The Metasploit Framework is my go-to tool for pentest automation still to this day, however, I do like what I've seen of CORE INSIGHT and Immunity Security SWARM. There are a few tools such as mana-toolkit and Responder.py that must be run outside of the Metasploit framework, but so many things can be done inside msfconsole these days (`use kiwi' comes to mind).
Much of the early work in network penetration testing is done with either nmap or unicornscan, although zmap and masscan have gained a lot of ground in recent years. In particular, dnmap is a sleek approach.
One of the reasons why nmap/dnmap have little competition is because of their solid inputs and outputs, and of course, as Tate Hansen mentions above, speed. In other ways, nmap is just a simple way of expressing what needs to be done.
Here are a few flags I enjoy with regards to nmap:
Slow scan (but not too slow), evades IDS, and gives the reason why the packets didn't make their destinations. Best performed one port at a time with data-length or string set when the destination protocol or port isn't known by nmap:
-T1 --max-retries 0 --randomize-hosts --reason -n -Pn -sT
If I've found HTTP or TLS targets with the default ports, I like to SYN scan them first before scanning other HTTP/TLS targets on non-default ports.
-T1 --max-retries 0 --randomize-hosts --reason -n -Pn -r -p 80,443
-T1 --max-retries 0 --randomize-hosts --reason -n -Pn -p 902,2375,3000,3010,3128,3790,4567,4848,5986,7001,8008,8040,8080-8091,8140,8200,8400,8443,8500,8776,8880,8834,8980,8999,9060,9080,9084,9191,9292,9443,9990
If everything in in order, switch to faster scans and check for IDS/IPS
-T2 --scan-delay 4 --max-retries 0 --randomize-hosts --reason -n -Pn
-T2 --scan-delay 1 --max-retries 0 --randomize-hosts --reason -n -Pn
-T2 --max-retries 0 --randomize-hosts --reason -n -Pn
This is the next level of scanning (default speed, no randomizing because of the qscan latency checks), giving you lots of detail and potential for movement
--script qscan --max-retries 1 -v -O --osscan-guess --max-os-tries 1 --reason -n -Pn --version-intensity 0 -sTV
--script qscan --max-retries 1 --badsum -v -O --osscan-guess --max-os-tries 1 --reason -n -Pn --version-intensity 0 -sTV
Now is the time to run any last-minute anti-IDS or IDS/IPS/WAF detection checks. Finally, go for it! No sense in scanning a single port or small set of ports at this point.
--script banner-plus --min-rate 450 --min-parallelism 20 --max-retries 9 --defeat-rst-ratelimit -n -Pn -p-
unicornscan 10.0.0.0/24:a -D -L 20 -r 450 -Iv -mU -w udp.pcap
The above rates (--min-rate in nmap and -r in unicornscan) are measured in packets-per second (pps) and can be modified up to 10000 when on a local network or other ideal conditions. There are patches to change nmap's scan rate dynamically (interactively) here. Some other suggestions involve using nping on the type of traffic you are targeting and setting a -T4 scan with twice the --initial-rtt-timeout and four times the –max-rtt-timeout based on some sort of average round-trip time result you see in nping.