuals for Nmap, curl, dig, Burp Suite, ffuf, Gobuster, sqlmap, Hashcat, John, BloodHound, NetExec, and Wireshark—alongside the concepts needed to interpret them.

Sources