# Tool Selection

> Select pentest tools by methodology phase, target type, and risk tolerance. Use for deciding whether to use amass, subfinder, nmap, owasp-zap, wfuzz, dirb, dnsrecon, netcat, linpeas, winpeas, metasploit-framework, and related tools during authorized assessments.

- Skill: `timsonner/tool-selection` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/tool-selection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/tool-selection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/tool-selection

---


# Tool Selection

## Purpose

Use this skill to choose the smallest effective toolset for the current phase of an authorized assessment.

## Phase-Based Selection

- Pre-Engagement: no active testing by default; confirm scope, windows, credentials, exclusions, and safety limits before selecting tools.
- Discovery and Reconnaissance: `amass`, `subfinder`, `nmap`, `masscan`, `theharvester`, `recon-ng`, `dnsrecon`, `dnsenum`, `httpx`, `whatweb`, `gowitness`, `gobuster`, `feroxbuster`, `dirsearch`, `dirbuster`, `dirb`, `ldapsearch`, `ldapdomaindump`, `rpcclient`, `smbclient`, `smbmap`, `nbtscan`, `onesixtyone`, `snmpwalk`, `kerbrute`, `adfind`, `powerview`, `sharphound`, `aws-cli`, `az-cli`, `gcloud`, `kubectl`, `tcpdump`, `curl`
- Threat Modeling and Test Planning: use discovery outputs to narrow `nmap`, `dnsrecon`, `theharvester`, `recon-ng`, `httpx`, `whatweb`, `gowitness`, `searchsploit`, `semgrep`, `bloodhound`, `certipy`, `impacket-lookupsid`, `scoutsuite`, `kubectl`, `trivy`, `adfind`, `powerview`, `sharphound`, and `rubeus` coverage instead of expanding tool count.
- Vulnerability Analysis: `nuclei`, `nikto`, `burp-suite`, `owasp-zap`, `ffuf`, `wfuzz`, `gobuster`, `feroxbuster`, `dirsearch`, `dirbuster`, `dirb`, `dalfox`, `commix`, `testssl-sh`, `searchsploit`, `prowler`, `aws-cli`, `az-cli`, `gcloud`, `scoutsuite`, `pacu`, `semgrep`, `enum4linux-ng`, `ldapsearch`, `ldapdomaindump`, `rpcclient`, `smbclient`, `smbmap`, `nbtscan`, `onesixtyone`, `snmpwalk`, `wpscan`, `bloodhound`, `certipy`, `kubectl`, `kube-bench`, `kube-hunter`, `trivy`, `gitleaks`, `trufflehog`, `netexec`, `sqlmap`, `impacket-getuserspns`, `impacket-getnpusers`, `mimikatz`, `rubeus`, `powerview`, `sharphound`, `adfind`, `procdump`, `lazagne`, `linpeas`, `winpeas`, `pspy`, `linux-exploit-suggester`, `seatbelt`, `certutil`, `bitsadmin`, `curl`, `plink`, `chisel`, `rclone`, `7zip`, `winrar`, `nessus`, `openvas`
- Validation and Controlled Impact Demonstration: `burp-suite`, `owasp-zap`, focused `nmap`, narrow `ffuf`, `wfuzz`, targeted `nuclei` reruns, `sqlmap` with the lowest safe settings, `commix` only for explicitly approved command-injection validation, `hydra` only for explicitly approved low-rate credential checks, offline `john-the-ripper` or `hashcat` for approved hash auditing, `responder` and `mitm6` only when name-resolution testing is explicitly authorized, tightly scoped execution or credential checks with `evil-winrm`, `impacket-psexec`, `impacket-wmiexec`, `impacket-smbexec`, `impacket-secretsdump`, and `impacket-ntlmrelayx` only when the rules of engagement clearly permit them, tightly scoped credential or ticket validation with `mimikatz`, `rubeus`, `procdump`, and `lazagne` only when explicitly approved, tightly scoped tunneling and transfer checks with `netcat`, `socat`, `proxychains`, `plink`, `chisel`, `curl`, `certutil`, `bitsadmin`, `rclone`, `7zip`, and `winrar` only when the rules of engagement clearly permit them, and `metasploit-framework` only for explicitly approved, narrowly bounded auxiliary or exploit validation paths
- Detection and Response Assessment: `wireshark` plus defender-side telemetry
- Reporting: normalize evidence, tie each observation to an asset, and map findings to business impact.
- Retest and Closure: rerun only the minimum tool and scope needed to confirm the fix.

