Kali Linux Vulnerability Scanner Tools: Which Scanner Should You Use?

Kali ships hundreds of security tools. That does not mean you should open twenty of them on every engagement. The useful question is narrower: which vulnerability scanner matches the surface you already found?

This page covers the vulnerability-analysis stage between reconnaissance and manual validation or exploitation. Pick the tool that answers the question your discovery pass already raised.

Which Kali vulnerability scanner should you use?

Start here, then read the sections that match your target:

No single Kali scanner is best for every target. Pick the tool that answers the question your recon already raised.

The first table gives the fastest choice; the detailed table below explains the trade-offs.

For a more detailed comparison:

Use the focused tutorials for install depth and long output. This page stays on which tool when.

Vulnerability scanning vs discovery, manual testing, and exploitation

These labels blur on Kali’s menu, so keep the jobs separate:

Nmap can discover hosts and run vulnerability-oriented NSE scripts, but that does not make it a full network assessment platform like Greenbone or Nessus. Burp Community is for interactive web testing through a proxy; it is not the same job as Nikto’s common web-server checks or Wapiti’s black-box DAST. Metasploit sits further down the workflow after you already have a validated finding.

Nmap and NSE: network discovery and focused checks

Use Nmap first when you need a map of hosts, ports, and service versions. Add NSE when you want protocol-specific checks after you know what is open.

Set the authorized target once:

TARGET=192.168.56.127

Shell assignment prints nothing. Replace the IP with a host in your RoE. In the pentest lab that address is Metasploitable 2 on the host-only network.

Confirm open ports before you choose a heavier scanner:

nmap -n -Pn -p 21,22,80,445 --open "$TARGET"

Nmap scan report for 192.168.56.127
Host is up (0.00074s latency).

PORT    STATE SERVICE
21/tcp  open  ftp
22/tcp  open  ssh
80/tcp  open  http
445/tcp open  microsoft-ds
MAC Address: 08:00:27:33:AF:98 (Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 0.16 seconds

That report already steers the next tool: HTTP points to Nikto or Nuclei; SMB and FTP point toward network VA or service-specific checks, not a web-only scanner.

Limitations:

• NSE is not a replacement for Greenbone or Nessus coverage
• Aggressive scripts can be noisy or unsafe — stay within RoE
• Discovery success does not mean a vulnerability exists

For NSE categories and script selection, use the Nmap NSE scripts lesson. For broader recon patterns, use network reconnaissance using Nmap.

Nikto: web server checks

Nikto fits when port 80 or 443 is open and you want a fast pass for common files, outdated banners, and server misconfiguration.

nikto -h "http://$TARGET/" -maxtime 40s

Trimmed sample from this lab:

- Nikto v2.6.0
+ Target IP:          192.168.56.127
+ Target Hostname:    192.168.56.127
+ Target Port:        80
+ Server: Apache/2.2.8 (Ubuntu) DAV/2
+ [999986] /: Retrieved x-powered-by header: PHP/5.2.4-2ubuntu5.10.
+ [750500] /icons/: Directory indexing found.
+ [600050] Apache/2.2.8 appears to be outdated (current is at least 2.4.66).
+ [000434] /: HTTP TRACE method is active and replies which suggests the host is vulnerable to XST.
+ [750510] /phpinfo.php: Output from the phpinfo() function was found.
+ ERROR: Host maximum execution time of 40 seconds reached

Nikto is still useful for that first web-server pass. It is not comprehensive web-app DAST, and it is rarely stealthy. For the full Nikto workflow, see the Nikto web scanner guide.

Nuclei: template-based vulnerability and exposure checks

Nuclei runs YAML templates against targets. Use it when you already know the technology fingerprint and want fast checks for known exposures, misconfigs, or CVE-shaped templates.

After HTTP is open, run a severity-filtered pass:

nuclei -u "http://$TARGET" -severity medium,high,critical

On this lab target that pass finished with no lines at those severities—even though Nikto separately flagged phpinfo.php, which shows why different scanners can cover different checks—so treat Nuclei as follow-up, not a replacement for Nikto. When a template does match, each hit prints on one line naming the template, protocol, severity, and URL.

What to remember:

• Keep templates updated before you trust “no findings”
• Match templates to the surface you found (do not spray every template at every host)
• Treat matches as candidates until you validate them

Nuclei complements Nikto and full VA platforms rather than sitting directly between them: it excels at targeted template-driven checks after reconnaissance and technology identification. There is no separate Nuclei deep-dive on this site yet; use official ProjectDiscovery docs for template management, and keep validation habits from your Domain 3 workflow.

