The distinction between a security tool and a hacking (or attack) tool is in the intent of the user. A penetration tester legitimately uses tools to penetrate an organization's security defenses. The organization uses the results of the penetration test to improve its security defenses. However, the same tools that the penetration tester uses can be used illegitimately by an attacker.
安全工具與駭客（或攻擊）工具之間的區別，在於使用者的意圖。滲透測試人員合法地使用工具來滲透組織的安全防禦。組織會利用滲透測試的結果，來改善其安全防禦。然而，滲透測試人員所使用的相同工具，也可能被攻擊者非法使用。
Innumerable quantities of hacking (or security) tools can be found on the internet. The following list provides a few examples. More important than the details of any single example are the understanding of how easy it is now to obtain and use very powerful attack tools.
網際網路上可以找到數量龐大的駭客（或安全）工具。以下清單提供幾個範例。比起任何單一範例的細節，更重要的是了解現今取得並使用強大攻擊工具是多麼容易。
Hacking (or security) tools can be found in the following places:
駭客（或安全）工具可在下列地方找到：
- sectools.org: A website run by the Nmap Project, which regularly polls the network security community regarding their favorite security tools. It lists the top security tools in order of popularity. A short description is provided for each tool, along with user reviews and links to the publisher's website. There are password auditors, sniffers, vulnerability scanners, packet crafters, and exploitation tools, among the many categories. The site provides information disclosure. Security professionals should review the list and read the descriptions of the tools. Network attackers certainly will.sectools.org：由 Nmap 專案營運的一個網站，會定期對網路安全社群進行意見調查，了解他們最喜愛的安全工具。它會依人氣排序列出頂尖安全工具，並為每項工具提供簡短說明、使用者評論，以及指向發行者網站的連結。其中包括密碼稽核工具、封包擷取工具、弱點掃描程式、封包產生工具，以及利用工具等多種類別。該網站提供資訊揭露。資安專業人員應查看此清單並閱讀各工具的說明，網路攻擊者當然也會這麼做。
- Kali Linux: The Knoppix Security Tools Distribution was published in 2004. It was a live Linux distribution that ran from a CD-ROM and included more than 100 security tools. Back when security tools were uncommon in Windows, Windows users could boot their PCs with the Knoppix STD CD and have access to that toolset. Over the years, Knoppix STD evolved through WHoppix, Whax, and Backtrack to its current distribution as Kali Linux. The details of the evolution are not as important as the fact that a live Linux distribution that can be easily booted from removable media or installed in a virtual machine has been well supported for over a decade. The technology continues to be updated to remain current and relevant. Kali Linux packages over 300 security tools in a Debian-based Linux distribution. Kali Linux may be deployed on removable media, much like the original Knoppix Security Tools Distribution. It may also be deployed on physical servers or run as a virtual machine (VM).Kali Linux：Knoppix Security Tools Distribution 於 2004 年發佈，是一套可從 CD-ROM 執行的 Live Linux 發行版，內含超過 100 種安全工具。在安全工具於 Windows 上尚不普及的年代，Windows 使用者可以用 Knoppix STD CD 開機，使用該工具集。多年來，Knoppix STD 經歷 WHoppix、Whax、Backtrack 演變至今日的 Kali Linux 發行版。演變的細節不如以下事實重要：一套可輕鬆從卸除式媒體開機、或安裝於虛擬機器中的 Live Linux 發行版，十多年來一直獲得良好支援。這項技術持續更新，以保持最新且切合實際需求。Kali Linux 在一套基於 Debian 的 Linux 發行版中，打包了超過 300 種安全工具。Kali Linux 可部署於卸除式媒體，做法與最初的 Knoppix Security Tools Distribution 類似，也可部署在實體伺服器上，或以虛擬機器（VM）的形式執行。
- Metasploit: When Metasploit was first introduced, it had a big impact on the network security industry. It was a very potent addition to the penetration tester's toolbox. While it provided a framework for advanced security engineers to develop and test exploit code, it also lowered the threshold for the experience required for a novice attacker to perform sophisticated attacks. The framework separates the exploit (code that uses a system vulnerability) from the payload (code injected to the compromised system). The framework is distributed with hundreds of exploit modules and dozens of payload modules. To launch an attack with Metasploit, you must first select and configure an exploit. Each exploits targets a vulnerability of an unpatched operating system or application server. The use of a vulnerability scanner can help determine the most appropriate exploits to attempt. The exploit must be configured with relevant information such as the target IP address. Next, you must select a payload. The payload might be remote shell access, Virtual Network Computing (VNC) access, or remote file downloads. You can add exploits incrementally. Metasploit exploits are often published with or shortly after the public disclosure of vulnerabilities.Metasploit：Metasploit 剛推出時，對網路安全產業造成了很大的衝擊，成為滲透測試人員工具箱中相當強大的一項工具。它不僅為進階資安工程師提供了開發與測試利用程式碼的框架，也降低了新手攻擊者執行複雜攻擊所需的經驗門檻。該框架將利用程式碼（exploit，利用系統弱點的程式碼）與酬載（payload，注入到已入侵系統的程式碼）分開。此框架隨附數百個利用模組與數十個酬載模組。若要使用 Metasploit 發動攻擊，你必須先選擇並設定一個利用程式碼。每個利用程式碼都鎖定未修補作業系統或應用程式伺服器的某項弱點。使用弱點掃描程式有助於判斷哪些利用程式碼最為合適。利用程式碼必須設定相關資訊，例如目標 IP 位址。接著，你必須選擇一個酬載。酬載可能是遠端命令列存取、虛擬網路運算（VNC）存取，或遠端檔案下載。你可以逐步新增利用程式碼。Metasploit 的利用程式碼通常在弱點公開揭露的同時或稍後不久便發佈。
Which option lowered the threshold of experience that is required for a novice attacker to perform sophisticated attacks?下列哪個選項降低了新手攻擊者執行複雜攻擊所需的經驗門檻？