The Armory

The tools I actually reach for on a test, grouped by what they’re for, with honest notes on where each one shines and where it falls down.

Web

The proxy most web testing runs through.

Fast web fuzzer for content and parameter discovery.

WordPress-focused scanner.

Template-driven scanner with a huge community library.

Port and service discovery. Usually the first thing a test runs.

SMB enumeration of Windows/Samba hosts.

Checks a server’s SSL/TLS configuration.

Maps AD attack paths to high-value targets.

Sweep networks to check creds and run actions at scale.

Captures hashes by answering LLMNR/NBT-NS.

A swiss-army toolkit for AD and network protocols.

A Kerberos toolkit for ticket abuse.

PowerShell recon for Active Directory.

A menu-driven wrapper for wifi auditing.

Automates attacking nearby wifi networks.

Offline password crackers. Each has its strengths.

Commercial vulnerability scanner.

Exploitation framework. I reach for it rarely.

Reference lists for living off the land.