PENETRATION TESTING TOOLS
Penetration testing tools, sorted by what they actually find
No single pentest tool covers everything. Recon tools map the attack surface, proxies and scanners test the running app, exploitation frameworks prove impact and code-level tools read the source. This guide sorts well-known open source and commercial penetration testing tools by category and shows where Nurbak fits: an AI white-box pentester for your source code.
Create account and connect GitHubWe never store your code. We only write when you ask for a fix PR.
Organized by category
Recon, web proxies, scanners, exploitation, SAST, secrets and dependencies, with what each category is good at and where it stops.
Mostly free or open source
Almost every tool in this guide has a free or open source edition, so you can build a solid toolkit without a big budget.
Black box and white box
Tools that test the running system from outside and tools that read the code see different bugs. A good pentest uses both views.
Where Nurbak fits
Nurbak is the white-box piece: an AI pentester that reads your GitHub repo and opens fixes as PRs. It does not scan networks or attack live systems.
The main categories of pentest tools
Reconnaissance
Map the attack surface before testing it. OWASP Amass maps external assets and subdomains using open source intelligence and active techniques, and ProjectDiscovery's subfinder does passive subdomain discovery from public sources.
Web proxies
Sit between your browser and the app to intercept, inspect and modify traffic. Burp Suite from PortSwigger has a free Community edition and a paid Professional edition. ZAP is a free, open source alternative, sponsored by Checkmarx.
Network and vulnerability scanners
Nmap is a free, open source tool for host discovery, port scanning and service and OS detection, with its own scripting engine. Nuclei, from ProjectDiscovery, runs YAML templates to detect known issues over HTTP, DNS, TCP and other protocols.
Exploitation
Prove that a vulnerability has real impact. The Metasploit Framework is open source and maintained by Rapid7 together with the community, and Rapid7 also sells Metasploit Pro. sqlmap automates detecting and exploiting SQL injection.
SAST and white-box analysis
Read the source code instead of the running app. Semgrep Community Edition uses rules that look like code, and GitHub's CodeQL lets you query code as data and is free for open source. See secure code review.
Secrets and dependencies
Gitleaks and TruffleHog find leaked credentials in git repos, and TruffleHog can check whether a secret is still live. Google's OSV-Scanner and Aqua Security's Trivy check dependencies for known vulnerabilities. See our vulnerability scanner.
Penetration testing tools compared
A quick map of which tool does what. Most real engagements combine several rows of this table.
| Category | Example tools | What it finds |
|---|---|---|
| Reconnaissance | OWASP Amass, subfinder | Subdomains, external assets and forgotten entry points |
| Web proxy | Burp Suite, ZAP | Flaws in access control, sessions and input handling, tested by hand against the running app |
| Network scanner | Nmap | Live hosts, open ports, services and versions, operating systems |
| Template scanner | Nuclei | Known CVEs, exposed panels and common misconfigurations on live targets |
| Exploitation | Metasploit, sqlmap | Proof that a vulnerability can be exploited, and how far an attacker gets |
| SAST and white-box | Semgrep, CodeQL, Nurbak | Injection, IDOR, broken auth and SSRF in the source code, with file and line |
| Secrets | Gitleaks, TruffleHog | API keys, tokens and passwords in code and git history |
| Dependencies (SCA) | OSV-Scanner, Trivy | Known CVEs in third-party packages |
How Nurbak fits into your pentest toolkit
Create an account and connect GitHub. Public and private repos both work.
Nurbak's own self-hosted model reads the code on ephemeral infrastructure, like a pentester with full source access.
Get a 0 to 100 security score and findings with file, line, CWE and a plain-language explanation.
Open a pull request with the fix and a security regression test in one click.
Keep Burp, ZAP or a manual pentest for the running app. Nurbak covers what is only visible in the code.
Penetration testing tools FAQ
What are penetration testing tools?
They are the tools security testers use to find and prove vulnerabilities: recon tools to map the attack surface, proxies and scanners to test the running application, exploitation frameworks to show impact, and static analysis, secret and dependency scanners to review the code. Our guide to what penetration testing is explains how they fit in a real engagement.
What are the best penetration testing tools?
There is no single best tool, it depends on the target. A common starting kit is Nmap for the network, Burp Suite or ZAP for web apps, Nuclei for known issues, Metasploit or sqlmap to prove exploitation, and a SAST plus secret and dependency scanners for the code. The table above maps each category to what it finds.
Which open source penetration testing tools are worth knowing?
Nmap, ZAP, Nuclei, the Metasploit Framework, sqlmap, OWASP Amass, subfinder, Semgrep Community Edition, Gitleaks, TruffleHog, OSV-Scanner and Trivy all have open source versions. Several of them also have commercial editions with extra features and support.
What are automated penetration testing tools?
Tools that run tests without a human driving every step. Scanners like Nuclei or ZAP's automated scan test a running app, while Nurbak automates the white-box side by reading the source and reasoning about how data flows. Automation gives you breadth and repetition, a human still adds creativity on business logic. More in automated penetration testing.
Does Nurbak replace Burp Suite, Nmap or Metasploit?
No. Nurbak does not scan networks, crawl your live site or exploit running systems. It is a white-box AI pentester for your source code: it finds exploitable vulnerabilities such as SQL injection, IDOR, SSRF, XSS or JWT flaws with file, line and CWE, and opens the fix as a pull request. It complements black-box tools and manual testing. See also penetration testing as a service and application security testing.
Is my code sent to a third-party AI?
The analysis runs on Nurbak's own self-hosted model, so your code is not sent to OpenAI or Anthropic to be analyzed. The infrastructure is ephemeral and every scan has a hash-chained audit trail you can download. Only if you ask for a fix pull request and give explicit consent is the fix generated with Claude. The vulnerability classes we look for are explained in our OWASP Top 10 2025 guide.
How much does it cost?
The first scan is free and shows the 3 most important findings in full, plus 1 free fix PR. Plans are USD 79 per month for 1 repo and USD 199 per month for up to 5 repos, with daily scans. Above 5 repos there is an Enterprise plan. See pricing.
Add a white-box pentest to your toolkit
Connect GitHub and get your security score and your 3 most important findings free.
Scan my repo