tools of the trade

What are we using for pentesting lainons? vulnerability analysis? open source all-in-one intercept devices like pwny? this is a thread for what to use, how to build, and interesting projects.

Metasploit is a pretty good all in one tool/framework maltigo is a pretty good recon and network mapping tool recon-ng - metasploit but for OSINT only burbsuite/zap/paros - intercepting proxies for web app

>>638 straight up, Kali MATE yeah yeah, roll your own distro. I know I should but I'm lazy and kali has most of what I need right out of the box except it NEVER HAS THE fuarrrkING KERNEL HEADERS RIGHT FOR VMWARE-TOOLS Which is why I've moved on to other floss/non-bad-software virtualization solutions and host to VM sharing.

>>644 problem with headers exists only in kali rolling, which burps ''rolling" instead of kernel version on uname - r command

nmap mostly tbh big fan of nikto aswell

>>638 WEB APP STUFF Burp Suite is pretty much the de-facto standard intercepting proxy for web application hacking these days, and intercepting mobile app soykaf and the like. OWASP ZAP is free, but the active scanner in Burp is orders of magnitude more superior. Nikto and dirbuster and hoppy are useful "dumb" application scanning tools; they're unlikely to do more than uncover an interesting directory or two on an oldschool, LAMP-style site, and are almost entirely useless against a lot of modern frameworks, but they can be handy on embedded devices, too. There's also commix, sqlmap, and fimap, for exploiting various kinds of code injection attacks. My experience with w3af is it's a piece of soykaf, and I don't know anyone competent who uses it, but feel free to give it a go.

>>2103 INFRASTRUCTURE/NETWORK STUFF Obviously nmap, though I will state than nmap is not particularly portable these days (compiling it can be a time-consuming endeavour if you're doing anything non-standard), so one should investigate alternative portscanners if you're going to end up on a box that you'll have to drop tools on; I'll leave that up as an exercise to the reader. Metasploit is a piece of soykaf, with broken modules and a vast array of out-of-date exploits, but some of the auxiliary modules are useful, and meterpreter can be a godsend on Windows if you're not particularly comfortable operating in a command-line environment there, or you can't easily drop other tools on the machine. Responder is great for any Windows networks, as long as you don't get too careless and fuarrrk the entire network completely. Netcat and socat are always useful to have in any situation. You won't use it often, or have much success, but a good bruteforcing tool is always important to have around. (hydra is probably the most comprehensive). Scapy (or some other socket library that gives you a lot of control) is always useful to have, but requires some level of competence with programming.

>>2104 Backdoors/Persistence/Post-exploitation Weevely is the only thing you should be using as a PHP backdoor. There's nothing comparable for ASP/JSP/CFM as far as I'm aware, but plenty of soykafty shells that'll do. Powersploit is good for post-exploitation, and Empire is excellent. Pupy is a fairly functional multi-platform implant framework, but I'll warn you; while I believe it has some comments along the lines of being forensically resistant, it's really not. If you're incompetent with Linux, there's a whole bunch of Linux exploit suggesting tools out there; if you do use these, I'd recommend you learn some soykaf instead.

>>2105 Reverse Engineering objdump for linear sweep disassembly, radare2 for debugging and recursive traversal. Despite what people seem to do, you can't just throw a binary into IDA Pro and expect the best, especially not if you're looking at competent malware. Not that there's much out there. Procyon for decompiling Java, and there's a bunch of .NET decompilers out there, so take your pick. I think monoedit or some soykaf is fairly alright on Linux. Hexedit for, well, hex editing. Strace for tracing syscalls (obviously).

>>2106 I'm bored now, but if people have more specific questions or whatever, shoot.

nmap kali scapy metasploit ...and telephone

I just gave a shot to the blackarch repo and really liked it. Far better and more organized than Kali. This + archstrike repo + aur and I feel like I've unlimited software on my fingertips.

>>2106 IDA has the best dissassembler to this day. Binary Ninja is a good option too. Radare takes reading a whole book to learn, and you spend a lot of time trying to figure out what to do. Also the dependencies on that thing. Fuuuuk.

>>2871 I love radare. Until they come up with a stable option for GUI debugging, it makes no sense to even try to use it. The webapps are el garbagio Learn the CLI and you'll never use anything else. Maybe. Probably not.

>>2873 Radare2, gdbpeda, angr, pwntools here Would use IDA Pro beceause of HexRays but it is too expensive :D What software would you recommend for reverse engineering and exploit development for Windows OS? I've tried Olly and x64 debuggers once but they seem inelegant to me, is WindDbg worth to learn? I've seen it got decent GUI for Win10 recently. Or maybe just radare2 for windows?

>>2873 Ever use Geohots reverse debugger thing? It's actually kind of magic.

>>2109 >telefone probably the best if your skilled in se

>>2103 >>2107 How do you feel about Fuzzers?