Greenbone / OpenVAS (GVM): full vulnerability assessment

Choose Greenbone (GVM / OpenVAS stack) when you need a managed vulnerability assessment: targets, tasks, feeds, and severity-oriented reports across many services—not just one web port.

On current Kali releases, the packaged stack is exposed through the gvm package and utilities such as gvm-setup, gvm-start, and gvm-check-setup. Searchers still look for “OpenVAS on Kali”; here that means the Greenbone Vulnerability Manager stack behind GVM.

Strengths:

• Broad network and service coverage once feeds are synced
• GUI workflow for recurring scans
• Fits “full VA” exam and engagement language better than Nikto alone

Trade-offs:

• First-time setup and feed sync take longer than a CLI one-liner
• Results still need validation and prioritization

Do not paste a second install guide here. Use the OpenVAS / Greenbone tutorial for install, feed readiness, and reading reports.

Nessus: commercial vulnerability scanning

Nessus is the commercial counterpart many clients already run. Tenable distributes it separately from Kali repositories—it is proprietary software you install on Kali, not a normal apt install package like Nikto.

Use Nessus when:

• The engagement expects a commercial VA report format
• You need polished credentialed scan workflows
• You are comparing client Nessus output with your own findings

Use Greenbone when you want an open-source full VA path on Kali. They compete in the same job, not the same license model. Install and policy details live in the Nessus vulnerability scanner article.

Web application scanners and testing tools

After Nikto, web work usually splits into three intents:

Burp Community does not include Burp Scanner—the automated vulnerability scanner in Burp Professional. Burp does not replace Nikto. Nikto answers “what is wrong with this web server’s common surface?” Wapiti and ZAP automate black-box web checks after crawling or probing the application, while Burp Community is primarily for interactive manual testing. Burp answers “what can I prove in this application’s request/response flow by hand?” For Burp workflows, see the Burp Suite proxy tutorial. Pair app labs with DVWA when you need a safe practice target.

Specialized security scanners and follow-up tools

Keep these for matching surfaces, not as defaults on every host. Not every row is a classic network or web vulnerability scanner—some enrich CVEs, hunt secrets, or probe a narrow stack after discovery.

Specialized tools reduce noise when recon already identified the stack. Running WPScan against a non-WordPress site wastes time and confuses the report.

Build a practical scanner workflow

Use this sequence on an authorized engagement:

1. Discover hosts and open ports (Nmap).
2. Identify technologies and services from banners, headers, and page content.
3. Choose the scanner that matches that surface (table at the top).
4. Run a targeted scan against the authorized hosts, ports, URLs, or application paths.

An unauthenticated scan sees the target from the network. A credentialed vulnerability scan can inspect installed packages, patch levels, and local configuration, so Greenbone or Nessus may find issues that an external Nmap or Nuclei pass cannot see.

5. Check scan completeness (timeouts, auth failures, skipped ports).
6. Validate findings manually before you treat them as confirmed.
7. Prioritize by applicability, reachability, exploit evidence, severity, and engagement impact — use vulnerability prioritization for scoring context.
8. Add a second scanner only when it answers a different question.
9. Document evidence: command, vantage, tool version, and validation notes.

Why scanners disagree:

• Different plugins / templates / feeds
• Authenticated vs unauthenticated visibility
• Timing, rate limits, and incomplete crawls
• Category mismatch (web-server check vs full VA vs manual proxy)

A scanner report is not proof of exploitability. Validation and prioritization are separate steps.

Troubleshooting

Summary

Kali’s value for vulnerability scanning is not the length of the tool list. It is how quickly you can match a discovered surface to the right scanner: Nmap for the map, Nikto or Nuclei for web exposure, Greenbone or Nessus for full network VA, Burp or ZAP for application testing, and specialized tools when the stack is already known.

The common mistake is running everything and calling the loudest report the truth. Keep discovery, scanning, validation, and exploitation as separate jobs. When a finding matters, open the focused tutorial for that scanner and finish the evidence trail there.

References

• Nmap documentation
• Nikto on GitHub
• ProjectDiscovery Nuclei
• Nuclei on Kali Tools
• Greenbone Community Edition documentation
• GVM on Kali Tools
• Tenable Nessus documentation
• OWASP ZAP Getting Started
• PortSwigger Burp Suite documentation
• Kali Tools listing