Gordon Lyon released Nmap in September 1997, and nearly three decades later it is still the first command most penetration testers type against a new target. That longevity is the theme of this guide: the open-source pentest toolchain has barely consolidated. Metasploit, created by H.D. Moore in 2003 and acquired by Rapid7 on October 21, 2009, still handles exploitation. Burp Suite and OWASP ZAP still split the web-app testing market between a commercial-first tool and a free one — except ZAP is no longer strictly an OWASP project. On September 24, 2024, ZAP's core developers joined Checkmarx as employees and the project was rebranded "ZAP by Checkmarx," staying Apache 2.0-licensed with the ZAP Core Team retaining control, after the project had already left OWASP governance in 2023 for the Linux Foundation's Software Security Project. Meanwhile sqlmap (2006), Nikto, Wireshark, Hydra, and John the Ripper each still own a narrow, specific job nobody has managed to fully automate away. None of these tools compete head-to-head; they sit at different stages of an engagement. This post maps out which tool to reach for at each stage, what each one actually verifies, and where the boundaries between them lie.
When should you reach for Nmap versus jumping straight to exploitation?
Nmap belongs at the start of every engagement, before you touch an exploitation tool, because you cannot responsibly attack what you haven't enumerated. It performs host discovery, port scanning, service/version detection, and OS fingerprinting, and its scripting engine (NSE) extends that into light vulnerability checks and even some safe exploitation scripts. A typical scan tells you which of 65,535 ports are open, what's listening on them, and often the exact software version — the raw material every later stage depends on. Jumping straight to Metasploit without this step means guessing at targets, which wastes exploit attempts and generates noisy, easily detected traffic. Nmap is GPLv2-licensed and free, runs on Linux, Windows, and macOS, and its output format (particularly -oX for XML) is designed to feed directly into other tools, including Metasploit's own db_import. The rule of thumb: Nmap answers "what's out there and what's it running," and every other tool on this list answers a narrower question once you already know that.
What's the actual difference between Metasploit and a vulnerability scanner?
A vulnerability scanner tells you a weakness might exist; Metasploit proves it does by actually exploiting it. Metasploit Framework packages thousands of exploit modules, payloads, and post-exploitation tools into a single console, letting a tester select a known vulnerability, configure a payload, and launch it against a target to confirm real impact — not just a version-matched guess. This distinction matters for reporting: a finding a client can dismiss as "theoretical" carries far more weight once you've produced an actual shell or exfiltrated a sample file through it. Rapid7's acquisition of the project in 2009 didn't close the source; the core framework remains open, while Rapid7 sells Metasploit Pro on top for teams that want a GUI, reporting, and support. The tradeoff is that exploitation is inherently riskier than scanning — a misfired exploit can crash a production service — so Metasploit use is typically scoped tightly to an authorized engagement window, unlike a scanner that can safely run continuously.
Burp Suite or OWASP ZAP for web application testing?
The honest answer is both, for different reasons: Burp Suite Professional (PortSwigger) is the industry standard for manual, hands-on web app testing, while ZAP is the better fit for free, automated, CI-integrated scanning. Both are intercepting proxies that let you inspect and modify HTTP requests in transit, but Burp's Professional tier adds an actively maintained active scanner, a much larger extension ecosystem (BApp Store), and tooling built around a human tester driving requests one at a time. ZAP, now developed under Checkmarx after its September 2024 rebrand while keeping its Apache 2.0 license and independent Core Team governance, is built to be scripted and automated — its baseline and full-scan Docker images are a common sight in GitHub Actions and GitLab CI pipelines because they need no license key. Community-tier Burp lacks the active scanner entirely, which is the real reason many teams run ZAP for automated coverage and reach for Burp Pro only when a human needs to manually probe a specific finding.
Why do dedicated tools like sqlmap and Nikto still beat general scanners?
Dedicated single-purpose tools still win because depth beats breadth once you've narrowed to a specific vulnerability class. sqlmap, first released in 2006, automates SQL injection detection and exploitation specifically — it can fingerprint the backend database, enumerate schemas, dump data, and in some configurations read or write files on the underlying server, all through a single injection point that a general scanner might only flag as "possible SQLi" and move on from. Nikto takes the opposite approach at similar depth: it's a fast, GPL-licensed web server scanner focused purely on outdated software versions, dangerous default files, and known misconfigurations across thousands of signatures, built to run in seconds rather than the minutes or hours a full DAST scan takes. Neither replaces a general web scanner like ZAP or Burp; they're what you run after initial recon flags a database-backed form or a server that looks stale, because a purpose-built tool encodes far more database- or server-specific logic than a generalist scanner can justify carrying.
Where do Wireshark, Hydra, and John the Ripper fit in an engagement?
These three cover the parts of an engagement that happen off the main scan-and-exploit path: traffic analysis and credential attacks. Wireshark, the packet analyzer descended from Ethereal (renamed in 2006 after a trademark dispute), lets a tester capture and dissect network traffic byte-by-byte — essential for verifying whether an exploit payload actually transmitted, whether traffic is unexpectedly unencrypted, or diagnosing why a tool's request isn't reaching a target. Hydra (THC-Hydra) and John the Ripper attack authentication from opposite ends: Hydra brute-forces live login services — SSH, RDP, web forms — over the network, while John the Ripper cracks password hashes you've already obtained, whether from a dumped database or an exported credential store. Both have been maintained for decades and remain default installs on Kali Linux, the Offensive Security Debian distribution that succeeded BackTrack in 2013 and bundles nearly every tool in this guide. Credential weakness is still one of the most common findings in real engagements, which is why these tools haven't been displaced despite their age.
How does this toolchain fit with continuous security work between engagements?
Penetration testing tools are built for point-in-time, human-driven engagements — a tester runs Nmap, ZAP, and Metasploit over a defined window, then hands over a report. That model doesn't cover what happens to your dependency tree the other 360 days a year, when a new CVE lands in a package none of these tools were pointed at because it wasn't in scope for the last test. Safeguard is built for that gap rather than as a pentest replacement: it continuously rescans your SBOM against CVE, GHSA, OSV, and CISA KEV feeds as new advisories publish, so a vulnerable transitive dependency doesn't sit unnoticed until the next scheduled assessment. The two approaches are complementary — pentest tools validate exploitability of what a human decides to test, while continuous dependency and secrets scanning catches what changed in your supply chain since the last time anyone looked.