Penetration Testing Tools: 18 Tools by Test Phase, Licence and October 2026 Price

By The Uptime Report Team · Last reviewed: October 2026

The eighteen penetration testing tools compared here, as of October 2026, run from Nmap to Nessus: sixteen are free, and listed paid tiers run from $499 per Burp Suite Professional user to $6,790 a year for Nessus Expert.

Which penetration testing tools cover each phase of a test?

Eighteen penetration testing tools cover the four NIST SP 800-115 phases: Nmap for discovery; Wireshark for capture; Nessus, Greenbone OpenVAS and Nuclei for vulnerability scanning; Burp Suite, ZAP and sqlmap for web apps; Metasploit, Responder, Impacket, NetExec and BloodHound for exploitation and Active Directory; Hashcat, John the Ripper and Hydra for passwords; Aircrack-ng for Wi-Fi; and Kali Linux as the bundle. The table gives each one’s licence, latest version and price from its own page.

Sixteen of the eighteen are free to use with no paid tier needed, counting Metasploit Framework and BloodHound CE as products separate from Metasploit Pro and BloodHound Enterprise. The two that gate real work behind payment are Nessus, whose free Essentials tier is 5 IPs and non-commercial per Tenable’s Essentials page, and Burp Suite, where PortSwigger calls the free Community Edition an “essential manual toolkit” and sells automated scanning in Professional.

Kali Linux is the shortcut for most of them. Its kali-tools-top10 metapackage pulls in aircrack-ng, burpsuite, hydra, john, metasploit-framework, netexec, nmap, responder, sqlmap and wireshark; hashcat ships in kali-linux-headless. ZAP sits in kali-linux-large, BloodHound in kali-linux-everything, and Nessus, Greenbone OpenVAS and Nuclei are not in the default install: Greenbone (the gvm package, in kali-tools-vulnerability) and Nuclei (in kali-linux-everything) install from Kali’s repository, while Nessus comes from Tenable.

How do pen testing tools map to NIST SP 800-115?

NIST SP 800-115, the Technical Guide to Information Security Testing and Assessment published in September 2008, splits a penetration test into four phases in section 5.2.1: Planning, Discovery, Attack and Reporting. It files techniques under numbered sections: network discovery 4.1, port and service identification 4.2, vulnerability scanning 4.3, wireless scanning 4.4, password cracking 5.1 and penetration testing 5.2.

The guide is old enough to name tools of its own. Its Appendix A, Table A-1, samples the BackTrack live distribution and lists Nmap, Wireshark, Metasploit, John the Ripper and Hydra; Table A-2 for Knoppix STD adds Nessus. That makes six of today’s eighteen tools already present in a 2008 federal guide. Its sample application testing tools were Paros Proxy, Peach and three fuzzers, according to the SP 800-115 PDF.

Two placements need explaining. SP 800-115 files network sniffing under Review Techniques (section 3.5), yet its discovery phase lists “network sniffing (generally only during internal tests)” as a way to gather host names and IP addresses, so Wireshark sits in Discovery. BloodHound, Responder, Impacket and NetExec sit in Attack because section 5.2.1 describes exploits that “enable testers to escalate their privileges on the system or network to gain access to additional resources”, which is the internal Active Directory work those four do.

NIST also says its own model is one option: footnote 18 reads “There are many acceptable ways of grouping the actions involved in performing penetration testing.” Five-phase models in tool guides are not wrong; they regroup the same work. The scoping and pricing of that work sits in our guide to vulnerability assessment and penetration testing, and the most common internal-network job in our network penetration testing guide.

What do the paid editions cost in October 2026?

As of October 2026, three paid editions publish a list price: Burp Suite Professional at $499 per user on PortSwigger’s product page, Nessus Professional at $4,790 for one year and Nessus Expert at $6,790 for one year on Tenable’s buy page. Metasploit Pro, BloodHound Enterprise and Greenbone’s Enterprise appliances publish no price and route buyers to sales.

For an MSP quoting a client, the scanner is the only forced line item: Nessus Professional at $4,790 a year is what Tenable’s licence requires for commercial scanning, and a longer term trims only a little. A three-year Nessus Professional licence lists at $13,637.54, which is $732.46 (5.1%) below three one-year renewals, and Expert costs $2,000 a year more than Professional at the one-year price. Everything else in a standard kit is free.

The $5,788 kit covers licences only and excludes the people who run the tools, the subject of our guide to the penetration tester role.

Which free tiers and licences allow paid client work?

