Pentesting Tools
Reference pages for the tools used in CPTS and on real engagements. Each one says when to reach for the tool and why, then shows commands that were checked against the real release.
0 of 35 guides marked as learned
Enumeration
4 guidesNmap
Network scanner and service fingerprinter. The first tool on every engagement.
enum4linux-ng
SMB/RPC enumeration, pulls users, shares, groups, and password policy without credentials.
smbmap
Maps SMB shares and permissions across hosts. Shows what you can read and write.
ldapsearch
Raw LDAP queries against a Domain Controller. Pulls everything AD knows.
Active Directory
9 guidesBloodHound
Visualizes AD attack paths. Maps who can reach Domain Admin and how.
Certipy
Attacks AD Certificate Services. Misconfigured templates = instant Domain Admin.
Rubeus
Kerberos attack toolkit. Kerberoasting, AS-REP roasting, ticket manipulation.
Responder
Poisons LLMNR/NBT-NS/mDNS to capture NTLMv2 hashes from the network.
Kerbrute
Username enumeration and password spraying via Kerberos. Stealthy, no lockouts.
PowerView
PowerShell AD reconnaissance. Finds shares, ACLs, GPOs, sessions, trusts.
bloodyAD
AD object manipulation from Linux. Exploits ACL misconfigs found by BloodHound.
ntlmrelayx
Relays captured NTLM authentication to other hosts. Code execution if SMB signing is off.
secretsdump
Dumps all hashes from a DC (DCSync) or local SAM hives. The endgame tool.
Remote Access
4 guidesevil-winrm
WinRM shell with upload/download, in-memory PowerShell, and pass-the-hash.
psexec
Remote execution via SMB. Drops a service binary, noisy but reliable.
wmiexec
Remote execution via WMI. Stealthier than psexec, semi-interactive shell.
xfreerdp
RDP client for Linux. Full GUI access, drive mounting, pass-the-hash support.
Credential Attacks
4 guidesHashcat
GPU-accelerated hash cracker. Handles NTLMv2, Kerberos, SAM, and hundreds more.
LaZagne
Recovers stored passwords from browsers, WiFi, mail clients, and more.
Mimikatz
Extracts passwords, hashes, tickets from Windows memory. The LSASS tool.
SessionGopher
Finds and decrypts saved sessions, PuTTY, WinSCP, FileZilla, RDP.
Windows Privilege Escalation
5 guideswinPEAS
Automated Windows privesc enumeration. Checks hundreds of escalation paths.
Seatbelt
Host survey and security checks. Broader than privesc, covers credential locations too.
SharpUp
Finds exploitable service misconfigs, weak permissions, unquoted paths.
PowerUp
PowerShell privesc finder. Can also exploit what it finds automatically.
Potato Attacks
JuicyPotato, PrintSpoofer, GodPotato, exploit SeImpersonatePrivilege to SYSTEM.
Linux Privilege Escalation
2 guidesPivoting & Tunneling
3 guidesWeb Attacks
4 guidesffuf
Fast web fuzzer. Directory brute-forcing, vhost discovery, parameter fuzzing.
Gobuster
Directory and DNS brute-forcer. Simpler than ffuf, great for quick dir scans.
sqlmap
Automated SQL injection detection and exploitation. Dumps databases, gets shells.
Burp Suite
Web proxy and testing platform. Intercept, modify, and replay HTTP requests.