Tools
& field notes

Finds which ports are open on a target and which services and versions run on them. Its NSE scripting engine adds service-specific checks.

At the very start of every in-scope network test. I don't move on before mapping the attack surface.

• RustScan
• Masscan
• Naabu

Captures network traffic and decodes hundreds of protocols into a readable form. It shows what an application actually says on the wire.

When learning how a protocol works, looking for unencrypted traffic or verifying what a tool actually sends.

• tcpdump
• tshark

A proxy that sits between browser and server. It intercepts, modifies and replays requests (Repeater), automates them (Intruder) and is extensible with add-ons.

In every web and API test. I first browse the app like a normal user to collect HTTP history, then dig into interesting requests one by one in Repeater.

• ZAP
• Caido
• mitmproxy

An intercepting proxy similar to Burp, plus passive/active scanning and ready-made automation for CI/CD pipelines.

When I need free automated scanning or want to add baseline security checks to a pipeline.

• Burp Suite

Replaces the FUZZ keyword in a URL, parameter, header or body with a wordlist to find hidden directories, files, parameters and virtual hosts.

When discovering parts of an app that aren't linked anywhere, especially old endpoints and backup files.

• Feroxbuster
• Gobuster
• Dirsearch

Takes a list of hosts and finds which serve HTTP(S), collecting status code, title, technologies and server info.

Right after building a subdomain list, to decide which targets deserve attention.

• httprobe

Collects a domain's subdomains from certificate logs and public sources without touching the target.

As the first recon step in bug bounty when the scope is wide (*.target.com).

• Amass
• assetfinder

Runs thousands of checks defined as YAML templates (known CVEs, misconfigurations, exposed panels) against targets at speed.

To quickly sweep a large host list for known issues; before manual testing, not instead of it.

• ZAP
• Nikto

Automatically tests whether a parameter is vulnerable to SQL injection and verifies what it finds.

To confirm a parameter I already suspect by hand; I don't blindly run it against every parameter.

• ghauri

Organises API requests into collections; environment variables, auth helpers and test scripts make it easy to explore APIs systematically.

If an API has docs (OpenAPI/Swagger) I import them and walk every endpoint, testing BOLA and authorisation with different user tokens.

• Insomnia
• Bruno

A framework bringing scanning, verification and post-exploitation modules into one console. Used for controlled verification of known vulnerabilities.

In lab environments (HTB, THM) and authorised tests when verifying a known vulnerability.

• Sliver
• Havoc

Models users, groups, computers and permissions in Active Directory as a graph and visualises privilege paths.

In AD labs to understand the environment; defenders use it too, to find unnecessary privilege chains.

• PingCastle
• ADExplorer

A Debian-based distribution with hundreds of security tools preinstalled. Runs as a VM or under WSL.

The base of my testing machine. I start every project from a clean snapshot.

• Parrot OS
• Exegol