Security tooling has exploded over the last decade – there are hundreds of tools covering every phase of a penetration test or security assessment. This roundup focuses on the tools that actually matter: the ones with staying power, active development, and real-world use across reconnaissance, scanning, exploitation, post-exploitation, and analysis. Whether you’re preparing for OSCP, doing bug bounty work, or just building out your home security lab, these are the tools worth knowing.
Reconnaissance
Nmap – The essential network scanner. Host discovery, port scanning, service version detection, and OS fingerprinting. The Nmap Scripting Engine (NSE) extends it massively – there are scripts for vulnerability detection, brute forcing, and service enumeration. Learn the flags: -sV, -sC, -A, -p-, -T4.
theHarvester – OSINT tool for gathering emails, subdomains, hosts, and employee names from public sources. Integrates with Google, Bing, LinkedIn, Shodan, and more. Useful for external reconnaissance before touching any live systems.
Shodan – A search engine for internet-connected devices. Find exposed services, industrial control systems, webcams, and misconfigured infrastructure without sending a single packet to the target. The API is where the real power is – query it programmatically as part of your recon pipeline.
Sublist3r – Subdomain enumeration using multiple sources including Google, Bing, Virustotal, and DNSdumpster. Pair it with Amass for thorough subdomain discovery on external assessments.
Scanning and enumeration
Nikto – Actually, Nikto – a web server scanner that checks for outdated software, dangerous files, misconfigurations, and known vulnerabilities. Not subtle (it’ll appear in logs), but excellent for a quick health check of a web target.
WPScan – The definitive WordPress security scanner. Enumerates users, plugins, themes, and known vulnerabilities. Essential if you’re assessing any WordPress installation. Free for non-commercial use; the vulnerability database feed requires an API key.
Gobuster – Directory and file brute-forcing tool written in Go. Fast and reliable for discovering hidden endpoints, backup files, and admin panels. Pair it with SecLists for comprehensive wordlists covering every common web path.
Hydra – Network login brute-forcer supporting dozens of protocols: SSH, FTP, HTTP, SMB, RDP, and more. Useful for testing weak credentials on exposed services. Always ensure you have explicit authorisation – this one’s loud and will be noticed.
Exploitation frameworks
Metasploit Framework – The exploitation framework. A vast library of exploits, payloads, and post-exploitation modules. msfconsole is the primary interface – search for modules, configure options, run exploits, and manage sessions. The community edition is free; Metasploit Pro adds automation and reporting.
sqlmap – Automated SQL injection detection and exploitation. Point it at a URL with parameters and it’ll identify injectable points, enumerate databases, extract data, and in some cases escalate to OS-level access. Covers MySQL, PostgreSQL, MSSQL, Oracle, and more.
OWASP ZAP – A web application security scanner and intercepting proxy. Good alternative to Burp Suite for web app testing – active scanning, spidering, fuzzing, and a scriptable API. Free and open source.
Burp Suite – The professional standard for web application testing. The Community edition covers the core proxy, repeater, and scanner. Professional adds the full active scanner, Intruder without rate-limiting, and Collaborator. Worth the price if you’re doing serious web app work.
Password and credential tools
John the Ripper – Password cracker supporting hundreds of hash types. Good for offline cracking of captured hashes. The Jumbo community patch adds formats and features beyond the core release.
Hashcat – GPU-accelerated password cracker. Significantly faster than John for large wordlists when you have a capable GPU. Supports rule-based attacks, combination attacks, and mask attacks. Pair with the rockyou.txt wordlist to start.
Post-exploitation and lateral movement
PowerSploit – A collection of PowerShell modules for post-exploitation on Windows targets. Covers privilege escalation, credential harvesting, persistence, and code execution. Understanding these techniques is equally useful for defenders.
BloodHound – Active Directory attack path analysis. Maps AD relationships and identifies privilege escalation paths that would take hours to find manually. An eye-opener for anyone who thinks their AD is clean.
Mimikatz – Windows credential extraction tool. Used to understand how attackers harvest credentials from memory, LSASS, and the registry. Important context for defenders and red teamers alike.
Traffic analysis and wireless
Wireshark – Packet capture and analysis. Indispensable for understanding what’s happening on the wire. Useful in CTFs for finding cleartext credentials, analysing protocols, and understanding network behaviour.
Aircrack-ng – Wireless network security toolkit. WEP and WPA/WPA2 cracking, packet capture, and injection. Requires a wireless adapter that supports monitor mode – the Alfa AWUS036ACH is a common choice.
Reporting and documentation
PwnDoc – Open source pentest reporting tool. Collaborative, template-driven, and produces professional Word document reports. A good choice for anyone doing regular assessments who wants to standardise their output.
Notion or Obsidian – Many pentesters use a personal knowledge base to track findings, commands, and methodology notes during engagements. Obsidian is popular for its local-first approach and Markdown support.
Where to practise
Tools without targets to practise on aren’t much use. The best legal practice environments:
- Hack The Box – Realistic lab machines with active community writeups after machines retire
- TryHackMe – More guided, good for beginners building foundational skills
- VulnHub – Downloadable vulnerable VMs for fully offline practice
- PortSwigger Web Security Academy – The best free resource for web application security, bar none
The tools are only as good as your understanding of what you’re looking for. Time in the labs matters more than accumulating tools.
Leave a Reply
You must be logged in to post a comment.