There is a narrative about open source pentesting that simply does not add up: "the free alternatives are not up to the job". The people who say this usually have never used Metasploit Framework in a real pentest, because 90% of what the paid product does is already in the free version.
The free part does the work. The paid part adds automation, interface and reporting. The real work — understanding what is there, verifying what is broken, demonstrating what can be done — is all inside the open code.
That said, an article that merely lists free tools would be advertising disguised as content. So here we also say where open source is not enough, which is the part that costs you the most if you discover it in the middle of an engagement.
The same constraint always applies first: these tools may be used only on systems for which you have written authorisation. A scanner does not need sanctions because it does nothing illegal; an exploit does. In Italy this constitutes aggravated unlawful access to a computer system (art. 615-ter of the Criminal Code).
The toolchain, phase by phase
The four phases of a pentest and what free software covers in each of them. This is the map that is usually missing, because tool lists present the instruments as a menu rather than as a process.
| Phase | Open source | What is missing |
|---|---|---|
| Reconnaissance | Nmap, masscan, Amass | automatic correlation and reporting |
| Enumeration | Nikto, ffuf, nuclei, Impacket | centralised management of results |
| Verification | Metasploit Framework, sqlmap, ZAP | automatic validation and prioritisation |
| Post-exploitation | Impacket, Sliver (C2), BloodHound | stability and support |
| Reporting | Jinja2, Pandoc, Dradis CE | wizards and compliance maps |
Reconnaissance: Nmap
This case is particular and deserves a note, because here people get it wrong systematically. Nmap has not been pure GPL since 2020. From version 7.90 it is distributed under the Nmap Public Source License, derived from GPLv2 with additional clauses on commercial reuse: if you redistribute Nmap inside a proprietary product or sell it as part of an appliance, a separate licence from Nmap Software is required.
For a pentest this changes nothing: you can download it, use it, modify it, do whatever you want with it. But if one day you incorporate it into a product you sell, the question "is it open source?" is no longer enough. It is the case where the yes/no answer is more nuanced than it appears, and it is worth knowing before you get into a legal discussion.
The rest is the usual: -sV for versions, NSE scripts for vulnerabilities, and a false positive rate that has to be managed like all scans. A scan says "there is a port", not "there is a vulnerability".
Verification: Metasploit Framework
Here the distinction is clear and documented. Rapid7 distributes Metasploit Framework under a BSD-style licence, permanently free, and Metasploit Pro as a paid product. The same exploit base — over 1,500 — is in everyone's hands, and the difference is not in the catalogue, it is in what you put around it:
- Pro has a web interface, wizards, task chains, reporting;
- Pro has discovery scanning and import of scan data;
- Pro has a documented remote API for SIEM and GRC;
- Pro has automatic bruteforce and payloads that evade some antiviruses.
Put plainly: the average user of a paid tool is not paying for the exploits, they are paying not to have to write the glue scripts. And in many cases they still have to write those scripts, because the real case is never the standard one.
There is also Community Edition, which is free but limited to a single user. If you need the free product with several people, that is not the way to go.
A legal note that is often ignored: the Rapid7 EULA explicitly forbids use to create antivirus signatures, for heuristic analysis and for comparative benchmarks of products. If you do comparative evaluations for a client, Metasploit Pro is not the tool to use.
Web: sqlmap and ZAP
sqlmap is GPLv2, with no commercial editions upstream, and it is the case where free software beats the paid product outright: it automates SQL injection better than almost anything else, and it lets you inspect every request it generates. What it does not do: it does not distinguish an exploitable vulnerability from a response that only looks exploitable. It gives you the injection, not the impact.
ZAP deserves an update that few people have: it left OWASP in 2023 and moved to the Linux Foundation, within the Software Security Project. It remains Apache 2.0, it remains community-governed, it remains free. The name everyone searches for is still "OWASP ZAP", but officially it is now called ZAP and it has been owned by Checkmarx since September 2024. The information changes nothing technically and changes a lot in the perception of those who search for it.
Here the competition with Burp is more interesting than with Metasploit, because Burp Community Edition is free and does the manual testing proxy. The Pro version adds scanning, automation and integration.