## Target-Based Hints

- External infrastructure: `amass`, `subfinder`, `nmap`, `masscan`, `httpx`, `whatweb`, `nikto`, `testssl-sh`
- Internal Windows networks: `nmap`, `enum4linux-ng`, `ldapsearch`, `ldapdomaindump`, `rpcclient`, `smbclient`, `bloodhound`, `certipy`, `kerbrute`, `netexec`, `searchsploit`, `responder`, `mitm6`, `evil-winrm`, `impacket-secretsdump`
- Identity, Kerberos, and AD graphing: `adfind`, `powerview`, `sharphound`, `bloodhound`, `rubeus`, `kerbrute`, `certipy`, `ldapsearch`, `ldapdomaindump`, `impacket-getuserspns`, `impacket-getnpusers`, `impacket-lookupsid`
- Credential material and host access review: `mimikatz`, `procdump`, `lazagne`, `netexec`, `evil-winrm`, `impacket-secretsdump`
- OWASP Top 10 and web applications: `httpx`, `whatweb`, `gowitness`, `burp-suite`, `owasp-zap`, `ffuf`, `wfuzz`, `gobuster`, `feroxbuster`, `dirsearch`, `dirbuster`, `dirb`, `nikto`, `nuclei`, `dalfox`, `commix`, `sqlmap`, `semgrep`
- Recon and OSINT: `theharvester`, `recon-ng`, `amass`, `subfinder`, `dnsrecon`, `dnsenum`, `httpx`, `whatweb`
- SMB, NetBIOS, and legacy enumeration: `enum4linux-ng`, `rpcclient`, `smbclient`, `smbmap`, `nbtscan`
- SNMP and network-device review: `onesixtyone`, `snmpwalk`, `nmap`, `searchsploit`
- Privilege escalation review: `linpeas`, `winpeas`, `pspy`, `linux-exploit-suggester`, `seatbelt`, `searchsploit`
- Pivoting and port forwarding: `netcat`, `socat`, `proxychains`, `plink`, `chisel`
- CMS and WordPress: `httpx`, `whatweb`, `wpscan`, `burp-suite`, `nuclei`
- Credential auditing: `hydra`, `john-the-ripper`, `hashcat`
- Network and device management: `nmap`, `snmpwalk`, `searchsploit`
- Active Directory and identity abuse simulation: `bloodhound`, `certipy`, `kerbrute`, `ldapsearch`, `ldapdomaindump`, `impacket-getuserspns`, `impacket-getnpusers`, `impacket-lookupsid`
- Controlled remote execution and credential operations: `evil-winrm`, `netexec`, `impacket-psexec`, `impacket-wmiexec`, `impacket-smbexec`, `impacket-secretsdump`, `impacket-ntlmrelayx`
- Tunneling, staging, and transfer: `curl`, `certutil`, `bitsadmin`, `plink`, `chisel`, `rclone`, `7zip`, `winrar`
- Cloud control planes: `prowler`, `aws-cli`, `az-cli`, `gcloud`, `scoutsuite`, `pacu`
- Containers and Kubernetes: `kubectl`, `kube-bench`, `kube-hunter`, `trivy`
- Vulnerability scanners and baseline review: `nessus`, `openvas`, `nikto`, `nuclei`
- Secrets and repository exposure: `gitleaks`, `trufflehog`, `semgrep`
- Controlled exploitation framework: `metasploit-framework`
- White-box application review: `semgrep`
- Detection visibility and protocol review: `wireshark`, `tcpdump`, `mitmproxy`

## Command Syntax

This selector is not a single CLI tool. Use a short selection input, then choose the matching tool skill.

```text
Phase: Discovery and Reconnaissance
Target: External infrastructure
Goal: Build confirmed web inventory
Constraints: passive first, low impact
Recommended chain: subfinder -> httpx -> gowitness
```

```text
Phase: Vulnerability Analysis
Target: Web application
Goal: Verify hidden routes and auth boundaries
Constraints: authenticated, low rate, no state changes
Recommended chain: ffuf -> burp-suite -> nuclei
```

## Selection Rules

1. Start with the current phase, not with the loudest tool.
2. Prefer the least invasive option that answers the current hypothesis.
3. Narrow scope before increasing depth or rate.
4. Do not use validation tools before discovery and analysis justify them.
5. Capture enough evidence for reporting and retest, but minimize sensitive data collection.

## Escalation Logic

1. If inventory is weak, start with discovery tools.
2. If exposure is confirmed, move to analysis tools aligned to the asset type.
3. If a candidate issue exists, use one focused validation tool to prove or disprove it.
4. If defenders are in scope, map the activity to detection checks and logging gaps.
5. If remediation is claimed, rerun only the original proof path with tighter bounds.

## Safety Boundaries

- Use only on explicitly authorized systems.
- Respect rate limits, fragile assets, maintenance windows, and exclusions.
- Stop if the current tool creates instability or exceeds the agreed impact level.