In the popular cybersecurity breakdown "A to Z Bug Bounty Hunting Tools! (HACKING)" by Hacker Joe (based on Satya Prakash's curated 0xKayala/BugBountyTools repository), dozens of essential tools are surveyed across eleven testing categories.
For researchers running penetration testing environments—especially inside virtual machines on 256 GB laptops—blindly installing every tool is a quick way to run out of disk space.
Before running apt install or go install, we performed a category-by-category storage audit, calculating the exact disk footprint of every tool in the video, separating lean essentials from high-disk bloat, and sizing the optimal Kali Linux ARM64 virtual disk.
1. Quick Storage Reality: How Much Space Will It Take?
Installing the entire A-to-Z collection unconstrained will consume ~20+ GB inside a virtual machine (on top of Kali's 12 GB base OS). However, categorizing the tools reveals that 80% of the weight comes from heavy wordlists, local vulnerability DBs, and mobile emulation runtimes.
+-------------------------------------------------------------+ | Kali Base OS (12 GB) | Core Web/Recon (5.5 GB) | Heavy (14 GB) | +-------------------------------------------------------------+ | LEAN STACK (~18 GB) | +-------------------------+ | FULL A-Z ARSENAL (~32-34 GB) | +-------------------------------------+ | Setup Tier | VM Disk Consumed | What It Includes | Recommended For |
|---|---|---|---|
| Tier 1: Core Web & Recon | ~5.5 GB | ProjectDiscovery suite, Burp Suite, ffuf, SQLmap, targeted SecLists | 95% of HackerOne & Intigriti web/API targets |
| Tier 2: Full Web + Cloud + API | ~11.0 GB | Adds Kiterunner datasets, Postman, Pacu, ScoutSuite, nuclei-templates | Comprehensive cloud & enterprise API audits |
| Tier 3: The Complete A-to-Z | ~19.5 GB to 22.0 GB | Adds Metasploit Framework, MobSF/Frida runtimes, full uncompressed SecLists | Full-scope labs, mobile reversing & network testing |
2. Category-by-Category Tool Inventory & Sizing
Here is the exact breakdown of every tool covered in the video and repository, grouped by offensive discipline:
A. Reconnaissance & Subdomain Enumeration
Tools for mapping attack surfaces, dark-archive URLs, and domain assets:
| Tool | Language / Packaging | Estimated Disk Size | Primary Function |
|---|---|---|---|
| Subfinder | Go (Single binary) | ~32 MB | Passive multi-source subdomain discovery |
| Amass | Go + SQLite DB | ~120 MB | Active/passive DNS enumeration & network mapping |
| Assetfinder | Go (Single binary) | ~15 MB | Fast domain and asset correlation |
| Katana | Go (Single binary) | ~30 MB | Next-gen crawling & JavaScript spidering |
| Hakrawler | Go (Single binary) | ~15 MB | Fast endpoint crawling |
| Gauplus / Gau | Go (Single binary) | ~20 MB | Fetch URLs from AlienVault, Wayback, CommonCrawl |
| Waybackurls | Go (Single binary) | ~15 MB | Historical URL extraction from Wayback Machine |
| Findomain | Rust (Single binary) | ~25 MB | High-speed multi-threaded domain reconnaissance |
| ParamSpider | Python + Dependencies | ~55 MB | Mining parameters from web archives for fuzzing |
| Sublist3r | Python | ~35 MB | Search-engine-based subdomain enumeration |
| Knockpy | Python | ~45 MB | Dictionary-based subdomain discovery |
| Chaos | Go (Single binary) | ~20 MB | Querying ProjectDiscovery’s Chaos bounty dataset |
| Subtotal | ~427 MB | High-yield, extremely lightweight |
B. Web Application Testing & Scanners
Manual interception, parameter manipulation, and targeted scanners:
| Tool | Language / Packaging | Estimated Disk Size | Primary Function |
|---|---|---|---|
| Burp Suite Community | Java (JAR + bundled JRE) | ~750 MB | Industry-standard web security interception proxy |
| OWASP ZAP | Java | ~400 MB | Open-source proxy, active scanner & fuzzer |
| Nuclei | Go binary (~45 MB) | ~45 MB | Fast template-based vulnerability scanner |
| Nuclei Templates | Git Repository | ~1,200 MB | 8,000+ community CVE/misconfiguration signatures |
| SQLmap | Python | ~110 MB | Automated SQL injection detection & exploitation |
| XSStrike | Python | ~45 MB | Intelligent XSS scanner with payload generator |
| Dalfox | Go (Single binary) | ~35 MB | Dedicated DOM/Reflected XSS scanner & analyzer |
| Kxss | Go (Single binary) | ~15 MB | Checks reflected characters in URL parameters |
| CRLFuzz | Go (Single binary) | ~20 MB | Scans for HTTP response splitting / CRLF injection |
| Nikto | Perl | ~50 MB | Web server misconfiguration scanner |
| WhatWeb | Ruby | ~30 MB | Web technology stack and CMS identifier |
| Subtotal | ~2,700 MB (2.7 GB) | Nuclei templates account for nearly half |
C. API Security Testing
Probing REST, GraphQL, SOAP, and token authentication architectures:
| Tool | Language / Packaging | Estimated Disk Size | Primary Function |
|---|---|---|---|
| Postman | Electron Application | ~450 MB | GUI-based API exploration and mock testing |
| Kiterunner | Go binary (~40 MB) | ~40 MB | Content-aware API endpoint brute forcing |
