Lesson 11 of 12

Building Your Pentest Toolkit

Professional penetration testers rely on a curated set of tools they know deeply rather than a large collection they barely understand. This lesson surveys the essential tools across every phase of a pentest and teaches you how to customize Kali Linux for your workflow. You will also learn where to find new tools and how to evaluate them.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

In simple terms: Build a professional penetration testing toolkit. This means building enough understanding that you can apply this concept in a real scenario — not just answer a quiz question about it, but actually use it when it matters. Focus on the "why" behind the concept, not just the "what."

Why this matters

Cybersecurity is one of the fastest-growing fields in tech, with hundreds of thousands of unfilled positions globally. Understanding the career landscape helps you make smart decisions about which certifications to pursue, which specializations to develop, and how to position yourself for the roles you actually want.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Apply this skill in a real lab environment, explain it clearly to a colleague or client, and use it as a building block for the more advanced techniques that come later in this course.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

Building Your Pentest Toolkit · Objective 1 of 4

VIDEO

Loading video…

Audit your current Kali installation for tool coverage

Open a terminal and verify that the essential tools for each phase of a penetration test are installed and working by running the which command for each one. Kali Linux comes with most tools pre-installed, but some require additional setup or configuration before they are usable — pay particular attention to Burp Suite (requires Java and initial configuration), Metasploit (requires database initialization), and OpenVAS (requires the vulnerability database download). Create a checklist organized by phase: Reconnaissance, Scanning, Exploitation, Post-Exploitation, and Reporting — ensure you have at least two tools for each phase so you have a backup when one tool fails or is blocked.

which nmap burpsuite msfconsole wireshark sqlmap hydra john hashcat gobuster nikto

Configure Burp Suite Community Edition as your web proxy

Open Burp Suite from the Kali applications menu and on the first launch select Temporary project and use Burp defaults. Go to Proxy > Options and confirm the proxy listener is running on 127.0.0.1:8080. In Firefox, go to Settings > Network Settings > Manual proxy configuration and set HTTP Proxy to 127.0.0.1 port 8080. To intercept HTTPS traffic, you must install the Burp CA certificate: browse to http://burpsuite in Firefox while the proxy is running, download the certificate, and import it into Firefox certificate store under Settings > Privacy and Security > Certificates. Without the CA certificate, Burp cannot decrypt HTTPS traffic and you will see certificate errors on every HTTPS site you visit.

burpsuite &

Set up tmux for professional terminal management

Tmux (terminal multiplexer) is essential for penetration testing because it lets you run multiple terminal sessions in one window, keep sessions running after disconnecting, and organize your work into named windows. Install it and create a basic configuration file that enables mouse support so you can click to switch panes. Learn the essential shortcuts: Ctrl+B then C creates a new window, Ctrl+B then % splits the current pane vertically, Ctrl+B then double-quote splits horizontally, and Ctrl+B then arrow keys navigate between panes. Create a standard tmux layout for penetration testing: one pane for Metasploit, one for Nmap scans, one for web testing, and one for notes.

sudo apt install tmux -y && echo 'set -g mouse on' >> ~/.tmux.conf && tmux new -s pentest

Build a comprehensive personal wordlist

A good wordlist is one of the most valuable assets in your toolkit — start with rockyou.txt which is already on Kali at /usr/share/wordlists/rockyou.txt (you may need to gunzip it first). Then use CeWL to generate a target-specific wordlist by scraping words from the target website, which is highly effective because people often use words related to their company or industry as passwords. Combine multiple wordlists and remove duplicates using sort and uniq. Also download SecLists from GitHub — it contains hundreds of specialized wordlists for different attack scenarios including usernames, passwords, directories, and fuzzing payloads.

gunzip /usr/share/wordlists/rockyou.txt.gz
git clone https://github.com/danielmiessler/SecLists ~/SecLists

Create a structured note-taking system

Professional penetration testers use structured note-taking to track findings, commands, and ideas during an engagement — install CherryTree (already on Kali) or Obsidian for markdown-based notes. Create a template with these sections: Target Information (IPs, domains, technologies), Recon Findings (subdomains, emails, employees), Scan Results (open ports, service versions), Exploitation Attempts (what you tried, what worked, what failed), Post-Exploitation Findings (credentials, sensitive files, network topology), and Report Draft (findings formatted for the final report). The key habit is writing notes in real time, not trying to reconstruct them from memory after the fact — you will forget important details that matter for the final report.

sudo apt install cherrytree -y && cherrytree &

Build and maintain a personal command cheat sheet

Create a markdown file with your most-used commands organized by phase and scenario — this cheat sheet should be a living document that you update every time you learn a new technique. Include: Nmap scan templates for different scenarios (quick scan, full scan, UDP scan, NSE scripts), Metasploit workflow commands, common privilege escalation checks for Linux and Windows, web application testing payloads (SQL injection, XSS, CSRF), and password cracking commands for different hash types. The goal is to have a reference you can consult quickly during an engagement without having to search the internet — internet searches during a timed engagement waste valuable time and can reveal your activities if you are on a monitored network.

nano ~/pentest-cheatsheet.md

Previous: CTF Walkthrough: Beginner Box Next Lesson