The Metasploit Framework is my go-to tool for pentest automation still to this day, however, I do like what I've seen of CORE INSIGHT and Immunity Security SWARM. There are a few tools such as Loki (or the older Yersinia tool), intrace, Chiron, mana-toolkit, mitmf, and Responder.py that must be run outside of the Metasploit framework, but so many things can be done inside msfconsole these days (`use kiwi' comes to mind).
Much of the early work in network penetration testing is done with either nmap or unicornscan, although zmap and masscan have gained a lot of ground in recent years. In particular, dnmap is a sleek approach.
One of the reasons why nmap/dnmap have little competition is because of their solid inputs and outputs, and of course, as Tate Hansen mentions above, speed. In other ways, nmap is just a simple way of expressing what needs to be done.
Here are a few flags I enjoy with regards to nmap:
Slow scan (but not too slow), evades IDS, and gives the reason why the packets didn't make their destinations. Best performed one port at a time with data-length or string set when the destination protocol or port isn't known by nmap:
-T1 --max-retries 0 --randomize-hosts --reason -n -Pn -sT
If I've found HTTP or TLS targets with the default ports, I like to SYN scan them first before scanning other HTTP/TLS targets on non-default ports.
-T1 --max-retries 0 --randomize-hosts --script +http-title --reason -n -Pn -r -p 80,443
-T1 --max-retries 0 --randomize-hosts --script +http-title --reason -n -Pn -p 902,2375,3000,3010,3128,3790,4567,4848,5986,7001,8008,8040,8080-8091,8140,8200,8400,8443,8500,8776,8880,8834,8980,8999,9060,9080,9084,9191,9292,9443,9990
If everything in in order, switch to faster scans and check for IDS/IPS
-T2 --scan-delay 4 --max-retries 0 --randomize-hosts --reason -n -Pn
-T2 --scan-delay 1 --max-retries 0 --randomize-hosts --reason -n -Pn
-T2 --max-retries 0 --randomize-hosts --reason -n -Pn
This is the next level of scanning (default speed, no randomizing because of the qscan latency checks), giving you lots of detail and potential for movement
--script qscan,duplicates --max-retries 1 -v -O --osscan-guess --max-os-tries 1 --reason -n -Pn --version-intensity 0 -sTV
--script qscan,duplicates --max-retries 1 --badsum -v -O --osscan-guess --max-os-tries 1 --reason -n -Pn --version-intensity 0 -sTV
Now is the time to run any last-minute anti-IDS or IDS/IPS/WAF detection checks. Finally, go for it! No sense in scanning a single port or small set of ports at this point.
--script banner-plus --min-rate 450 --min-parallelism 20 --max-retries 5 --defeat-rst-ratelimit -n -Pn -p-
unicornscan 10.0.0.0/24:a -D -L 20 -r 450 -Iv -mU -w udp.pcap
The above rates (--min-rate in nmap and -r in unicornscan) are measured in packets-per second (pps) and can be modified up to 10000 when on a local network or other ideal conditions. There are patches to change nmap's scan rate dynamically (interactively) here. Some other suggestions involve using nping on the type of traffic you are targeting and setting a -T4 scan with twice the --initial-rtt-timeout and four times the –max-rtt-timeout based on some sort of average round-trip time result you see in nping. It is difficult to get nmap into best-fit approach for bulk SYN or UDP scanning, even when using pedantic min-hostgroup, min-parallelism, and min-rate parameters. This is why many people turn to unicornscan, zmap, or masscan. If your target networks and services have very reliable and consistent round-trip times in their server responses, nmap/dnmap may be your best bet for tooling consistency if nothing else.
If you find any open ports with services (or apps of any kind) that require any form of authentication (HTTP, SSL/TLS, SMTP, POP3, IMAP, Oracle, DB2, MySQL, MS SQL, Cassandra, MongoDB, SVN, CVS, Git, SIP, VMware, et al), then you will want to find the specific script, but generically your nmap/dnmap command-line arguments should look like:
--min-rate 100 --max-retries 5 -n -Pn --script +brute,creds-summary --script-args brute.mode=pass,userdb=usernames.lst,passdb=passwords.lst,brute.firstOnly,brute.guesses=2
The above could be performed with dnmap using a different passwords.lst file on each server in order to increase attempts, to brute from different IP addresses, or a variety of other scenario-dependent options. If you had three servers for dnmap, as an example, you could set brute.delay to 3 seconds, 5 seconds, and 10 seconds -- noting the differences.
Finally, let's talk about how nmap can really shine -- by combining the last three sections after you know that SYN scanning works and that IDS/IPS isn't going to be a bother for your automation. Let's say you aren't just on a coffee break, you can't take "just another nap", and your significant other demands some attention and a normal 8-hour sleep routine. Well, fire up nmap this way and you'll get some great results for when you come back to the console!
--min-rate 100 --max-retries 5 --defeat-rst-ratelimit --randomize-hosts --open -v -O --osscan-guess --max-os-tries 1 -sUSV --version-all --script banner,duplicates,vuln,vulscan,brute,creds-summary --script-args vulns.showall,unsafe,vulscanversiondetection=0,brute.mode=pass,userdb=usernames.lst,passdb=passwords.lst,brute.firstOnly