Kali Linux for Web Application Penetration Testing: Tools, Techniques, and Workflow

Kali Linux is the de facto operating system for professional penetration testers. It ships pre-loaded with hundreds of security tools, but knowing the tool names and actually conducting a systematic web application assessment are different things. This guide covers the essential web application testing toolkit — what each tool does, when to use it, and how they fit together into a repeatable workflow.

Everything here assumes you have a legal testing mandate for your target. Running these tools against applications you don't own or don't have explicit authorisation to test is illegal in most jurisdictions.

Why Kali Linux for Web App Testing?

The practical answer is consolidation. Instead of installing and maintaining individual security tools across a general-purpose OS, Kali provides a curated, regularly updated collection that works out of the box. The Kali team maintains packages for tools that are otherwise difficult to install correctly, and the system is built for security work — networking tools, wireless support, and hardware compatibility are configured for a tester's use case rather than a developer's.

For web application testing specifically, the relevant tools fall into five categories: reconnaissance, scanning and fingerprinting, vulnerability exploitation, authentication testing, and reporting. We'll cover each.

Phase 1: Reconnaissance

Nmap — Network and service discovery

Before you test a web application, you need to understand what's listening. Nmap maps open ports, identifies services, and fingerprints the software versions running on them.

# Full TCP port scan with service/version detection
nmap -sV -sC -p- --open -T4 target.example.com -oA nmap-full

# Fast initial scan of top 1000 ports
nmap -sV -sC --open target.example.com

# UDP scan (slower — run targeted)
nmap -sU -p 53,67,68,161,500 target.example.com

# OS detection (requires root)
sudo nmap -O target.example.com

Key things to check in results: non-standard ports hosting web services (8080, 8443, 8888, 8000, 4443), admin interfaces (Tomcat manager on 8080, Kubernetes API on 6443), and verbose service banners that reveal software versions for CVE lookup.

Sublist3r and Amass — Subdomain enumeration

Web applications often have staging environments, admin subdomains, and legacy endpoints that are less carefully maintained than the primary domain. Subdomain enumeration finds them.

# Amass passive enumeration (no direct target interaction)
amass enum -passive -d example.com -o amass-subdomains.txt

# Amass active enumeration
amass enum -active -d example.com -brute -o amass-active.txt

# Sublist3r
sublist3r -d example.com -o sublist3r-results.txt

# DNS brute-force with dnsx
cat amass-subdomains.txt | dnsx -silent -a -resp > live-hosts.txt

whatweb — Technology fingerprinting

Before you start testing, identify what you're dealing with: the web framework, CMS, JavaScript libraries, server software, and CDN. This determines which vulnerability classes to prioritise.

# Basic fingerprint
whatweb https://target.example.com

# Verbose with plugin detail
whatweb -v https://target.example.com

# Scan a list of targets
whatweb -i live-hosts.txt --log-json=whatweb-results.json

Phase 2: Scanning and Fingerprinting

Nikto — Web server misconfiguration scanning

Nikto is a web server scanner that checks for common misconfigurations, dangerous files, outdated software, and default credentials. It's noisy — it will generate log entries — but it's fast and covers a broad range of server-level issues.

# Basic scan
nikto -h https://target.example.com

# With authentication
nikto -h https://target.example.com -id username:password

# Tuned to specific check categories (2=misconfiguration, 4=XSS, 6=DoS-risk)
nikto -h https://target.example.com -Tuning 24

# Save output
nikto -h https://target.example.com -o nikto-output.html -Format htm

Nuclei — Template-based vulnerability scanning

Nuclei is the most practically useful automated web application scanner in the Kali toolkit. Its community template library covers thousands of CVEs, misconfiguration patterns, exposed panels, and vulnerability signatures. Templates are YAML — readable, auditable, and extensible.

