Tool Penetration Testing: A Complete Guide to the Attack Phase"

This guide collects all the offensive tools used in penetration testing, organized by attack phase—not alphabetically. From OSINT recon to exploitation, from AD lateral movement to pivoting on segmented networks. Each tool has its own context, its own moment, its own real-world use case. Each phase of a penetration test has its own tools. Nmap is useless if you don't know how to read the output. Mimikatz doesn't work without the right privileges. BloodHound is useless if you haven't first enumerated the domain. Choosing the wrong tool at the wrong time is the main cause of failed engagements and incomplete labs.

The operational reference for those preparing OSCP, OSEP, working on HTB, or performing red team engagements. For the services exposed on each port and their associated vectors, see the Complete Guide to TCP/UDP Ports in Penetration Testing.

Recon → Scanning → Enumeration → Exploitation → Post-Exploitation → Pivoting → Exfiltration

Top Offensive Toolkit 80/20 #

If you're just starting out or preparing for OSCP, these are the 10 tools that cover 80% of real-world scenarios. Learn them before anything else.

NetExec vs CrackMapExec: NetExec is an active fork of CrackMapExec, developed by the community after the original project was abandoned. It uses the same basic syntax, but NetExec is more up-to-date. Use NetExec for new engagements, and CME if you follow documentation that references it.

Index #

• Recon & OSINT
• Network Scanning & Discovery
• Web Application Testing
• Exploitation
• Brute Force & Credentials
• Active Directory & Windows
• Linux Post-Exploitation & PrivEsc
• Pivoting & Tunneling
• Sniffing & MITM
• Social Engineering & Phishing
• Cloud & Infrastructure
• LOLBins & Native Windows Tools
• Real Attack Chains
• Related Hubs

Recon & OSINT #

Before you hit the target, gather everything you can from public sources. Subdomains, emails, technologies, employees, cloud infrastructure—anything that reduces noise in the next phase and increases your known attack surface.

Network Scanning & Discovery #

Once the OSINT perimeter is identified, you map the infrastructure. The goal is to find all active hosts, all open ports, and all exposed services. Nmap is the hub—the others complement it for specific speeds or protocols.

Web Application Testing #

Once the web services are found, every surface is tested: hidden directories, vulnerable parameters, injection points, weak authentication. The FFUF + Burp Suite combo covers 90% of cases.

Exploitation #

Once the vulnerability is identified, you move on to exploitation. Metasploit handles standardized cases. For custom vulnerabilities or hardened environments, combine SearchSploit with manual exploits and public PoCs.

Brute Force & Credentials #

When exploits aren't available, weak credentials are often the way to go. Hydra covers almost all protocols in online mode. Hashcat is for offline cracking of captured hashes.

Active Directory & Windows #

The densest cluster. In an AD engagement, you use these tools sequentially: enumeration with BloodHound and Enum4linux, Kerberos attacks with Rubeus, lateral movement with NetExec and Impacket, and credential dumps with Mimikatz.

Linux Post-Exploitation & PrivEsc #

Once you've got a Linux shell, the goal is to become root. LinPEAS automates the search for vectors, while GTFOBins tells you how to exploit them. Pspy monitors processes in real time without root—this is often the way to discover cron jobs with elevated privileges.

Pivoting & Tunneling #

Within the network, you need to reach segments that aren't directly accessible. Chisel and socat are the most commonly used in HTB labs. SSHuttle is the most transparent in real-world environments. ProxyChains routes existing tools through the tunnel without modifying them.

Sniffing & MITM #

On the LAN, unencrypted traffic is an immediate source of credentials. Responder poisons the network and automatically captures NTLM hashes. Wireshark and tcpdump analyze traffic. Ettercap and Bettercap handle full MITM attacks with real-time packet modification.

Social Engineering & Phishing #

When there are no exploitable technical vulnerabilities, the attack goes through people. GoPhish manages comprehensive phishing campaigns with tracking. EvilGinx2 captures credentials and session cookies, bypassing MFA.

Cloud & Infrastructure #

Misconfigured cloud environments expose public S3 buckets, overly privileged IAM roles, and unauthenticated APIs. These tools automate the detection of these vectors across AWS, Azure, and GCP.

LOLBins & Native Windows Tools #

Native Windows tools are the stealthiest: already present on the system, designed by Microsoft, and rarely blocked by AV/EDR. Always use them before downloading external tools to the target—less noise, fewer traces, less detection.

Real Attack Chains #

The tools aren't used in isolation. These are the most common chains you'll encounter in real-world environments, ProLab HTB, and OSCP assessments.

Chain 1 — External Recon → Web RCE #

Amass / Subfinder     →  Enumerazione subdomini
HTTPX                 →  Probe HTTP su tutti i subdomini trovati
Nmap                  →  Port scan + version detection sui target vivi
Nikto / Nuclei        →  Scan automatico vulnerabilità web note
FFUF                  →  Directory brute force, parameter fuzzing
Burp Suite            →  Analisi manuale, intercept, injection test
SQLmap / Commix       →  Exploitation — dump DB o OS shell
Weevely3              →  Webshell persistente per post-exploitation

Chain 2 — AD Attack Chain (from LAN network) #

Nmap                  →  Identifica DC, host Windows, porte AD aperte
Enum4linux-ng         →  Null session — utenti, share, policy dominio
Responder             →  LLMNR/NBT-NS poisoning → cattura NTLMv2 hash
Hashcat               →  Crack hash offline con wordlist
NetExec               →  Valida credenziali, password spray, enumera rete
BloodHound            →  Mappa attack path — trova percorso verso DA
Rubeus                →  Kerberoasting → hash account servizio
Hashcat               →  Crack hash Kerberos offline
Impacket secretsdump  →  DCSync → dump tutti gli hash del dominio
Mimikatz              →  Golden Ticket / credenziali da LSASS
Domain Admin          ✅

Chain 3 — Linux Post-Exploitation #

Shell iniziale        →  whoami, id, uname -a, ip a
LinPEAS               →  Enumera tutto — SUID, cron, sudo, capability
Pspy                  →  Monitora processi — trova cron job root
GTFOBins              →  Identifica binario sfruttabile per privesc
Getcap                →  Controlla capabilities — python3, perl, openssl
Root                  ✅
MimiPenguin           →  Dump credenziali da memoria
Chisel + ProxyChains  →  Pivoting verso subnet interna

Chain 4 — Internal Windows Lateral Movement #

Nmap                  →  Mappa rete interna — host Windows attivi
CrackMapExec          →  Verifica accesso su tutti gli host
SMBmap / SMBclient    →  Enumera share — cerca file con credenziali
Pass-the-Hash         →  Usa NTLM hash senza password in chiaro
Evil-WinRM            →  Shell su host via WinRM (5985)
WinPEAS / Seatbelt    →  Enumera privesc locale
SharpDPAPI            →  Dump credenziali salvate — browser, Windows
Mimikatz              →  Dump LSASS — NTLM hash e ticket Kerberos
BloodHound            →  Aggiorna attack path con nuove credenziali
Lateral movement      →  Ripeti fino a Domain Admin ✅

Related Hubs #

For professional penetration testing on real infrastructures, discover HackIta's services.