Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to ask you about some good security tools you've used or heard about, please let us know the ability in every tool and the difficulty to use it and which is the best situation to use this tool .
Edit: my question is about tools like metasploit, scapy, nmap ....etc


locked by AviD Oct 18 '12 at 17:27

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

Hello, I wish you had included what you want to pentest as the scoep of this question is really really big! You would get different answers for different pentests. For example if you want to pentest a website? A server? A specific technology? – Chris Dale Nov 19 '10 at 12:59
@ChrisAD: actually I am talking about LAN networks and computers Security – Mohammad AL Hammod Nov 19 '10 at 15:23
M.H. not really narrowing it down here. There are so many tools and procedures depending on what you want to do. – Rory Alsop Dec 7 '10 at 21:39
up vote 7 down vote accepted

Your brain. Tools can be excellent force multipliers, but the most essential pen tester tool is a well tuned noggin that knows in depth the systems (both technological and human) it is attacking. The ability to think creatively about potential failure modes is indispensable.

This is a smart 'out of the box thinking' answer and all that. But clearly he asked for TOOLS. Suggesting him to use a brain is like pointing out that a keyboard might be helpful. -1, Sorry. – freddyb Mar 13 '12 at 10:35

I couldn't agree more with @spinkham's answer. That is the best answer.

To add to @ygjb's power tool list, on the web app side, these tools are excellent for extracting data

First use the Burp Suite to identify points of opportunity - this tool can be challenging to gain proficiency in if you're new to how web apps work

Powertools to help you exploit SQL injection vulnerabilities

sqlmap & sqlninja
sqlmap & sqlninja have been invaluable to me - the information revealed from extracting the data in target databases (usernames, password hashes, trust relationships, etc.) was key to attacking/compromise additional devices

Also, there are many commercial exploit kits, to name a few:

White Phosphorus Exploit Pack
Agora Exploit Pack
VulnDisco Exploit Pack Professional
D2 Exploitation Pack


If you are referring to attack platforms that would be used for penetration testing, then you are probably best off looking into the following:

But those tools don't necessarily have everything you would want. You should also look at the Backtrack linux distribution, which is a VM or disc image that contains a large collection of security tools for many disciplines.

Aside from that, there are so many powerful tools and libraries written in it, Python deserves a mention too :)


Today while I was searching I saw this book : SecurityPowerTools, it covers many security tools and really has great explanations about them.I think it covers a huge side in my question.


Here is a previous answer of mine discribing a list of tools that I use for penteting web applications :


Not the answer you're looking for? Browse other questions tagged or ask your own question.