Penetration Testing Tools (2026): 15 Free and Paid Options Compared

Not every product on the market. How we rank Grouped by job; within each group, free and open source first, then lowest published price, then quote-only. Prices checked October 24, 2026.

How we chose these penetration testing tools

We picked penetration testing tools that do one of the six jobs in a standard test, that are built for authorized security testing, and that had a release or code change in the last 12 months (GitHub or the vendor’s site, checked October 24, 2026). This is a comparison, not a scored ranking: we read each project’s site, license file and pricing page, and we did not run the tools ourselves.

The table is grouped by job, from finding hosts to breaking in. Inside each group, free and open-source tools come first, then paid tools from the lowest published price, then tools sold only through a demo or quote. None of these vendors pays us; a vendor’s affiliate status would not change its place.

Penetration testing tools by category

Penetration testing tools split into six jobs: network discovery, vulnerability scanning, web app testing, exploitation, password cracking, and automated platforms that chain the steps together.

Network discovery and traffic: Nmap and Wireshark

Nmap finds the hosts on a network, the ports they have open and the services behind them, which is the first step in most tests. Nmap is free under the Nmap Public Source License, which allows free use but restricts embedding Nmap in commercial products without a paid OEM license.

Wireshark captures network traffic and decodes it packet by packet, so a tester can see credentials sent in clear text or confirm what an exploit did. Wireshark is free and open source under GPL-2.0.

Vulnerability scanning: OpenVAS, Nuclei and Nessus

OpenVAS is Greenbone’s free, open-source vulnerability scanner (GPL-2.0); its scanner had a release on October 21, 2026. Nuclei, from ProjectDiscovery, is a free scanner (MIT license) that runs community-written templates against websites, APIs and hosts.

Nessus Professional costs $4,790 a year and Nessus Expert costs $6,790, adding web app scanning and external attack surface discovery, per Tenable’s store. The free Nessus Essentials scans up to 5 IP addresses on a 30-day license, and Tenable says it is “strictly for non-commercial use”. Scanners list likely weaknesses; they do not prove an attacker can use them, which is the line between a scan and a penetration test.

Web application testing: ZAP, sqlmap and Burp Suite

ZAP (Zed Attack Proxy) is a free, open-source web app scanner and proxy (Apache-2.0). Its site calls it “an independent Open Source project” and carries the branding “ZAP by Checkmarx”. sqlmap automates finding and exploiting SQL injection, licensed GPL-2.0, with a commercial license sold to companies that embed it.

Burp Suite is the standard toolkit for manual web app testing. The free Community Edition has the core manual tools; Burp Suite Professional costs $499 per user a year and adds the automated scanner. PortSwigger says everyone who uses Professional needs their own subscription.

Exploitation: Metasploit

Metasploit Framework is a free, open-source library of exploits and payloads (BSD-3-Clause) maintained by Rapid7, used to show that a weakness a scanner found can really be used. Metasploit Pro is the commercial edition; Rapid7 does not publish its price on its site, so expect a sales quote.

Password cracking: Hashcat and John the Ripper

Hashcat recovers passwords from stolen hashes using a graphics card, and is free under the MIT license. John the Ripper, from Openwall, does the same job on a normal processor and supports hundreds of hash types; the open-source version is free, and Openwall also sells Pro builds.

Kali Linux: all of the above in one install

Kali Linux is a free Linux distribution for security testing whose tool listings include Nmap, Wireshark, Burp Suite, ZAP, Nuclei, sqlmap, Metasploit Framework, Hashcat and John the Ripper. Kali’s latest release when we checked was 2026.2. Kali also runs in a virtual machine or in Docker and LXD containers, per its site.

Automated penetration testing platforms

Pentest-Tools.com is a cloud platform that runs scanning and exploit checks from a browser; its NetScan plan starts at $96 a month for 16 assets, AppScan at $140 for 5 assets and Exploit at $190 for 5 assets, with prices varying by billing cycle. A free edition is available.

Intruder runs continuous vulnerability scans, with a free plan for up to 5 infrastructure targets, Cloud at $2,870 a year and Pro at $4,790 a year at the entry asset count, billed annually. Intruder also sells an AI-led web app pentest from $3,500 per test for platform subscribers, or $4,000 otherwise. Horizon3.ai NodeZero runs autonomous internal and external pentests that chain weaknesses together; Horizon3.ai sells it through demos and publishes no price.

Free vs paid penetration testing tools

Free penetration testing tools cover every step of a test: Nmap, OpenVAS, ZAP, Metasploit Framework and Hashcat together match the jobs of the paid tools in this list.

Paid editions add speed and support rather than new abilities:

• Burp Suite Professional adds the automated web scanner; Community Edition has the manual tools.
• Nessus Professional is licensed for commercial use; Nessus Essentials is non-commercial and capped at 5 IPs.
• Automated platforms run the steps on a schedule without a skilled tester at the keyboard.

A small IT team with a skilled tester can work almost entirely with free tools. A team without one gets more from an automated platform or a hired test.

Automated penetration testing: what it is and isn’t

Automated penetration testing is software that scans, tries known exploits and chains findings without a person driving each step, such as Horizon3.ai NodeZero, Pentest-Tools.com and Intruder’s AI-led pentest.

Automated platforms are good at repeating known attacks across many systems, often on a schedule. The vendors describe their products as AI or autonomous; those are the vendors’ claims, and we did not run the tools. What automation does poorly is business logic, such as whether one customer can read another customer’s invoices, which is why the firms on our penetration testing services comparison still sell human-led tests alongside AI-led ones. Testing an AI model itself is a separate job; see how AI red teaming works.

Penetration testing tools vs hiring a penetration tester

Buy penetration testing tools when you have someone who knows how to use them; hire a tester when you need a report that an auditor, a customer or an insurer will accept.

PCI DSS shows where the line falls. Requirements 11.4.2 and 11.4.3 call for internal and external penetration tests at least once every 12 months and after significant changes, performed “by a qualified internal resource or qualified external third party” with “organizational independence of the tester”. A company can meet that with its own staff only if the tester is independent of the systems tested, which most small teams aren’t. If a SOC 2 project is behind the request, our guide to how SOC 2 certification works explains the audit itself. See penetration test prices by test type.

Is it legal to use penetration testing tools?

Using penetration testing tools is legal on systems you own or have written permission to test, and a crime on anyone else’s. The Computer Fraud and Abuse Act (18 U.S.C. 1030) makes it an offense to “intentionally access a computer without authorization”, and it doesn’t matter that the tool is free or popular. A May 19, 2022 Justice Department policy says good-faith security research “should not be charged” under the CFAA, but that is a prosecutors’ policy, not permission to test systems you don’t own.

Before any test, get signed permission from the system owner that names the targets, the dates and what’s off-limits. Hired firms put this in their rules of engagement.