Primary network scanner for host discovery, port scanning, service/version detection, and OS fingerprinting. Use this FIRST on any target to understand what's running. Returns open ports with service banners and detected OS. For fast bulk port scanning across many hosts, use masscan instead. For live host discovery on a local subnet, use arp_scan.

Ultra-fast asynchronous TCP port scanner. Use when you need to scan large IP ranges (entire subnets or the internet) for open ports. Much faster than nmap for bulk scanning but does NOT provide service/version detection. Typical workflow: masscan to find open ports, then nmap on those ports for details. Output: list of open ports with optional banner grab.

TCP/UDP connection utility — connect to services, create listeners, transfer files, or spawn shells. Use for quick service banner grabs, port connectivity tests, or setting up reverse/bind shells. For structured service enumeration, prefer nmap. For raw packet analysis, use tcpdump/tshark.

Real-time packet capture on a network interface. Use for live traffic monitoring, debugging connectivity, or capturing evidence of network activity. For deeper protocol analysis and display filtering, use tshark. Output: raw packet headers (IP, TCP/UDP, payload snippets). Requires root/privileged access.

ARP-based host discovery on a local network segment. Sends ARP requests and identifies live hosts by MAC address and vendor. Use for initial reconnaissance of a local subnet — faster and more reliable than nmap ping scans on the same LAN. Output: IP address, MAC address, and OUI vendor name for each responding host.

Fast SNMP scanner — discovers SNMP-enabled devices and tests community strings. Use when you suspect SNMP is running (port 161 UDP) and want to find readable community strings (public, private, or custom). Much faster than snmpwalk for initial discovery. Output: list of IPs with their valid community strings and system descriptions.

DNS enumeration tool — performs zone transfers, brute-force subdomain discovery, reverse lookups, and DNS record enumeration (A, AAAA, MX, NS, SOA, TXT, SRV). Use when you have a domain and need to map its DNS footprint. For passive subdomain discovery across many sources, prefer subfinder. Output: DNS records organized by type with associated IPs and hostnames.

Command-line Wireshark — captures and deeply analyzes network traffic with full protocol dissection. Use for detailed traffic analysis, extracting specific protocol fields, or analyzing pcap files. Superior to tcpdump for protocol decoding and display filters. Can read pcap files or capture live. Output: detailed packet summaries with protocol-specific fields.

Automated SQL injection detection, exploitation, and data extraction. Use when you find a URL parameter that may be injectable. Handles detection, database fingerprinting, data dumping, and even OS shell access via SQLi. Output: confirms injectable parameters, database type/version, and extracted data. For command injection (not SQL), use commix. For XSS, use xsser.

Web server vulnerability scanner — checks for 6700+ known issues: outdated server software, dangerous files/CGIs, default credentials, and server misconfigurations. Use early in web recon to find low-hanging vulnerabilities. Does NOT exploit — only reports. For modern CVE-based scanning, use nuclei. For WordPress-specific, use wpscan. Output: categorized list of findings with severity.

Fast multi-mode brute-force tool: directory/files (dir), DNS subdomains (dns), virtual hosts (vhost), and fuzzing. Use for discovering hidden paths and subdomains. Written in Go — faster than dirb. For pure directory brute-force, dirb is simpler. For parameter/header fuzzing, use ffuf. Output: discovered paths/subdomains with HTTP status codes.

Classic web content scanner using dictionary-based attacks to find hidden directories and files. Simpler than gobuster — good for quick scans with built-in wordlists. Use when you want a straightforward directory scan without configuring many options. Output: list of found paths with HTTP response codes. Non-recursive by default.

Dedicated WordPress security scanner. Enumerates installed plugins, themes, users, and checks for known vulnerabilities in all of them. Use ONLY when the target is confirmed to be WordPress (verify with whatweb first). Output: WordPress version, vulnerable plugins/themes with CVE references, enumerated usernames.

Extremely fast web fuzzer written in Go. Supports directory discovery, virtual host enumeration, GET/POST parameter fuzzing, header fuzzing, and more. Use for high-performance fuzzing tasks. Place 'FUZZ' keyword in the target URL where fuzzing should occur. For simpler directory scans, use gobuster or dirb. For HTTP parameter brute-force, wfuzz has more features. Output: matched URLs with status codes and response sizes.

Modern template-based vulnerability scanner with thousands of community-maintained YAML templates. Detects CVEs, misconfigurations, exposed panels, default credentials, and more. Use as your primary vulnerability scanner after discovering services. Much faster and more current than nikto. Output: vulnerability name, severity, matched endpoint, and remediation reference.

