There is no law in Hong Kong which specifically forbidden penetration testing software (as in forbidding firearms). However there are some related laws which you may want to be aware of:
Chapter 106 Section 27A:
Any person who, by telecommunications, knowingly causes a computer to
perform any function to obtain unauthorized access to any program or
data held in a computer commits an offence (...)
Which in laymen terms, is "hacking".
The key point here is "unauthorized". As long as you have obtained permission to perform penetration testing, you will be okay.
Then, there is this "catch all" clause in Chapter 200 Section 59. They usually use this to prosecute somebody on computer-related crimes if they cannot locate a specific law:
(...) to cause a computer to function other than as it has been
established to function by or on behalf of its owner (...)
Penetration testing should always be conducted after the owner has agreed anyway. No license is required to conduct such activities.