Kali Linux is the operating system most frequently used by both ethical hackers and malicious hackers for almost every aspect of cybersecurity. Kali includes almost every imaginable hacking tool, which means learning to use it is a journey, not a simple skill that can be picked up watching a 10-minute tutorial.
Based on the Debian Linux distribution, Kali includes hacking tools that can be used to carry out and defend against brute-force attacks, wireless attacks, IP spoofing attacks, reverse-engineering attacks, password cracking, dictionary attacks, phishing attacks, SQL injection and more.
Other Kali tools are more aligned with ethical hackers using penetration testing tools, network security information gathering, vulnerability assessment, security testing and security auditing. As a general platform, it also enables cybersecurity professionals to take an offensive rather than a defensive security stance by actively detecting vulnerabilities.
What tools are included in Kali Linux?
The better question to ask is: What cybersecurity tools are not included in Kali Linux? While some cybersecurity toolkits focus on a small number of best-of-category tools, Kali Linux is much more comprehensive. While some cybersecurity platforms integrate multiple different utilities, Kali Linux can be viewed as an entire cybersecurity superstore, offering numerous different suites of tools.
The Kali distribution includes hundreds of tools in a dozen different categories. Some of the bigger collections include the following:
- Information gathering. This category includes tools used for everything from identifying all the devices on a network — enumerating — to linking a network interface controller’s media access control address with an IP address to identifying open ports on targeted servers. Kali Linux information gathering tools include scanners, such as Nmap and Wireshark, as well as information planning platforms that integrate the leading tools, often with GUIs for more comprehensive functionality.
- Wireless attacks. This category includes a broad range of utilities to carry out cybersecurity exercises — or hack attacks — against wireless systems, including those connected by Bluetooth and Wi-Fi. The top Kali wireless utility is Aircrack-ng, a software suite that includes a network detector, wireless packet sniffer and credential cracking tools used to attack wireless authentication protocols, such as Wired Equivalent Privacy (WEP) and Wi-Fi Protected Access.
- Web applications. This category covers a lot of ground, and like everything in Kali, tools exist for almost any pen testing or red-teaming exercise involving web applications. While OWASP is a rich cybersecurity platform for network attacks and defenses included with Kali, OWASP Zed Attack Proxy is just one of the many utilities available for attacking web apps.
- Password attacks. This category includes standalone password cracker tools, such as Hydra, Ncrack, Hashcat and John the Ripper. It also includes utilities that help increase the effectiveness of any password cracker, such as Crunch, a program for generating wordlists; Ophcrack, a program that uses rainbow tables to crack Windows passwords; and more.
This abundance of options makes Kali Linux a challenge for beginners looking for an easy tutorial to get started, but it also makes it an indispensable resource for the experienced pen tester or hacker. Consider the information gathering category, which, by some counts, includes well over 60 individual tools.
While network protocol analyzers, such as Nmap or Wireshark, may be the best-known information gathering tools, they aren’t the only ones. Some of the lesser-known ones are …….