Passive web technology fingerprinting. Identifies CMS (WordPress, Joomla, Drupal), web frameworks, JavaScript libraries, analytics platforms, CDNs, server software, and more. Use FIRST on any web target to understand the tech stack before running specialized tools. Output: structured list of identified technologies with version numbers where available.

Feature-rich web application brute-forcer. Fuzzes URLs, POST data, headers, cookies, and authentication. Use for parameter discovery, login brute-force, header injection testing, and custom fuzzing scenarios. More flexible than ffuf for complex fuzzing (multi-point injection, encoders, auth handling). Output: requests with their response codes, line/word/char counts.

Cross-Site Scripting (XSS) detection and exploitation framework. Tests for reflected, stored, and DOM-based XSS. Use when you find user input reflected in page output. Automatically encodes payloads to bypass filters. For general web vulnerability scanning, use nuclei or nikto. For SQL injection, use sqlmap. Output: identified XSS vectors with payload and injection point.

Automated OS command injection detection and exploitation tool. Tests for shell command injection in HTTP parameters, headers, cookies, and POST data. Use when sqlmap confirms the parameter is NOT SQL injectable but may still be vulnerable to command injection. Supports multiple injection techniques: results-based, blind, time-based. Output: confirms injection, shows OS type, and provides an interactive pseudo-shell on success.

Fast network login brute-force tool supporting 50+ protocols (SSH, FTP, HTTP, RDP, SMB, MySQL, etc.). Use for testing password strength on network services. Specify the target service and provide user/password lists. For offline hash cracking, use john or hashcat instead. Output: found credentials in login:password format, or 'no valid credentials found'.

John the Ripper — offline password hash cracker. Supports hundreds of hash formats with auto-detection. Use for cracking password hashes extracted from /etc/shadow, SAM databases, or captured network hashes. CPU-based — better for smaller hash sets or when GPU is unavailable. For GPU-accelerated cracking of large hash sets, prefer hashcat. Output: cracked passwords with their corresponding hashes.

World's fastest GPU-accelerated password cracker with 300+ hash type modes. Use for high-performance cracking of large hash sets. REQUIRES the mode number matching the hash type. For CPU-only or auto-detect cracking, use john instead. Use hash_identifier first if unsure of hash type. Output: cracked hashes with their plaintext passwords. Status lines show cracking speed and progress.

Wordlist generator — creates custom password lists based on character sets, length ranges, and patterns. Use to generate targeted wordlists when you know password policy (min/max length, required characters). For generating wordlists from website content (password profiling), use cewl instead. Output: wordlist printed to stdout or written to a file.

Windows/Samba enumeration tool. Extracts user lists, shares, groups, password policies, and OS information from SMB services (ports 139/445). Use for Windows domain reconnaissance without authentication. For more advanced AD enumeration with credentials, use crackmapexec or impacket modules. Output: structured enumeration data including RID-cycled user lists and accessible shares.

Command-line interface to the Exploit Database. Search for public exploit code by software name, version, CVE number, or vulnerability description. Use after identifying software versions (from nmap, whatweb, etc.) to find available exploits. Output: exploit title, path, and sometimes the exploit file content. Pair with msf_search for Metasploit module equivalents.

Passive subdomain discovery using multiple online sources (certificate transparency, search engines, DNS datasets). No direct DNS queries — completely passive and undetectable. Use for initial domain reconnaissance to map external attack surface. For active DNS brute-force and zone transfers, use dnsrecon. For deeper OSINT, use amass. Output: list of discovered subdomains.

Comprehensive network mapping and attack surface discovery using OSINT and active techniques. Discovers subdomains, IP ranges, ASNs, and related domains. Use for deep domain mapping — combines passive (OSINT) and active (DNS brute-force) methods. More thorough than subfinder but slower. Use subfinder for quick passive-only results. Output: discovered assets with their sources and relationships.

Read, write, and edit metadata embedded in files — images, PDFs, Office documents, audio, video. Use to extract hidden information: GPS coordinates from photos, author names from documents, software versions from PDFs, or creation timestamps. Output: all metadata fields with their values. Can also strip or modify metadata.

OSINT tool for harvesting emails, names, subdomains, IPs, and URLs from public sources (Google, Bing, LinkedIn, Shodan, PGP key servers, and 20+ others). Use for early reconnaissance to identify employee email patterns, exposed services, and related domains. Output: organized results by source — emails, hosts, IPs, and URLs.

SMB/CIFS client — connects to Windows file shares for browsing, downloading, and uploading files. Use to access SMB shares with or without credentials (anonymous/null session). For SMB vulnerability scanning, use nmap or crackmapexec. For automated share enumeration, use enum4linux. Output: directory listings, file contents, or confirmation of upload/download.

