Overview

This section provides operational guidance for the core tools used throughout offensive engagements. Each tool page focuses on how the tool supports decision-making and execution across the attack lifecycle, not on exhaustive feature documentation.

Strategic context

Tools are a means to an end. The value of any tool comes from knowing when to use it, what it does, and how its output guides the next decision. Tool proficiency without operational context produces noisy engagements with shallow results. Operational thinking backed by tool proficiency produces controlled, effective outcomes.

This section covers the tools that appear in nearly every engagement. They are not the only tools available, and they are not always the best choice for every situation. They are the tools that an operator should be comfortable with before stepping into a professional engagement.

For security leaders, understanding the tools attackers use provides insight into what activity to monitor for and what artifacts to expect. Each tool page includes notes on what traces the tool leaves, which helps inform detection strategy.

Tool selection principles

Choosing the right tool for a task involves more than knowing what the tool does. Consider:

• Purpose: what does this tool provide, and is it the most direct path to that outcome?

• Noise: how much network traffic, disk activity, or log entries will this tool generate?

• Artifacts: what artifacts does this tool leave behind on the target?

• Alternatives: is there a quieter, faster, or more reliable way to accomplish the same objective?

The best operators maintain fluency with multiple tools that serve similar functions, allowing them to select the most appropriate option for each engagement's constraints.

Core tools

The following tools are covered in this section:

• Nmap: network scanning and service discovery

• Burp Suite: web application testing and traffic interception

• BloodHound: Active Directory attack path analysis

• Impacket: network protocol interaction and remote execution

• NetExec: network authentication and enumeration at scale

• Responder: name resolution poisoning and credential capture

• Metasploit and MSFvenom: exploitation framework and payload generation

Operator notes

• Master a core set of tools before expanding to specialized alternatives

• Read tool documentation and understand what happens at the protocol level

• Tool output is data, not a conclusion

• When a tool is blocked or detected, have an alternative ready