Skip to content

CEH Toolset (by phase)

The tools CEH expects you to recognize, grouped by where they're used. Homepages only — install most of these from Kali (sudo apt install <tool>) or their repos. Kali tool docs: https://www.kali.org/tools/

🛠️ See also: tools/tools-by-phase.md (purpose per phase and module) and the Kali reference (syntax).

Recon / footprinting (Module 02)

  • theHarvester — https://github.com/laramies/theHarvester
  • Recon-ng — https://github.com/lanmaster53/recon-ng
  • Maltego — https://www.maltego.com/
  • Shodan — https://www.shodan.io/ · Censys — https://censys.io/
  • HTTrack (site mirroring) — https://www.httrack.com/
  • dnsrecon — https://github.com/darkoperator/dnsrecon · dnsenum, dig, whois (Kali built-ins)

Scanning (Module 03)

  • Nmap — https://nmap.org/ · Nmap Scripting Engine — https://nmap.org/nsedoc/
  • Masscan — https://github.com/robertdavidgraham/masscan
  • hping3 — https://github.com/antirez/hping
  • Angry IP Scanner — https://angryip.org/

Enumeration (Module 04)

  • enum4linux-ng — https://github.com/cddmp/enum4linux-ng
  • NetExec (successor to CrackMapExec) — https://github.com/Pennyw0rth/NetExec
  • SNMP: snmpwalk (net-snmp) — http://www.net-snmp.org/ · onesixtyone — https://github.com/trailofbits/onesixtyone
  • ldapsearch (openldap), smbclient, rpcclient (Samba)

Vulnerability analysis (Module 05)

  • Nessus (Tenable) — https://www.tenable.com/products/nessus
  • OpenVAS / Greenbone — https://www.greenbone.net/
  • Nikto — https://github.com/sullo/nikto

Exploitation / system hacking (Module 06, 13–15)

  • Metasploit Framework — https://docs.metasploit.com/
  • Impacket — https://github.com/fortra/impacket
  • Mimikatz — https://github.com/gentilkiwi/mimikatz
  • Hydra — https://github.com/vanhauser-thc/thc-hydra · Medusa — https://github.com/jmk-foofus/medusa
  • Hashcat — https://hashcat.net/hashcat/ · John the Ripper — https://www.openwall.com/john/
  • sqlmap — https://sqlmap.org/

Sniffing / MITM (Module 08, 11)

  • Wireshark — https://www.wireshark.org/ · tcpdump — https://www.tcpdump.org/
  • Ettercap — https://www.ettercap-project.org/ · Bettercap — https://www.bettercap.org/
  • Responder — https://github.com/lgandx/Responder

Social engineering (Module 09)

  • Social-Engineer Toolkit (SET) — https://github.com/trustedsec/social-engineer-toolkit
  • Gophish — https://getgophish.com/

Web (Modules 13–15)

  • Burp Suite — https://portswigger.net/burp · Web Security Academy — https://portswigger.net/web-security
  • OWASP ZAP — https://www.zaproxy.org/
  • gobuster — https://github.com/OJ/gobuster · ffuf — https://github.com/ffuf/ffuf · wfuzz — https://github.com/xmendez/wfuzz
  • whatweb — https://github.com/urbanadventurer/WhatWeb

Wireless (Module 16)

  • Aircrack-ng suite — https://www.aircrack-ng.org/
  • wifite — https://github.com/derv82/wifite2 · reaver — https://github.com/t6x/reaver-wps-fork-t6x
  • Kismet — https://www.kismetwireless.net/

Mobile (Module 17)

  • MobSF — https://github.com/MobSF/Mobile-Security-Framework-MobSF
  • apktool — https://apktool.org/ · jadx — https://github.com/skylot/jadx
  • Frida — https://frida.re/ · Drozer — https://github.com/WithSecureLabs/drozer
  • adb (Android platform tools) — https://developer.android.com/tools/adb

IoT / OT (Module 18)

  • Shodan — https://www.shodan.io/ · pymodbus — https://github.com/pymodbus-dev/pymodbus

Cloud (Module 19)

  • ScoutSuite — https://github.com/nccgroup/ScoutSuite
  • Prowler — https://github.com/prowler-cloud/prowler
  • Pacu (AWS exploitation) — https://github.com/RhinoSecurityLabs/pacu
  • kube-hunter — https://github.com/aquasecurity/kube-hunter · Trivy — https://github.com/aquasecurity/trivy

Cryptography (Module 20)

  • OpenSSL — https://www.openssl.org/ · GnuPG — https://gnupg.org/
  • CyberChef (encode/decode swiss-army) — https://gchq.github.io/CyberChef/
  • hashID — https://github.com/psypanda/hashID