# Update templates first (do this regularly)
nuclei -update-templates

# Full scan against a target
nuclei -u https://target.example.com -o nuclei-results.txt

# Targeted by severity
nuclei -u https://target.example.com -severity high,critical

# Specific vulnerability categories
nuclei -u https://target.example.com \
  -t http/misconfiguration/ \
  -t http/exposures/ \
  -t ssl/ \
  -t http/vulnerabilities/ \
  -o nuclei-targeted.txt

# Authenticated scan with cookie
nuclei -u https://target.example.com \
  -H "Cookie: session=abc123" \
  -t http/vulnerabilities/ \
  -severity medium,high,critical

# Scan a list of URLs from a file
nuclei -l urls.txt -t http/vulnerabilities/ -o nuclei-bulk.txt

testssl.sh — TLS/SSL configuration analysis

TLS misconfigurations are a common finding in web app assessments. testssl.sh checks cipher suites, protocol versions, certificate validity, and common TLS attack vectors.

# Full TLS assessment
testssl.sh --full https://target.example.com

# Check for specific weaknesses
testssl.sh --vulnerable https://target.example.com

# Output to JSON for report integration
testssl.sh --jsonfile testssl-results.json https://target.example.com

Phase 3: Directory and Content Discovery

ffuf — Fast web fuzzer

ffuf is a high-performance fuzzer built for directory/file discovery, parameter fuzzing, and virtual host enumeration. It's replaced dirb and gobuster as the preferred tool for most testers due to its speed and flexibility.

# Directory brute-force (using SecLists wordlist)
ffuf -u https://target.example.com/FUZZ \
  -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
  -fc 404 \
  -o ffuf-dirs.json

# File discovery with extensions
ffuf -u https://target.example.com/FUZZ \
  -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt \
  -e .php,.html,.js,.txt,.bak,.sql \
  -fc 404

# API endpoint discovery
ffuf -u https://target.example.com/api/FUZZ \
  -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt \
  -fc 404,405

# Virtual host enumeration
ffuf -u https://target.example.com \
  -H "Host: FUZZ.example.com" \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  -fs 0

Phase 4: Vulnerability Exploitation

sqlmap — Automated SQL injection detection and exploitation

sqlmap automates the detection and exploitation of SQL injection vulnerabilities. It handles dozens of injection techniques and supports virtually every database backend.

# Test a URL parameter
sqlmap -u "https://target.example.com/items?id=1" --dbs

# Test with a POST request
sqlmap -u "https://target.example.com/login" \
  --data="username=admin&password=test" \
  --dbs

# Test with an authenticated session
sqlmap -u "https://target.example.com/api/users?id=1" \
  --cookie="session=abc123" \
  --dbs \
  --level=3

# Dump a specific database and table
sqlmap -u "https://target.example.com/items?id=1" \
  -D appdb -T users --dump

# Using a saved Burp Suite request file
sqlmap -r burp-request.txt --dbs

sqlmap's --level (1–5) and --risk (1–3) flags control thoroughness vs. safety. Keep risk at 1 unless you're authorised to run aggressive tests — higher risk levels include techniques that can corrupt data.

Burp Suite — The essential proxy and manual testing platform

Burp Suite Community Edition ships with Kali and is sufficient for most web application testing tasks. Professional adds the automated scanner (and the price tag). At minimum, configure your browser to proxy through Burp (127.0.0.1:8080) and use the interceptor, repeater, and intruder for manual testing.

Key Burp workflows for web app testing:

• Intercept and modify requests — catch requests in the Proxy tab, send to Repeater, and manually test parameter manipulation
• Intruder for fuzzing — mark injection points with §, load a payload list, and systematically test input validation
• Decoder — decode base64, URL-encoding, HTML entities to understand what the application is actually processing
• Sequencer — analyse the entropy of session tokens to identify predictability
• Comparer — diff two responses to identify subtle behavioural differences that indicate successful injection

wfuzz — Advanced parameter and authentication fuzzing

# Password brute-force (replace FUZZ with password list)
wfuzz -c -z file,/usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt \
  --hh 0 \
  -d "username=admin&password=FUZZ" \
  https://target.example.com/login