| Kiterunner Wordlists | Assetnote Datasets | ~800 MB | Pre-compiled JSON route graphs (routes-large.kite) |
| JWT_Tool | Python | ~35 MB | Tampering, cracking, and forging JSON Web Tokens |
| GraphQLmap | Python | ~30 MB | Testing GraphQL injection, introspection, and mutations |
| NoSQLMap | Python | ~50 MB | Automated MongoDB/NoSQL injection testing |
| Subtotal | ~1,405 MB (1.4 GB) | High impact for modern API bug bounties |
D. Fuzzing Tools
High-throughput path, parameter, and header brute forcing:
| Tool | Language / Packaging | Estimated Disk Size | Primary Function |
|---|---|---|---|
| ffuf | Go (Single binary) | ~25 MB | Ultra-fast HTTP fuzzer with filter recursion |
| Gobuster | Go (Single binary) | ~30 MB | Directory, DNS, and vhost brute-forcer |
| Dirsearch | Python | ~60 MB | Classic advanced web path scanner |
| Wfuzz | Python + PyCurl | ~45 MB | Modular web application fuzzing framework |
| Subtotal | ~160 MB | Tiny footprint, massive utility |
E. Network & Port Scanning
Infrastructure mapping and open service discovery:
| Tool | Language / Packaging | Estimated Disk Size | Primary Function |
|---|---|---|---|
| Nmap | C/C++ + Lua NSE scripts | ~80 MB | Host discovery and detailed service fingerprinting |
| Masscan | C | ~25 MB | Asynchronous Internet-scale TCP port scanner |
| RustScan | Rust (Single binary) | ~20 MB | Fast adaptive port scanner piped to Nmap |
| Zmap | C | ~30 MB | High-speed single-packet network scanner |
| NetFuzzer | Python | ~50 MB | Network assessment and automation framework |
| Subtotal | ~205 MB | Native and lightweight |
F. Heavy Exploitation, Cloud & Mobile Frameworks
Specialized tools with higher system demands:
| Tool | Language / Packaging | Estimated Disk Size | Primary Function |
|---|---|---|---|
| Metasploit Framework | Ruby + PostgreSQL + Gems | ~2,200 MB (2.2 GB) | World’s most used penetration testing framework |
| Commix | Python | ~40 MB | Automated command injection exploitation |
| RouterSploit | Python | ~60 MB | Embedded device and IoT vulnerability scanner |
| Cloud Suite | Python (Pacu, ScoutSuite, CloudBrute) | ~1,100 MB (1.1 GB) | Multi-cloud IAM and security configuration auditing |
| Mobile Suite | MobSF, Frida, Objection, APKTool | ~2,150 MB (2.15 GB) | Static & dynamic Android/iOS APK reverse engineering |
| Subtotal | ~5,550 MB (5.55 GB) | Only install if targeting mobile or cloud apps |
G. Wordlists & Dictionaries (The Invisible Space Hog)
Wordlists are where developers accidentally waste 10–15 GB:
| Dataset | Size Compressed | Size Uncompressed | Strategy |
|---|---|---|---|
| SecLists (Full) | ~1.8 GB | ~8.5 GB | Do not extract everything. Keep zipped and extract only needed lists. |
| RockYou.txt | ~135 MB | ~400 MB | Keep rockyou.txt.gz intact until cracking hashes. |
| Essential Subset | — | ~65 MB | Extract only raft-medium-directories.txt and subdomains-top1million-110000.txt. |
3. Recommended Kali Installation Strategy
If you are setting up a virtual machine on a MacBook (e.g., using UTM on Apple Silicon), here is how to install these tools cleanly without bloat:
Step 1: Create a 35 GB Dynamic Disk in UTM
- Set virtual disk size to 35 GB.
- Do NOT pre-allocate disk space.
- The VM will only take ~12 GB initially and will expand gradually as you install tools.
Step 2: One-Liner Fast Install for Tier 1 Tools
Inside your Kali terminal, install the core Go suite and essential scanners:
# 1. Update package manager and install base tools sudo apt update && sudo apt install -y golang nmap sqlmap ffuf nikto seclists # 2. Configure Go environment echo 'export GOPATH=$HOME/go' >> ~/.zshrc echo 'export PATH=$PATH:$GOROOT/bin:$GOPATH/bin' >> ~/.zshrc source ~/.zshrc # 3. Install the high-yield ProjectDiscovery and Go recon arsenal go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest go install -v github.com/projectdiscovery/katana/cmd/katana@latest go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latest go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest go install -v github.com/tomnomnom/assetfinder@latest go install -v github.com/tomnomnom/waybackurls@latest go install -v github.com/bp0lr/gauplus@latest go install -v github.com/hahwul/dalfox/v2@latest # 4. Download initial Nuclei templates nuclei -update-templates Result:
- Total disk consumed: ~5.5 GB
- Capabilities: Subdomain discovery, fast HTTP probing, automated crawling, parameter extraction, XSS validation, SQL injection testing, and template-based vulnerability scanning.
- Remaining Free Space on Host: Plentiful buffer for macOS swap and APFS snapshots.
Conclusion
The "A to Z" toolkit offers an incredible spectrum of offensive capabilities, but smart bug bounty hunters optimize their environment:
- Prioritize single-binary Go utilities (
subfinder,katana,nuclei,ffuf) for maximum speed and negligible disk overhead. - Avoid extracting massive 8+ GB wordlist archives when 65 MB curated lists cover 95% of target endpoints.
- Leverage dynamic virtual disk allocation so your machine only uses storage when needed.