Metasploit Framework console — the primary interface for running exploit, auxiliary, post-exploitation, and payload modules. Use to execute exploits, scan with auxiliary modules, or run post-exploitation tasks. For generating standalone payloads without the console, use msfvenom. For searching modules without opening console, use msf_search. Output: module output, exploit results, or session information.

Metasploit payload generator — creates shellcode and executables from payloads. Use for generating standalone payloads (reverse shells, meterpreter, etc.) in various formats. For AV-evasion with encoding, encryption, and template injection, use evasive_payload instead. Output: generated payload in the requested format, or list of available payloads/encoders.

Metasploit database management. Controls the PostgreSQL database used by Metasploit for storing host data, service info, credentials, and loot from scans and exploits. Run 'init' before first use, 'start' to launch the DB, 'status' to check if running. Output: status messages about database state.

Search the Metasploit module database by keyword, CVE, platform, or module type. Use BEFORE opening msfconsole to find relevant modules for a target. Returns module paths, disclosure dates, ranks, and descriptions. After finding a module, use msf_info to see its options and requirements. Output: table of matching modules with full paths and metadata.

Display detailed information about a specific Metasploit module: description, available options, required settings, supported targets, and references. Use after msf_search to understand what a module does and what parameters it needs before running it. Output: module metadata, option table (name, current setting, required, description), and references.

Execute a Metasploit resource script (.rc file) — batch automation for multi-step Metasploit operations. Use for running pre-written attack sequences, setting up multi-handlers, or automating complex module chains. Resource files contain msfconsole commands (one per line) executed sequentially. Output: combined output of all commands in the script.

Advanced payload crafter for anti-virus evasion. Applies multiple evasion layers: polymorphic encoding (shikata_ga_nai, xor), encryption (AES256, RC4), template injection into legitimate executables (putty, plink), process migration on execution, bad character avoidance, and obfuscation padding. Use INSTEAD of msfvenom when AV evasion is needed. Use msfvenom for simple/standard payload generation. Output: saved payload file path with size, plus any msfvenom warnings about the chosen configuration.

List all available msfvenom payloads with descriptions. Use BEFORE generating a payload to find the correct payload name for your target platform and connection type. Filter by platform (windows, linux, android), architecture (x86, x64), or keyword (reverse_tcp, bind, meterpreter). Output: table of payload names with descriptions, organized by platform.

List all available msfvenom encoders with their ranks and descriptions. Use to find the best encoder for your target architecture. Filter by platform or architecture to see relevant encoders only. Output: table of encoder names with ranks (excellent, great, good, normal, manual) and descriptions.

List available msfvenom encryption/encoding formats (aes256, rc4, xor, base64, etc.). Use to see what encryption options are available for payload generation. Output: list of supported encryption methods.

Convert raw shellcode from a file into a Windows executable. Use when you have shellcode from another source (Cobalt Strike, custom C code, or extracted from malware) and need to package it as an EXE for execution. Output: path to the generated executable file.

WiFi security auditing tool — cracks WEP, WPA/WPA2-PSK, and WPA3 keys from captured wireless traffic. Requires a .cap capture file containing the 4-way handshake (for WPA) or enough IVs (for WEP). For capturing handshakes and automating attacks, use wifite. For WPS attacks, use reaver. Output: cracked WiFi password/key on success.

LLMNR, NBT-NS, and mDNS poisoner. Responds to name resolution requests on the local network and captures NTLMv2 password hashes from Windows systems. Use on internal network assessments to capture credentials when systems attempt to resolve names. Run on a network interface with an IP on the target subnet. Output: captured NTLMv2 hashes that can be cracked with hashcat (mode 5600).

Collection of Python tools for Windows network protocols. Includes secretsdump (dump credentials remotely), psexec (remote command execution), wmiexec (WMI shell), GetNPUsers (AS-REP roasting), GetUserSPNs (Kerberoasting), and many more. Use for post-exploitation Windows/AD operations when you have credentials. Output: varies by module — dumped hashes, command output, or shell access.

Windows post-exploitation tool for extracting plaintext passwords, NTLM hashes, Kerberos tickets, and PINs from memory (LSASS). Use on a compromised Windows system to dump credentials. Output: extracted credentials in structured format — usernames, domains, passwords/hashes.

Real-time MITM attack framework with modular caplets. Performs ARP spoofing, DNS spoofing, HTTP/HTTPS traffic manipulation, credential sniffing, and session hijacking. Use for man-in-the-middle attacks on a local network segment. Output: real-time captured credentials, session cookies, and traffic logs.

