Why use tools such as BurpSuite, nmap or SQLmap?

Question

I mean why are tools needed for pen-testing? I've hacked websites using plain XSS and SQL injections. I didn't require any tools such as the ones I listed above. Now that I want to progress further and improve my overall flexibility as a pen-tester. I seek an answer to this question. (in pen-testing perspective)

Answer 1

Several reasons:

• reduce testing time
• automation
• clear methodology
• consistency of testing and results
• repeatability of testing

Tools are never needed to break something. But you are providing a testing service, and in order to provide value to your clients, you do well to act more like a QA tester instead of a smart person who can break things. No one cares how good you are at breaking things. They need something actionable.

Tools provide a framework for you to show how you broke the target. Even if you end up doing something custom that a tool cannot do, it is better if you can configure a known tool to repeat it for you. If for no other reason, but that the client can test their mitigations.

Tools are not the definitive suite of tests, but they do provide context and a common frame of reference. This is very useful when communicating to development teams. I've provided reports from a tool saying that a site is vulnerable to ' OR 1==1 only to have them come back saying that they fixed it. But it failed again when I reconfigured the tool to test for ' OR foo==foo. The tool provides the basis to say that the values do not matter, but the program logic, and they can run tests on different value ranges themselves.

Answer 2

Among other things, Burp allows you to get a good look of the layout of a web app through spidering- exposing source code and dependencies, directory layout, even API methods that are being called, etc. Much of this can be done simply with the browser dev tools, though trying to manage this within a browser's dev tools would likely prove to be insane.

Furthermore, as a proxy, Burp allows for the interception of requests. For this reason alone, a web proxy like Burp is an absolute requirement. This is especially useful for allowing you to bypass client-side validation and easily send repeat requests, among other things.

XSS and SQLi can be performed without these tools, as you have pointed out, though you may begin to run into issues needing to bypass client-side restrictions that a proxy will likely help with.

Nmap is an entirely different animal, though in short, is not entirely necessary as port scans can be performed with nc or custom scripts. Nmap simply provides you with a suite of helpful commands like running custom lua scripts to automate tasks further. Much more can be said about this.

SQLMap is another tool that- is also not entirely necessary- helps aid and automate testing for SQLi. Much more can be said about this as well.

All in all, these tools can only ever aid you in automating some of your work and to assist you in covering a larger attack surface in a shorter amount of time.