The set I actually run, when, and why.
| Tool | When | Why |
|---|---|---|
| subfinder | Day 1 | Fast passive subdomain enum |
| amass | Day 1 | Thorough (slower) enum |
| dnsx | After subfinder | Resolve + DNS record extraction |
| httpx | After dnsx | Live host probing + tech detect |
| katana | Content discovery | JS endpoint extraction |
| ffuf / feroxbuster | Content discovery | Fast directory brute-force |
| nuclei | Continuous | CVE + misconfiguration scanning |
| Tool | When | Why |
|---|---|---|
| Burp Suite Professional | Every engagement | Proxy, repeater, intruder, extensions |
| mitmproxy | Mobile / API | Command-line proxy, scriptable |
| Tool | When | Why |
|---|---|---|
| jwt_tool | JWT found | Decode, crack, confusion attacks |
| hashcat -m 16500 | JWT HS256 | Brute weak secrets |
| Autorize (Burp) | IDOR testing | Automated horizontal authz checks |
| Tool | When | Why |
|---|---|---|
| sqlmap | Confirmed SQLi | Automated extraction (with permission) |
| XSStrike | XSS suspected | Automated XSS detection |
| commix | Command injection | Automated command injection |
| Tool | When | Why |
|---|---|---|
| arjun | Parameter discovery | Find hidden parameters |
| postman / insomnia | API testing | Collection management |
| jq | Always | JSON parsing in shell |
| Tool | When | Why |
|---|---|---|
| gowitness | Recon | Screenshots of live hosts |
| exiftool | File upload | Metadata injection |
| linkfinder | JS analysis | Endpoint extraction |
- Nessus / OpenVAS — infrastructure scanners, not app-layer.
- Acunetix — noisy, misses business logic, expensive.
- Metasploit — rarely needed for web app testing; reach for custom scripts first.