Most free tools are free for client work too: the GNU GPL says “the act of running the Program is not restricted”, and the MIT, Apache 2.0 and BSD licences place no field-of-use limit, so ZAP, Nuclei, Greenbone OpenVAS, Nmap, Metasploit Framework, sqlmap, Hydra and the rest can be used on a paying client’s systems at $0. The one clear exception is Nessus Essentials, which Tenable restricts to non-commercial use.

The Nessus terms are the most explicit about client work: Tenable’s FAQ says “Commercial deployments and consulting services require a paid Nessus Professional license.” A small MSP that wants free scanning for a paying client has two sourced options instead of buying Nessus: Greenbone OpenVAS Community Edition (GPL v2 and AGPL v3 components) or Nuclei (MIT), both of which permit commercial use at no licence cost. AGPL v3 adds one duty the GPL does not: under section 13, a modified version offered to users over a network must make its source available to them, so an MSP that patches gvmd or the web UI and exposes it to clients owes them the code; running it unmodified carries no such duty.

Also allowed on client work at $0: Wireshark (GPL v2) and BloodHound CE (Apache 2.0). Burp Suite Community Edition is licensed “solely for Your internal business purposes” under PortSwigger’s Community EULA, which mentions client consultancy only where “permitted under an Order”, so read the EULA before using it on client engagements. Nessus Essentials Plus is non-commercial; Nessus Professional and Expert are licensed for commercial use. Buying testing as a managed service moves these licence questions onto the provider, the model in our guide to penetration testing as a service.

What do several tool guides get wrong?

Two errors show up in several top-ranking tool lists read in October 2026. ZAP is still called “OWASP ZAP”, although the ZAP team took it out of OWASP in September 2023 and it has been “ZAP by Checkmarx” since 24 September 2024. And paid prices are copied from older snapshots: an April 2026 roundup prints Burp Suite Professional at $449 and Nessus Professional at $3,859.25, against $499 and $4,790 on the vendor pages now.

The ZAP team is blunt about the naming: its ownership page says “If you see a reference to ‘OWASP ZAP’ then you know that the source is out of date.” On prices, the gaps are $50 for Burp Suite Professional (11.1%), $930.75 for Nessus Professional (24.1%) and $1,103.25 for Nessus Expert (19.4%). The roundup figures may have been right on their date, and prices differ by region and currency. The practical rule for a quote: date every price and recheck the vendor page before it goes to a client.

How current is each penetration testing tool?

Sixteen of the eighteen penetration testing tools shipped a release in the 12 months to 26 October 2026, and nine shipped in October 2026 itself. Only two have gone longer than a year: John the Ripper, whose last numbered release, 1.9.0-jumbo-1, dates from 14 May 2019 (2,722 days), and Aircrack-ng 1.7 from 10 May 2022 (1,630 days). Hashcat, stale a year ago, shipped 8.0.0 on 25 October 2026, per each project’s own release record.

The chart axis is marked at 0, 500, 1,000, 1,500, 2,000, 2,500 and 3,000 days. Days since the latest release, newest first: John the Ripper 1.9.0-jumbo-1 2722, Aircrack-ng 1.7 1630, ZAP 2.17.0 315, Responder 3.2.2.0 273, NetExec 1.5.1 245, Hydra 9.7 176, Impacket 0.13.1 160, Nuclei 3.11.1 79, Wireshark 4.6.9 33, sqlmap 1.10.10 21, BloodHound CE 9.8.0 19, Nmap 7.992 11, Greenbone OpenVAS 23.52.3 5, Nessus 10.12.6 4, Metasploit Framework 6.5.8 4, Hashcat 8.0.0 1, Burp Suite 2026.9.3 0, Kali Linux 2026.3 0. An old release number does not always mean an idle project. Openwall’s John the Ripper page labels the 1.9.0-jumbo-1 tarball “out of date, with known issues” and recommends the GitHub development source instead, so install John from the repository. Aircrack-ng’s own news item for 1.7 says it came “after more than 2 years” without a release.

Recency matters most for scanners and exploit frameworks, because their value is the checks they carry. Tenable’s Nessus Essentials receives plugin updates on a 30-day delay, while Professional receives them in real time. Flaws on the CISA Known Exploited Vulnerabilities catalog have confirmed exploitation in the wild, which makes them a sensible place to start confirming with Metasploit; our analysis of the CISA KEV catalog shows which ones those are.

Which tools can you safely run on a production network?

Four of these tools can disrupt a live service, and each ships a setting that limits the damage. Nessus 10.12.6 has “Enable Safe Checks” on by default in its scan templates; Nmap 7.992 separates “safe” scripts from “intrusive” and “dos” ones; sqlmap defaults to risk 1 of 3; and Responder has an Analyze mode that listens without poisoning. Name each tool and its safe setting in the client’s rules of engagement.

