I would like to perform penetration testing on my project, to make it more secure. and to fix the vulnerabilities and weaknesses in the system.

Vulnerabilities allow attackers to exploit or control our system, so I want to make my project more secure.

I Googled to get a list of tools, but I want to know what tool most people are using and which ones are the most famous tools for penetration testing.

  • Its totally depend on your requirement. Like which kind of application or system you are going to test there are many tools in the market. Dec 23, 2016 at 10:19
  • This is a very broad question, could you narrow it down a little bit, please?
    – Malachi
    Dec 23, 2016 at 18:09
  • I have used ZAP. Its a free tool. But report analysis requires a bit of time to understand
    – A user
    Jan 6, 2017 at 14:09

2 Answers 2


You can install Kali Linux. It has a massive amount of tools that you can use to perform penetration testing with.

It may take a day or so to download and install. Kali Linux OS link

  • Currently I installed windows and ubuntu. is it possbile to install kali linux with this softwares
    – user21268
    Dec 23, 2016 at 14:48
  • @AntonyNaveen, if you install ubuntu, windows and Kali Linux on the same workstation at the same time, it may create some problems, I suggest you install Kali Linux on a fresh workstation by itself.
    – Yu Zhang
    Dec 23, 2016 at 19:26
  • @YuZhang In what way could it cause issues? I have ran Kali alongside Windows and other Linux based OS'es on several occasions.
    – Paul Muir
    Dec 30, 2016 at 16:55

Below are some of the penetration tools used in security testing services:

  • Wireshark This is basically a network protocol analyzer –popular for providing the minutest details about your network protocols, packet information, decryption etc. It can be used on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many other systems.

  • Burp suite is also essentially a scanner (with a limited “intruder” tool for attacks), although many security testing specialists swear that pen-testing without this tool is unimaginable.

  • Zed Attack Proxy ZAP is a completely free to use, scanner and security vulnerability finder for web applications. ZAP includes Proxy intercepting aspects, variety of scanners, spiders etc.

  • Acunetix is essentially a web vulnerability scanner targeted at web applications. It provides SQL injection, cross site scripting testing, PCI compliance reports etc. along with identifying a multitude of vulnerabilities.