Tools & Commands

Tools are the easiest part of the discipline to list and the least of what makes a tester effective — knowing which one to reach for, and reading its output correctly, is the skill. This page is organised by phase, in the format that actually helps: what the command does, what the output means, and what it sets up next.

Authorized targets only

Everything here is for systems you have written permission to test — engagements, your own labs, CTFs. Versions and flags change; treat this as orientation and verify against current documentation.

Recon and enumeration

nmap -sV -sC -p- <target> — full TCP port sweep with version detection and default scripts. Output: open ports, service versions, script findings. Next: version strings drive the vulnerability hypothesis; unexpected open ports are often the finding. -p- is slow — scan top ports first, then all ports in the background.

httpx -l hosts.txt -sc -title -tech-detect — probe a host list for live web services. Output: status, title, detected technology per host. Next: the technology fingerprint shapes which attacks are plausible; titles reveal admin panels and forgotten apps.

ffuf -w wordlist -u https://target/FUZZ -mc 200,301,403 — content and directory discovery. Output: paths that exist, by status code. Next: 403 is as interesting as 200 — it means present-but-forbidden, a boundary worth pushing. Filter by response size to cut the wildcard noise.

For subdomains, amass enum -passive -d target.com and subfinder -d target.com build the external surface. Passive first: it touches no target infrastructure and so carries less OPSEC risk.

Web testing

Burp Suite is the workbench — intercepting proxy, repeater for hand-crafting requests, intruder for automation. Most manual web testing happens here, and the skill is in Repeater, not the scanner.

sqlmap -u "https://target/item?id=1" --batch --dbs — confirm and exploit SQL injection. Output: injectable parameters, DBMS, databases. Next: confirms and demonstrates impact. Loud and heavy — good for a lab or an authorized demonstration of impact, poor for a stealthy engagement. Start with --level/--risk low.

nuclei -u https://target -t <templates> — template-based checks for known issues. Output: matched templates with severity. Next: fast triage of known-vulnerable components; verify every hit by hand before it goes in a report.

Cloud

scout suite <provider> / prowler — posture assessment across an account. Output: misconfigurations against a benchmark. Next: orientation and the shortlist of weak spots. This is posture, not exploitation — the findings are candidates.

pacu — AWS exploitation framework. Output: enumeration and privesc modules against a foothold. Next: where an AWS engagement lives after you have a credential — enumerate permissions, then test escalation chains.

ROADrecon (Entra) and AzureHound map the Azure/Entra graph; cloudsplaining reads IAM policies for risk. Enumeration and analysis, not exploitation — they build the map you then find paths through.

Active Directory and identity

BloodHound ingests directory data and computes attack paths to high-value targets. Output: a graph, with shortest paths to Domain Admin. Next: the canonical AD escalation tool — it turns a mess of ACLs into a route. The collectors are noisy; collection method is an OPSEC decision.

netexec (formerly CrackMapExec) — swiss-army knife across SMB/WinRM/LDAP and more. Output: auth results, shares, sessions across a host list. Next: spraying, credential validation, and post-credential enumeration at scale. Account lockout is a real risk — know the policy before spraying.

Impacket — a suite of scriptable protocol tools (secretsdump, psexec, ntlmrelayx and more) that implement the primitives most AD attacks are built from.

C2 and post-exploitation

Sliver, Havoc and Mythic are open-source command-and-control frameworks: implant generation, session management, and post-exploitation tasking. Output: managed sessions on compromised hosts. Next: red team territory, where infrastructure and OPSEC matter more than the framework choice. This is dual-use tooling — covered here for authorized engagements and for the defenders who must detect it.

The judgement the list can’t give you

Which tool, and how loud, is the actual decision:

• Passive before active. Every active tool touches the target and may be logged.
• Loud has a place. In a pentest with detection out of scope, run the noisy efficient tool. In a red team engagement, that same tool ends the exercise.
• Read the output, don’t just collect it. A tool that reports “no findings” against a surface you know is vulnerable is misconfigured, not authoritative.
• Everything you run is detectable. Which of your actions were caught is itself a finding — see detection quality.

Where this connects

These tools execute the methods in web and cloud testing. Their detectability is the raw material of purple teaming, and how loud to be is set by the engagement type.