Firmware analysis tool — scans binary files for embedded file signatures, compressed data, and filesystem structures. Automatically extracts discovered files when using -e. Use for reverse engineering firmware images, IoT device binaries, or any blob that may contain embedded files. Output: offset map of discovered signatures and extracted file paths.

Memory forensics framework for analyzing RAM dumps. Extracts running processes, network connections, loaded DLLs, registry hives, injected code, and malware artifacts from memory images. Requires a memory profile matching the source OS version. Output: structured forensic data — process trees, network sockets, registry keys, or flagged anomalies.

File carving tool — recovers deleted files from disk images and raw data by searching for file headers, footers, and data structures. Supports common formats: images, documents, archives, executables. Use for data recovery from formatted drives, corrupted media, or when filesystem metadata is lost. Output: recovered files organized by type in the output directory.

Steganography tool — hides data within image (JPEG, BMP) and audio (WAV, AU) files, or extracts hidden data from them. Uses passphrase-protected embedding. Use to detect hidden messages in files (CTF challenges) or to conceal data. Output: embedded file confirmation or extracted hidden content.

Swiss army knife for pentesting Windows/Active Directory environments. Enumerates and exploits SMB, WinRM, MSSQL, RDP, SSH, and FTP services across multiple hosts. Supports pass-the-hash, Kerberos auth, and module execution (lsassy, mimikatz, spider_plus, etc.). Use as the PRIMARY post-exploitation tool against Windows networks when you have credentials. For interactive WinRM shells, use evil_winrm. For detailed SMB enumeration, use enum4linux. Output: per-host results with authentication status, shares, logged-on users, and module output.

Windows Remote Management (WinRM) shell client. Provides an interactive PowerShell session on port 5985 (HTTP) or 5986 (HTTPS) with pass-the-hash support. Use when you have valid Windows credentials and WinRM is enabled (common on servers). For non-interactive WinRM command execution or multi-host testing, use crackmapexec with winrm protocol. Output: interactive PowerShell session output.

Fast TCP/UDP tunnel over HTTP/HTTPS — ideal for pivoting through firewalls and NAT. Single binary for both client and server. Encapsulates TCP connections inside HTTP WebSocket streams. Use to tunnel traffic from an internal network through a compromised host to your attack machine. Run server on your attack box, client on the pivot host with reverse port forwarding. Output: connection status and tunnel statistics.

Hash type identification tool. Analyzes a hash string and determines which algorithm(s) likely produced it (MD5, SHA1, SHA256, NTLM, bcrypt, etc.). Use BEFORE attempting to crack a hash — you must know the hash type to select the correct mode in hashcat or format in john. Output: list of possible hash types ranked by likelihood with the corresponding hashcat mode and john format.

Custom wordlist generator that spiders a website and extracts words from its content. Creates targeted password lists based on the vocabulary actually used by the target organization. Use to generate wordlists for password attacks when you have a target website. For generating wordlists from character sets and patterns (not website content), use crunch. Output: list of extracted words, optionally saved to a file for use with hydra, john, or hashcat.

Proxy wrapper — forces any TCP-based tool's connections through a chain of proxies (Tor, SOCKS4/5, HTTP proxies). Reads proxy configuration from /etc/proxychains4.conf. Use to route tools through a pivot host (after setting up chisel or SSH tunneling) or through Tor for anonymity. Wrap any command: proxychains nmap -sT target.com Output: the wrapped tool's normal output, plus proxy chain connection debug info.

Automated wireless attack tool. Handles the full WiFi cracking workflow: interface setup, target scanning, WPA handshake capture, WEP cracking, and WPS PIN attacks — all with minimal user interaction. Use as the primary wireless attack tool for streamlined WiFi security testing. For manual control over individual steps, use aircrack_ng directly. For WPS-specific attacks, use reaver. Output: real-time attack progress and recovered passwords.

WPS (WiFi Protected Setup) brute-force attack tool. Exploits the WPS PIN vulnerability to recover the WPA/WPA2 passphrase without needing a captured handshake. Use when the target AP has WPS enabled (many do by default). For full WiFi attack automation including WPA handshake capture, use wifite. Output: WPA PSK (password) and AP details on success, or PIN attempt progress.

Execute an arbitrary command on the Kali system. Use ONLY as a fallback when the specific tool you need is not available as a dedicated MCP tool. The command is parsed into arguments and runs with safety restrictions — dangerous commands (rm, dd, shutdown, etc.) are blocked. Prefer the dedicated tool functions whenever possible for better parameter validation and structured output. Output: command stdout and stderr output.