Authorisation still comes first. In the US, owning the tools is not an offence; pointing them at systems without permission may be, under the Computer Fraud and Abuse Act, 18 U.S.C. 1030(a)(2), and subsection (g) gives a person who suffers damage or loss a civil action where the conduct meets one of the subsection (c)(4)(A)(i) factors, such as at least $5,000 of loss in a year. Put written management approval, an exclude list and the authorised tool list in the rules of engagement from the NIST SP 800-115 Appendix B template; our penetration tester guide sets out the full authorisation workflow.

Which penetration testing tool fits each task and budget?

Pick by target first, then by whether the work is commercial. For network hosts on client work, use Nessus Professional at $4,790 a year, or Greenbone OpenVAS and Nuclei at $0 if the licence budget is the constraint. For web apps, use ZAP, sqlmap or Nuclei at $0, or Burp Suite Professional at $499 per user. Internal Active Directory, exploitation, passwords and Wi-Fi all have free tools in the table.

If nobody on staff has run these 18 tools against a production network, buy the test rather than learn on a client’s systems. Web applications get their own method and scoping in our guide to web application penetration testing, and broader options sit in our overview of managed cybersecurity.

How we compiled this

We did not run or benchmark any tool. We compiled licence, version, release-date and price data from 51 primary documents: vendor and project download, pricing, licence and release pages, Git tags, NIST SP 800-115, 18 U.S.C. 1030 and the DOJ Justice Manual, accessed between 19 and 26 October 2026. We read top-ranking tool guides only to find gaps and quote one April 2026 roundup solely for its prices.

Frequently asked questions

Is Nmap a penetration testing tool?

Yes. Nmap handles network discovery and port and service identification, the techniques NIST SP 800-115 files under sections 4.1 and 4.2 and uses in the discovery phase. The latest stable release is 7.992, dated 15 October 2026 in the Nmap changelog, and it is free under the Nmap Public Source License, which does bar embedding it in a proprietary product.

What are the 5 phases of penetration testing?

NIST SP 800-115 section 5.2.1 uses four phases, not five: Planning, Discovery, Attack and Reporting, with a loop from Attack back to Discovery. Its footnote 18 says “there are many acceptable ways of grouping” the work, so five-phase models in tool guides regroup the same steps. Source: NIST SP 800-115, September 2008.

What is the difference between pentest tools and vulnerability scanners?

A scanner such as Nessus or Greenbone OpenVAS reports that a flaw may exist; a pentest tool such as Metasploit tries to exploit it. NIST SP 800-115 section 5.2.1 says “vulnerability scanners check only for the possible existence of a vulnerability, the attack phase of a penetration test exploits the vulnerability to confirm its existence.” Source: NIST SP 800-115.

Can I use free penetration testing tools on paid client work?

Usually yes. The GNU GPL says “the act of running the Program is not restricted”, and the MIT, Apache 2.0 and BSD licences set no field-of-use limit, so ZAP, Nuclei, Greenbone OpenVAS, Nmap and Metasploit Framework are fine on a paying client’s systems. The exception is Nessus Essentials, which Tenable limits to non-commercial use.

What replaced CrackMapExec?

NetExec. The NetExec project explains that CrackMapExec, created in 2015, lost its maintainer in September 2023, and the remaining contributors continued it “as a fully free and open source project under the new name NetExec.” The latest release is 1.5.1, from 23 February 2026, under the BSD 2-clause licence.

Do I need Kali Linux to use these penetration testing tools?

No. Each project ships its own installers; Nmap, for example, offers Windows, Linux RPM and macOS packages. Kali Linux 2026.3, released 26 October 2026, saves setup time because its kali-tools-top10 metapackage includes nmap, metasploit-framework, netexec, responder and more, though Nessus, Greenbone OpenVAS and Nuclei are not Kali defaults.

Is it legal to use penetration testing tools?

In the US, installing them is legal. Using them on systems you are not authorised to test can fall under the Computer Fraud and Abuse Act, 18 U.S.C. 1030(a)(2), which also allows civil suits under subsection (g) where the conduct meets a subsection (c)(4)(A)(i) factor. Get written management approval and rules of engagement before the first scan.

