I mean why are tools needed for pen-testing? I've hacked websites using plain XSS and SQL injections. I didn't require any tools such as the ones I listed above. Now that I want to progress further and improve my overall flexibility as a pen-tester. I seek an answer to this question. (in pen-testing perspective)

  • 8
    Aren't you essentially asking why things should be made easier and ideally automated? Or why one would use a car for longer distances instead of walking? Or why developers use high level languages instead of fiddling with plain machine code? How about an increase in productivity? Commented Jul 24, 2019 at 13:28
  • Steffen Ullrich summed it up , but I'll try to more sum it up : because of TIME. Commented Jul 24, 2019 at 15:25
  • 5
    Why use a hammer when a nearby rock will do?
    – schroeder
    Commented Jul 24, 2019 at 15:26

2 Answers 2


Several reasons:

  • reduce testing time
  • automation
  • clear methodology
  • consistency of testing and results
  • repeatability of testing

Tools are never needed to break something. But you are providing a testing service, and in order to provide value to your clients, you do well to act more like a QA tester instead of a smart person who can break things. No one cares how good you are at breaking things. They need something actionable.

Tools provide a framework for you to show how you broke the target. Even if you end up doing something custom that a tool cannot do, it is better if you can configure a known tool to repeat it for you. If for no other reason, but that the client can test their mitigations.

Tools are not the definitive suite of tests, but they do provide context and a common frame of reference. This is very useful when communicating to development teams. I've provided reports from a tool saying that a site is vulnerable to ' OR 1==1 only to have them come back saying that they fixed it. But it failed again when I reconfigured the tool to test for ' OR foo==foo. The tool provides the basis to say that the values do not matter, but the program logic, and they can run tests on different value ranges themselves.


Among other things, Burp allows you to get a good look of the layout of a web app through spidering- exposing source code and dependencies, directory layout, even API methods that are being called, etc. Much of this can be done simply with the browser dev tools, though trying to manage this within a browser's dev tools would likely prove to be insane.

Furthermore, as a proxy, Burp allows for the interception of requests. For this reason alone, a web proxy like Burp is an absolute requirement. This is especially useful for allowing you to bypass client-side validation and easily send repeat requests, among other things.

XSS and SQLi can be performed without these tools, as you have pointed out, though you may begin to run into issues needing to bypass client-side restrictions that a proxy will likely help with.

Nmap is an entirely different animal, though in short, is not entirely necessary as port scans can be performed with nc or custom scripts. Nmap simply provides you with a suite of helpful commands like running custom lua scripts to automate tasks further. Much more can be said about this.

SQLMap is another tool that- is also not entirely necessary- helps aid and automate testing for SQLi. Much more can be said about this as well.

All in all, these tools can only ever aid you in automating some of your work and to assist you in covering a larger attack surface in a shorter amount of time.

  • I downvoted your answer for two reasons, the first is the fact that it brings no answer at all, everything you cited could be done "manually". The 2nd is because you seem to misunderstood the question which was : "Why automating the work" and you just answered "Because it becomes automatic" Commented Jul 24, 2019 at 15:30
  • 2
    Thanks for your feedback, though the question was not "why automate the work"..and I did not answer "because it becomes automatic." It was an open-ended, opinion-based question anyway and I answered accordingly.
    – jonroethke
    Commented Jul 24, 2019 at 15:41
  • 3
    @SoufianeTahiri I think the answer is fine and doesnt deserve a down vote.He does answer it to an extent.
    – yeah_well
    Commented Jul 24, 2019 at 16:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .