The Standard Pentester's Toolkit

Why this matters

Every pentester has a toolkit: Kali / Parrot Linux, Burp Suite, ZAP, nmap, sqlmap, Metasploit, gobuster/ffuf, John the Ripper / hashcat, hydra, BloodHound, mimikatz (on engagements where authorised). Plus custom scripts in Python. The tool list is well-defined; the skill is in chaining them effectively.

Demo

Typical engagement-day: morning — gobuster + nmap (discovery), midday — Burp + sqlmap (web exploitation), afternoon — Metasploit + Cobalt Strike-like for lateral, evening — note-taking and report drafting. The tools are utilities; the methodology is the skill.

Try it yourself

1. Install Kali Linux in a VM or use an online lab (TryHackMe, HackTheBox).
2. Run through the Kali Tools Documentation index. Familiarise with categories.
3. Pick 3 tools you don't know and skim each's docs.

References

• Kali Linux Tools
• HackTricks (cheat sheets)