Sources

1. NIST, SP 800-115 Technical Guide to Information Security Testing and Assessment (publication page). Accessed October 2026.
2. NIST, SP 800-115 full text PDF (sections 3 to 8, Appendices A to C). Accessed October 2026.
3. Cornell LII, 18 U.S. Code 1030 Fraud and related activity in connection with computers. Accessed October 2026.
4. U.S. Department of Justice, Justice Manual 9-48.000 Computer Fraud and Abuse Act. Accessed October 2026.
5. GNU General Public License version 2 (running the Program is not restricted). Accessed October 2026.
6. Nmap Project, Download page. Accessed October 2026.
7. Nmap Project, Changelog. Accessed October 2026.
8. Nmap Project, Nmap Public Source License. Accessed October 2026.
9. Nmap Project, NSE script usage and categories. Accessed October 2026.
10. Wireshark Foundation, Download page. Accessed October 2026.
11. Wireshark Foundation, FAQ. Accessed October 2026.
12. Wireshark, GitLab tag v4.6.9. Accessed October 2026.
13. Tenable, Buy Tenable Nessus (pricing). Accessed October 2026.
14. Tenable, Nessus Essentials (limits and FAQ). Accessed October 2026.
15. Tenable, Nessus 2026 release notes. Accessed October 2026.
16. Tenable, Nessus Advanced Scan Settings (Enable Safe Checks). Accessed October 2026.
17. PortSwigger, Burp Suite Professional. Accessed October 2026.
18. PortSwigger, Burp Suite Professional order form. Accessed October 2026.
19. PortSwigger, Burp Suite releases (2026.9.3 Stable, 2026.10 Early Adopter). Accessed October 2026.
20. PortSwigger, Burp Suite Community Edition download. Accessed October 2026.
21. ZAP Dev Team, Download ZAP. Accessed October 2026.
22. ZAP Dev Team, ZAP Ownership. Accessed October 2026.
23. ZAP Dev Team, ZAP Has Joined Forces With Checkmarx (24 September 2024). Accessed October 2026.
24. ZAP, GitHub release v2.17.0. Accessed October 2026.
25. sqlmap project, sqlmap.org. Accessed October 2026.
26. sqlmap, GitHub tag 1.10.10. Accessed October 2026.
27. sqlmap, Usage wiki (level and risk). Accessed October 2026.
28. Rapid7, Metasploit Framework LICENSE file. Accessed October 2026.
29. Rapid7, Metasploit Framework GitHub tag 6.5.8. Accessed October 2026.
30. Rapid7, Metasploit product page. Accessed October 2026.
31. hashcat project, hashcat advanced password recovery (v8.0.0). Accessed October 2026.
32. Openwall, John the Ripper password cracker. Accessed October 2026.
33. Openwall, John the Ripper 1.9.0-jumbo-1 announcement (14 May 2019). Accessed October 2026.
34. THC, Hydra GitHub release v9.7. Accessed October 2026.
35. Aircrack-ng project, home page and news. Accessed October 2026.
36. Aircrack-ng, GitHub repository (GPL-2.0 licence). Accessed October 2026.
37. SpecterOps, BloodHound Community Edition GitHub release v9.8.0. Accessed October 2026.
38. SpecterOps, BloodHound Enterprise. Accessed October 2026.
39. Responder, GitHub release v3.2.2.0. Accessed October 2026.
40. Impacket (Fortra), GitHub release impacket_0_13_1. Accessed October 2026.
41. NetExec, GitHub release v1.5.1 and README (CrackMapExec successor). Accessed October 2026.
42. Nuclei (ProjectDiscovery), GitHub release v3.11.1. Accessed October 2026.
43. Nuclei, LICENSE.md (MIT). Accessed October 2026.
44. Greenbone, openvas-scanner GitHub release v23.52.3. Accessed October 2026.
45. Greenbone, gvmd COPYING (GNU AGPL version 3). Accessed October 2026.
46. GNU Affero General Public License version 3 (section 13). Accessed October 2026.
47. PortSwigger, Burp Suite Community Edition EULA. Accessed October 2026.
48. Greenbone Community Edition documentation (open-source licences, Community Feed). Accessed October 2026.
49. Kali Linux, Releases. Accessed October 2026.
50. Kali Linux, kali-meta metapackages (kali-tools-top10, headless, large, everything). Accessed October 2026.
51. CISA, Known Exploited Vulnerabilities Catalog. Accessed October 2026.
52. eSecurityPlanet, 7 Best Penetration Testing Tools and Software in 2026 (27 April 2026; secondary, cited only for comparison). Accessed October 2026.
53. eSecurityPlanet, 23 Top Open Source Penetration Testing Tools in 2026 (secondary, cited as example of the OWASP ZAP naming). Accessed October 2026.
54. Codecademy, What are Penetration Testing Tools? (secondary, cited as example of the OWASP ZAP naming). Accessed October 2026.