# Header fuzzing
wfuzz -c -z file,/usr/share/seclists/Discovery/Web-Content/common.txt \
  -H "X-Custom-Header: FUZZ" \
  https://target.example.com/api/internal

Phase 5: Authentication Testing

Hydra — Online credential brute-forcing

# HTTP form brute-force
hydra -l admin -P /usr/share/seclists/Passwords/Common-Credentials/best1050.txt \
  target.example.com \
  http-post-form "/login:username=^USER^&password=^PASS^:Invalid credentials"

# Basic auth
hydra -l admin -P passwords.txt \
  target.example.com https-get /admin/

jwt_tool — JSON Web Token testing

# Analyse a JWT
python3 jwt_tool.py 

# Test for algorithm confusion (alg:none)
python3 jwt_tool.py  -X a

# Test for RS256 to HS256 confusion
python3 jwt_tool.py  -X k -pk public_key.pem

# Crack weak HS256 secret
python3 jwt_tool.py  -C -d /usr/share/seclists/Passwords/Common-Credentials/best1050.txt

Phase 6: Bringing It Together — A Systematic Workflow

The tools are only useful when applied in the right order. Here's a structured workflow for a web application assessment:

1. Scope confirmation — document exactly which domains, IP ranges, and features are in scope. Write it down. Reference it constantly.
2. Reconnaissance — nmap all ports on all in-scope IPs, enumerate subdomains with Amass, fingerprint technologies with whatweb
3. Content discovery — ffuf all in-scope domains with a medium-sized wordlist; document all discovered endpoints
4. Automated scanning — run Nikto and Nuclei against all discovered endpoints; run testssl.sh against all TLS-enabled services
5. Manual review — proxy all traffic through Burp, manually walk every application feature, particularly authentication, authorisation, file upload, and data import/export
6. Targeted exploitation — follow up automated findings with manual verification; run sqlmap against parameterised endpoints; test JWT handling with jwt_tool
7. Authentication and session testing — test logout behaviour, session token entropy, password reset flows, account enumeration
8. Documentation — for every finding, capture: URL, request/response, vulnerability class, CWE/CVE reference, severity, proof of concept, remediation recommendation

Kali Linux Setup Essentials for Web Testing

# Install SecLists (essential wordlist collection)
sudo apt install seclists

# Install Nuclei
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
nuclei -update-templates

# Install ffuf
sudo apt install ffuf

# Install Amass
sudo apt install amass

# Keep Kali tools updated
sudo apt update && sudo apt upgrade -y

# Install jwt_tool
git clone https://github.com/ticarpi/jwt_tool.git
cd jwt_tool && pip3 install -r requirements.txt

# Set up Burp CA certificate in browser
# 1. Start Burp, go to Proxy > Options
# 2. Navigate to http://burpsuite/ in proxied browser
# 3. Click "CA Certificate" and download
# 4. Import in browser certificate store

Common Mistakes in Kali-Based Web App Testing

• Running tools without understanding what they do: sqlmap with --risk 3 can corrupt production data. Know your flags before you run them.
• Skipping manual testing: Automated tools find pattern-matchable issues. Business logic vulnerabilities, multi-step attack chains, and access control bugs require a human thinking adversarially.
• Testing unauthenticated only: Most application logic is behind authentication. Configure Burp with valid session cookies, pass cookies to Nuclei and sqlmap. Unauthenticated testing misses 80%+ of the attack surface.
• Not documenting as you go: A finding you can't reproduce in the report is worthless. Capture request/response pairs, screenshots, and exploitation steps in real time.
• Forgetting the scope document: Scope creep is how engagements get complicated. When you find a subdomain that looks vulnerable but isn't in scope, flag it to the client and get written authorisation before testing it.

Responsible Use

Every tool in this guide can cause real harm when used without authorisation. Kali Linux and its tools are built for professional security work — penetration testing engagements, bug bounty programmes with defined scope, and internal security assessments. The same tools that find vulnerabilities in authorised tests are the tools used in unauthorised attacks. The difference is permission.

Always operate with a signed rules of engagement document. Always stay within scope. Always report findings through the defined channel.