Post-exploitation and reporting
Impacket (Python, open source) is the workhorse for Active Directory, and it is the tool that saves your day in an internal assessment. BloodHound has a Community Edition under Apache 2.0, separate from the paid Enterprise: the attack map is the open part, the real-time detection functions are not. hashcat for cracking is open and has no equal; the commercial counterpart does not exist on the market.
Reporting, on the other hand, is the real weak point, and here it must be said clearly: there is no open equivalent of a polished commercial report. The tools exist — Jinja2, Pandoc, Dradis Community Edition — but the work of turning results into a document a client will agree to sign remains yours.
And it is real work. A report is not a dump of results: it is a risk hierarchy, a remediation priority, and an explanation for people who are not technical. This does not automate well.
Why it is better: six reasons, one of which is debatable
1. The lock-in risk is zero. If in three years your open source tool is abandoned, the code is yours. If the paid product stops, you repeat the exercise with a vendor.
2. Price is not the main factor, but it is not secondary. The saving on the licence is real. The stronger reason is another: the cost of a paid product scales with the number of testers, while the cost of open source does not. On a team of ten people the licence is not an expense line, it is a procurement project.
3. You can build on top of it. This is the real technical reason. With sqlmap you can do whatever you want; with a closed product you cannot. Open tools are components, not finished products.
4. You do not have to justify the budget. Often the licence is not even the main obstacle: it is the approval request. A paid product in a small company is a three-month process. An apt install is today.
5. There is no exfiltration channel. Paid tools often require activation and accounts, and in some cases telemetry. On a production machine, or in an engagement where the client cannot know you are using a tool with evasion functions, this is a real problem.
6. The flaw in this list. The free version is "better" only if you know what you are doing. A paid product with a wizard takes you far even if you understand nothing. The free framework puts a terminal in front of you and forces you to learn. For a beginner it is worse. For someone who needs to understand what happened in the system, it is the only thing that works: you cannot fix a vulnerability you do not understand.
The three cases where open source is not enough
If you know it beforehand, it costs you an hour. If you discover it in the middle of an engagement, it costs you the relationship.
1. Reporting. As said above. The building blocks exist, the product does not. If your deliverable is a document signed by the client, here open source requires hours that the commercial one gives you in minutes.
2. Managing results at scale. For a single assessment Nmap and Metasploit are enough. For a fleet of ten systems you have to re-assess three months apart, with history and diff, paid tools have a data model you have not rebuilt for free.
3. Enterprise coverage. Nexpose, Qualys and the like have something open tools do not: comparison against the company's inventory. They know what you have and tell you what is not covered. Nmap and sqlmap do not know what you have.
I will add a fourth, less obvious one: support at a critical moment. When you need an exploit and nobody is talking about it, a company with a support contract answers. A GitHub repository does not. And there are cases where that difference is worth more than the price of the tool.
The mistake to avoid
It is the only thing that really matters, and it is not about software.
Using a scanner as if it were a pentest. Open tools are excellent at finding the candidate and useless at establishing whether it is a problem. The ratio between scanning time and verification time is heavily unfavourable, and the reason is that verification requires understanding the system.
Someone who runs sqlmap against a site gets 40 alerts, verifies 3, finds one real SQL injection and writes "SQL injection vulnerability" in the report. That report is wrong in every part except one, because the 39 false positives did their job: the client no longer reads any finding, so they do not even read the real one.
Free software gives you the certainty that you found everything there was to find with that tool. It does not give you the certainty that it is a problem. The difference is the craft.
The rule we follow
The reasoning of CYBER ONIONS on this topic is not "free is better", and it is not "open source is always enough":
Use open software to understand. Use whatever saves you time only on what does not require understanding — the report, the inventory, the correlation. Everything else you have to be able to do.
The reason is what we have already written elsewhere and that applies here too: if you can read the code of something you depend on, that thing is yours. Licences get renewed, vendors withdraw, open tools stay on a repository and can be studied even when you no longer use them.
The initial saving is a few hours of configuration. The real advantage is that in a few years you still know how to use what you have, and you are not waiting for someone to renew your licence.