7 Tools for Web Penetration Testing

Reviews six widely-used port scanners including Nmap, Zenmap, Netcat, Wireshark, Unicornscan and Angry IP Scanner, covering how scanning uncovers vulnerabilities and examples for auditing open ports.

Practical domain reconnaissance guide: retrieving DNS records with dig, host and nslookup, WHOIS lookups, connectivity checks, discovering exposed services with Nmap, and inspecting SSL/TLS certificates.

An exposed server used Nmap, SQLMap and the BlueShell backdoor against Taiwan's Freeway Bureau and a local data center, as Hunt traced open-directory traces of attacks on Asian government targets.

A technical walkthrough of XPath injection: how unvalidated input in XML queries enables authentication bypass and data theft, with a vulnerable lab and Burp Suite techniques for identifying the flaw.

A three-part video series demystifies Burp Suite macros: capturing dynamic values like CSRF tokens, chaining sessions, and automating complex multi-request scenarios, with practice labs included.

NetSPI surveyed its 300-plus pentesters to rank twelve must-have offensive security tools, including Burp Suite, NMAP, CrackMapExec, Metasploit, BloodHound and Impacket, with commentary on each.