https://defektive.github.io/docs/pentest-handbook/Recent content in Pentest Engagement Handbook on defektiveHugoenhttps://defektive.github.io/docs/pentest-handbook/toolbox-reference/Mon, 01 Jan 0001 00:00:00 +0000https://defektive.github.io/docs/pentest-handbook/toolbox-reference/<p>This is the install-and-cheat-sheet companion to the handbook. It lists every tool the methodology uses, where it fits, and — where the original Arsenic tooling has aged out — what I replaced it with.</p> <h2 id="original--current-tool-mapping">Original → current tool mapping<a class="td-heading-self-link" href="#original--current-tool-mapping" aria-label="Heading self-link"></a></h2><p>Arsenic was built around a late-2010s OSCP-era toolchain. Most of it still holds up; a few tools have been superseded. The handbook uses the right-hand column.</p> <table> <thead> <tr> <th>Phase</th> <th>Job</th> <th>Arsenic originally used</th> <th>What I use now</th> </tr> </thead> <tbody> <tr> <td>Discovery</td> <td>Subdomain enum (passive)</td> <td><code>amass</code>, <code>crt.sh</code></td> <td><code>subfinder</code> + <code>amass</code> + <code>crt.sh</code></td> </tr> <tr> <td>Discovery</td> <td>Subdomain brute</td> <td><code>amass -brute</code>, <code>gobuster dns</code></td> <td><code>dnsx</code> / <code>puredns</code></td> </tr> <tr> <td>Discovery</td> <td>Mass DNS resolution</td> <td><code>fast-resolv</code></td> <td><strong><code>dnsx</code></strong> (or <code>puredns</code>/<code>massdns</code>)</td> </tr> <tr> <td>Discovery</td> <td>Host liveness</td> <td><code>nmap -sn</code></td> <td><code>nmap -sn</code> + <code>naabu</code></td> </tr> <tr> <td>Recon</td> <td>Port scan</td> <td><code>nmap</code></td> <td><code>nmap</code> + <code>naabu</code> (<code>masscan</code> for huge ranges)</td> </tr> <tr> <td>Recon</td> <td>Service/version</td> <td><code>nmap -sV -sC -A</code></td> <td>same</td> </tr> <tr> <td>Recon</td> <td>HTTP probe</td> <td><code>httpx</code></td> <td><code>httpx</code></td> </tr> <tr> <td>Recon</td> <td>Screenshots</td> <td><strong><code>aquatone</code></strong> (archived)</td> <td><strong><code>gowitness</code></strong> (or <code>httpx -screenshot</code>)</td> </tr> <tr> <td>Recon</td> <td>Content discovery</td> <td><code>ffuf</code>, <code>gobuster</code>, <code>dirb</code></td> <td><code>ffuf</code> + <code>feroxbuster</code></td> </tr> <tr> <td>Hunting</td> <td>Vuln templates</td> <td><code>nuclei</code></td> <td><code>nuclei</code></td> </tr> <tr> <td>Hunting</td> <td>Known exploits</td> <td><code>searchsploit</code> (Exploit-DB)</td> <td>same</td> </tr> <tr> <td>Hunting</td> <td>Subdomain takeover</td> <td><code>aquatone</code> tags</td> <td><code>subzy</code> / <code>nuclei</code> takeover templates</td> </tr> <tr> <td>Glue</td> <td>Scope ingest</td> <td><code>mlr</code> (miller), <code>jq</code></td> <td>same</td> </tr> <tr> <td>Glue</td> <td>Dedup/diff lists</td> <td>custom <code>sort</code>/<code>comm</code></td> <td><code>anew</code></td> </tr> <tr> <td>Reporting</td> <td>Screenshots</td> <td><code>flameshot</code>/<code>maim</code> + <code>xclip</code></td> <td>same</td> </tr> <tr> <td>Reporting</td> <td>Report site</td> <td><code>hugo</code> + arsenic-hugo</td> <td>same</td> </tr> </tbody> </table> <h2 id="install">Install<a class="td-heading-self-link" href="#install" aria-label="Heading self-link"></a></h2> <h3 id="projectdiscovery-suite-go">ProjectDiscovery suite (Go)<a class="td-heading-self-link" href="#projectdiscovery-suite-go" aria-label="Heading self-link"></a></h3><p>Most of the modern recon flow runs on these. Install <a href="https://go.dev/dl/">Go</a> first and make sure <code>$(go env GOPATH)/bin</code> is on your <code>$PATH</code>.</p>