Tool Selection

Tool Selection

Purpose

Use this skill to choose the smallest effective toolset for the current phase of an authorized assessment.

Phase-Based Selection

• Pre-Engagement: no active testing by default; confirm scope, windows, credentials, exclusions, and safety limits before selecting tools.
• Discovery and Reconnaissance: amass, subfinder, nmap, masscan, theharvester, recon-ng, dnsrecon, dnsenum, httpx, whatweb, gowitness, gobuster, feroxbuster, dirsearch, dirbuster, dirb, ldapsearch, ldapdomaindump, rpcclient, smbclient, smbmap, nbtscan, onesixtyone, snmpwalk, kerbrute, adfind, powerview, sharphound, aws-cli, az-cli, gcloud, kubectl, tcpdump, curl
• Threat Modeling and Test Planning: use discovery outputs to narrow nmap, dnsrecon, theharvester, recon-ng, httpx, whatweb, gowitness, searchsploit, semgrep, bloodhound, certipy, impacket-lookupsid, scoutsuite, kubectl, trivy, adfind, powerview, sharphound, and rubeus coverage instead of expanding tool count.
• Vulnerability Analysis: nuclei, nikto, burp-suite, owasp-zap, ffuf, wfuzz, gobuster, feroxbuster, dirsearch, dirbuster, dirb, dalfox, commix, testssl-sh, searchsploit, prowler, aws-cli, az-cli, gcloud, scoutsuite, pacu, semgrep, enum4linux-ng, ldapsearch, ldapdomaindump, rpcclient, smbclient, smbmap, nbtscan, onesixtyone, snmpwalk, wpscan, bloodhound, certipy, kubectl, kube-bench, kube-hunter, trivy, gitleaks, trufflehog, netexec, sqlmap, impacket-getuserspns, impacket-getnpusers, mimikatz, rubeus, powerview, sharphound, adfind, procdump, lazagne, linpeas, winpeas, pspy, linux-exploit-suggester, seatbelt, certutil, bitsadmin, curl, plink, chisel, rclone, 7zip, winrar, nessus, openvas
• Validation and Controlled Impact Demonstration: burp-suite, owasp-zap, focused nmap, narrow ffuf, wfuzz, targeted nuclei reruns, sqlmap with the lowest safe settings, commix only for explicitly approved command-injection validation, hydra only for explicitly approved low-rate credential checks, offline john-the-ripper or hashcat for approved hash auditing, responder and mitm6 only when name-resolution testing is explicitly authorized, tightly scoped execution or credential checks with evil-winrm, impacket-psexec, impacket-wmiexec, impacket-smbexec, impacket-secretsdump, and impacket-ntlmrelayx only when the rules of engagement clearly permit them, tightly scoped credential or ticket validation with mimikatz, rubeus, procdump, and lazagne only when explicitly approved, tightly scoped tunneling and transfer checks with netcat, socat, proxychains, plink, chisel, curl, certutil, bitsadmin, rclone, 7zip, and winrar only when the rules of engagement clearly permit them, and metasploit-framework only for explicitly approved, narrowly bounded auxiliary or exploit validation paths
• Detection and Response Assessment: wireshark plus defender-side telemetry
• Reporting: normalize evidence, tie each observation to an asset, and map findings to business impact.
• Retest and Closure: rerun only the minimum tool and scope needed to confirm the fix.

Target-Based Hints

• External infrastructure: amass, subfinder, nmap, masscan, httpx, whatweb, nikto, testssl-sh
• Internal Windows networks: nmap, enum4linux-ng, ldapsearch, ldapdomaindump, rpcclient, smbclient, bloodhound, certipy, kerbrute, netexec, searchsploit, responder, mitm6, evil-winrm, impacket-secretsdump
• Identity, Kerberos, and AD graphing: adfind, powerview, sharphound, bloodhound, rubeus, kerbrute, certipy, ldapsearch, ldapdomaindump, impacket-getuserspns, impacket-getnpusers, impacket-lookupsid
• Credential material and host access review: mimikatz, procdump, lazagne, netexec, evil-winrm, impacket-secretsdump
• OWASP Top 10 and web applications: httpx, whatweb, gowitness, burp-suite, owasp-zap, ffuf, wfuzz, gobuster, feroxbuster, dirsearch, dirbuster, dirb, nikto, nuclei, dalfox, commix, sqlmap, semgrep
• Recon and OSINT: theharvester, recon-ng, amass, subfinder, dnsrecon, dnsenum, httpx, whatweb
• SMB, NetBIOS, and legacy enumeration: enum4linux-ng, rpcclient, smbclient, smbmap, nbtscan
• SNMP and network-device review: onesixtyone, snmpwalk, nmap, searchsploit
• Privilege escalation review: linpeas, winpeas, pspy, linux-exploit-suggester, seatbelt, searchsploit
• Pivoting and port forwarding: netcat, socat, proxychains, plink, chisel
• CMS and WordPress: httpx, whatweb, wpscan, burp-suite, nuclei
• Credential auditing: hydra, john-the-ripper, hashcat
• Network and device management: nmap, snmpwalk, searchsploit
• Active Directory and identity abuse simulation: bloodhound, certipy, kerbrute, ldapsearch, ldapdomaindump, impacket-getuserspns, impacket-getnpusers, impacket-lookupsid
• Controlled remote execution and credential operations: evil-winrm, netexec, impacket-psexec, impacket-wmiexec, impacket-smbexec, impacket-secretsdump, impacket-ntlmrelayx
• Tunneling, staging, and transfer: curl, certutil, bitsadmin, plink, chisel, rclone, 7zip, winrar
• Cloud control planes: prowler, aws-cli, az-cli, gcloud, scoutsuite, pacu
• Containers and Kubernetes: kubectl, kube-bench, kube-hunter, trivy
• Vulnerability scanners and baseline review: nessus, openvas, nikto, nuclei
• Secrets and repository exposure: gitleaks, trufflehog, semgrep
• Controlled exploitation framework: metasploit-framework
• White-box application review: semgrep
• Detection visibility and protocol review: wireshark, tcpdump, mitmproxy

Command Syntax

This selector is not a single CLI tool. Use a short selection input, then choose the matching tool skill.

Phase: Discovery and Reconnaissance
Target: External infrastructure
Goal: Build confirmed web inventory
Constraints: passive first, low impact
Recommended chain: subfinder -> httpx -> gowitness

Phase: Vulnerability Analysis
Target: Web application
Goal: Verify hidden routes and auth boundaries
Constraints: authenticated, low rate, no state changes
Recommended chain: ffuf -> burp-suite -> nuclei

Selection Rules

1. Start with the current phase, not with the loudest tool.
2. Prefer the least invasive option that answers the current hypothesis.
3. Narrow scope before increasing depth or rate.
4. Do not use validation tools before discovery and analysis justify them.
5. Capture enough evidence for reporting and retest, but minimize sensitive data collection.

Escalation Logic

1. If inventory is weak, start with discovery tools.
2. If exposure is confirmed, move to analysis tools aligned to the asset type.
3. If a candidate issue exists, use one focused validation tool to prove or disprove it.
4. If defenders are in scope, map the activity to detection checks and logging gaps.
5. If remediation is claimed, rerun only the original proof path with tighter bounds.

Safety Boundaries

• Use only on explicitly authorized systems.
• Respect rate limits, fragile assets, maintenance windows, and exclusions.
• Stop if the current tool creates instability or exceeds the agreed impact level.