The tool index
A quick-reference catalogue of the tools referenced across the Academy: what each does, when to reach for it, and the job it belongs to.
On this page
Learning objectives
- Match a task to the right tool across recon, AD, cracking, web, cloud, mobile and phishing
- Understand at a high level what each tool does before you read the technique pages
- Apply the safety principle that credential-class and destructive uses warrant explicit sign-off
A catalogue of the tooling referenced throughout the attack-techniques material, grouped by job. This is a map, not a manual: each entry says what the tool does so you recognise it when a technique page reaches for it. A standing safety principle runs through all of it: the credential-class and destructive uses of these tools (spraying, cracking, relay, roasting, state-changing writes) warrant explicit sign-off and careful logging, never a casual run.
Reconnaissance and enumeration
| Tool | What it does |
|---|---|
| subfinder / dnsx / shuffledns | Passive and active subdomain and DNS discovery |
| httpx / tlsx / cdncheck | HTTP probing, TLS inspection, CDN and WAF detection |
| naabu / nmap | Port scanning plus service and version detection |
| katana / urlfinder | Crawling and endpoint or URL discovery (including JS) |
| nuclei | Template-based vulnerability and fingerprint scanning |
| crt.sh / Shodan / Censys | Certificate transparency and internet asset search |
| HIBP / breach sources | Breach and credential-exposure lookups |
Active Directory
| Tool | What it does |
|---|---|
| Responder | Poison LLMNR, NBT-NS and mDNS to capture or relay auth |
| mitm6 | IPv6 DNS poisoning to capture auth |
| ntlmrelayx (Impacket) | Relay captured NTLM auth to a useful target |
| PetitPotam / PrinterBug / DFSCoerce | Coerce a host (often a DC) to authenticate |
| Certipy | Enumerate and exploit AD CS misconfig (ESC1 to ESC11) |
| Rubeus | Kerberos primitives: roast, ticket forge and reuse |
| Impacket (GetUserSPNs, GetNPUsers, secretsdump, ticketer) | Kerberoast, AS-REP roast, dump secrets, forge tickets |
| BloodHound (SharpHound / bloodhound.py) | Map AD as a graph; find the shortest path to Domain Admin |
| NetExec (nxc) | Spray, auth, execute and dump across a subnet at scale |
| Mimikatz | Extract creds and tickets from Windows (LSASS, DPAPI) |
Credential cracking
| Tool | What it does |
|---|---|
| hashcat | GPU offline hash cracking (NTLM, Kerberos, MD5) |
| john (John the Ripper) | CPU and flexible offline cracking |
Web and API
| Tool | What it does |
|---|---|
| Intercepting proxy (for example Burp Suite, ZAP) | Inspect and modify HTTP requests and responses |
| Content discovery (directory and endpoint brute) | Find hidden routes, panels and files |
| nuclei | Known-CVE and misconfig templates against web |
Cloud
| Tool | What it does |
|---|---|
| ScubaGear / Maester | M365 and Entra configuration benchmarking |
| Prowler | AWS, Azure and GCP posture and compliance scanning |
| Monkey365 | Microsoft 365 and Azure security review |
Mobile
| Tool | What it does |
|---|---|
| jadx / apktool | Decompile and inspect Android packages |
| Frida / objection | Runtime instrumentation, pinning bypass |
Phishing
| Tool | What it does |
|---|---|
| evilginx (AiTM proxy) | MFA-bypass phishing via session-token capture |
| Static lander kits | Credential-harvesting clone pages |
AI and LLM testing
As more targets embed LLMs, a few categories of tooling have become standard for probing them.
| Tool | What it does |
|---|---|
| Prompt-injection test kits (for example garak) | Probe an LLM for prompt injection, jailbreaks and unsafe output |
| LLM red-team frameworks (for example PyRIT, promptfoo) | Automate adversarial prompts and score model responses at scale |
| MCP and agent inspectors | Enumerate an agent's exposed tools and test for excessive agency or unsafe tool use |
A note on responsible use
Reach for these tools only against systems you are authorised to test, and keep the destructive and credential-class uses behind deliberate approval and clear evidence logging. The techniques are identical to an attacker's; the authorisation and the record are what make the work a profession.
Related reading
- Frameworks and standards
- Glossary
Knowledge check
Answer without AI. This is your own recall. 70% to pass.
1.Which tool models Active Directory as a graph and computes the shortest path to Domain Admin?
2.You need to crack captured NTLM hashes offline using a GPU. Which tool fits?
3.Which tool is used for AiTM phishing that can capture a session token and bypass OTP or push MFA?