Pentest & Red Team Tools
Reconnaissance, web applications, Active Directory and post-exploitation: the most widely used penetration testing tools, to be used only within an authorized scope.
Using these tools against a system without written authorization is a criminal offense in most countries (e.g. Articles 323-1 et seq. of the French Criminal Code). Require a signed engagement letter stating scope, dates and contacts.
Nmap
Host, port and service discovery, with the NSE scripting engine.
Windows, macOS, Linux
Official websiteNuclei
Vulnerability scanner driven by community-maintained YAML templates.
Windows, macOS, Linux
Official websiteBurp Suite
The reference intercepting proxy for web application testing; the Pro version adds the scanner.
Windows, macOS, Linux
Official websiteZAP
Open source web proxy and scanner, easy to integrate into a CI/CD pipeline.
Windows, macOS, Linux
Official websiteffuf
Very fast web fuzzer to discover directories, parameters and virtual hosts.
Windows, macOS, Linux
Official websitesqlmap
Automated detection and exploitation of SQL injection.
Python
Official websiteMetasploit Framework
Rapid7’s exploitation framework: exploit modules, payloads and post-exploitation.
Windows, macOS, Linux
Official websiteBloodHound
Maps Active Directory relationships as a graph to find privilege escalation paths.
Web (Docker)
Official websiteNetExec
CrackMapExec’s successor: mass authentication testing and enumeration over SMB, LDAP, WinRM, MSSQL…
Linux, macOS, Windows
Official websiteImpacket
Python library and scripts (secretsdump, psexec, GetUserSPNs…) for Windows protocols.
Python
Official websiteResponder
Poisons LLMNR/NBT-NS/mDNS to capture NTLM hashes on a local network.
Linux
Official websiteSliver
Bishop Fox’s open source command-and-control framework, used in Red Team exercises.
Windows, macOS, Linux
Official website