Pentest tools tier list: learn about which tools are actually used in pentests, and why, with Andy Swift Please comment why you disagree and what we've missed!! The three S-tier tools have a shared attribute: They only do ONE thing, but do it really well and reliably

@SwiftSecur1

Some of the logos are from the Kali docs, and I think are completely fake and made up? For example, they list this as the masscan logo, which I don’t think has an official logo? @robertgraham

Also the top tier tools doing ONE thing (well) is in contrast to many security vendors today attempting to do everything (mediocrely)

@veorq @SwiftSecur1 No netcat?

@SwiftSecur1 Oh crap forgot to include that. Obviously S

@SwiftSecur1 I cannot accept Burp being C-tier.

@SwiftSecur1 I just heard @SwiftSecur1 mention token ring and then it cut off….. 🤣

@SwiftSecur1 A little teaser

@SwiftSecur1 Walking into a pen test and accidentally dropping my rtfm and art of exploitation out of my bag

@SwiftSecur1 It is NOT appropriate for a grown men to engage with or even think about pen-testing

@SwiftSecur1 Why is IDA Pro D tier 😢

@SwiftSecur1 Imagine pulling up IDA pro mid pentest as you’re scanning the network

@SwiftSecur1 my fault I forgot this was for pentesting

Nice list. Interesting seeing how the majors have held up over time. OG moment? I remember doing VAAPs where it was me+a couple of peeps across a table from 20+ppl (program staff), and all we got to do was ask questions. Verbally. No touchy, toooo sensitive. Lemme add this tool: What I think is THE most important *tool*, before hangin' and bangin', annnd 'Boldly pressing <ENTER> where Angels fear to tread' A 'Get out of jail free card' A signed pentesting agreement with both system AND data owner, listing scope of test. Many formats. Saved my keister more than once. Highly recommended if you accidently blow out all the blinking lights... Me? Just gimme a vm of backtrack/kali, memory space to run, and a valid IP. Best, HTM III

I am so stoked on you doing video content (unless youve always done that, in which case, I’m glad I know you do now)

Started the channel a couple months ago! Happy to hear feedback and suggestions

@SwiftSecur1 Bro exposed himself as being a major larper. nmap doesn't do anything fancy? Maybe because you haven't read any of Fyodor's docs and you only know 2 flags you skid. Never had to evolve? Lmao oh sweet child

@SwiftSecur1 Gigachad over here runs an Xmas scan targeting udp with -vvvv -d9 --packet-trace and autism-stares at it for hours with the -T0 and -A flags simultaneously on

@SwiftSecur1 responder? impacket? tcpdump?

@SwiftSecur1 mimikatz is A??? that is ridiculous

@SwiftSecur1 This tier list is so far off from any tools aligned to real engagements that I don't know if this is just a delayed aprils fools.

@SwiftSecur1 Rustscan fan

@SwiftSecur1 Don't know if it's rage bait so i'll bite. This list doesn't align with any specific engagement-types such as for netpen (either external or internal), web, mobile, RE, or any of the more specialized types of testing from my experience. Happy to discuss in good faith though.

@SwiftSecur1 Watch to see the reasoning behind the rankings, but also list what you think would be tools you frequently use during a netpen

@SwiftSecur1 . io/WHrTkL0t