Essential Tools for Recon, Active Directory, Privilege Escalation, Password Auditing, Forensics & Defense
Modern penetration testing, incident response, threat hunting, and digital forensics rely on a surprisingly small collection of powerful tools.
Some discover hosts and services. Others enumerate Active Directory, analyze Windows artifacts, inspect memory, audit passwords, identify privilege-escalation opportunities, or hunt malicious activity across thousands of endpoints.
This guide organizes some of the most useful tools into seven categories:
- Reconnaissance & Web Testing
- Active Directory Security
- Access & Privilege Escalation
- Password Auditing
- Windows Forensics
- Memory & Malware Analysis
- Detection & Hardening
Important: Many of these utilities are dual-use security tools. Use them only against systems you own or have explicit authorization to test.
1. Reconnaissance & Web Testing
Reconnaissance is usually the first stage of an authorized penetration test. The objective is to understand the attack surface: hosts, ports, services, domains, subdomains, web applications, and exposed resources.
Nmap
Purpose: Network discovery, port scanning, service detection, OS fingerprinting, and security auditing.
Nmap is one of the most important tools in a security professional’s toolbox. It can discover hosts, identify open ports, fingerprint services, and execute specialized checks through the Nmap Scripting Engine (NSE).
Install / Documentation:
https://nmap.org/download.html
Example:
nmap -sV -sC TARGET-sV performs service/version detection while -sC runs Nmap’s default NSE scripts.
ffuf
Purpose: Web content and parameter discovery.
ffuf — “Fuzz Faster U Fool” — is a high-speed web fuzzer commonly used during authorized web application assessments to discover directories, files, virtual hosts, parameters, and other resources.
Install:
https://github.com/ffuf/ffuf
Example:
ffuf -u https://example.test/FUZZ -w wordlist.txtWordlists such as SecLists can make ffuf substantially more useful.
Naabu
Purpose: Fast port discovery.
Naabu is ProjectDiscovery’s high-performance port scanner. It is particularly useful when quickly identifying listening TCP ports before handing the results to tools such as Nmap.
Install:
https://docs.projectdiscovery.io/opensource/naabu/install
ProjectDiscovery supports installation through Go or downloadable binaries.
Go installation:
go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latestNaabu requires libpcap on Linux for packet capture functionality.
Subfinder
Purpose: Passive subdomain discovery.
Subfinder is another ProjectDiscovery utility designed to discover valid subdomains using passive online sources.
Install:
https://github.com/projectdiscovery/subfinder
A common workflow is to feed discovered domains into httpx.
httpx
Purpose: Probe web servers and HTTP services.
httpx can determine which discovered hosts actually respond over HTTP/HTTPS while collecting information such as status codes, titles, technologies, and response characteristics.
Install:
https://github.com/projectdiscovery/httpx
Subfinder and httpx work particularly well together:
subfinder -d example.com | httpxsqlmap
Purpose: Automated SQL injection testing.
sqlmap is an automated SQL injection assessment framework supporting numerous database systems and injection techniques.
Install / Project:
https://sqlmap.org/
Source:
https://github.com/sqlmapproject/sqlmap
A basic authorized test begins with a URL containing a parameter:
sqlmap -u "https://example.test/page.php?id=1"Because sqlmap can actively manipulate database requests, it should only be used when the scope of a security assessment specifically permits it.
2. Active Directory Security
Microsoft Active Directory remains one of the most important environments for enterprise security professionals to understand.
The following tools help authorized testers and defenders identify dangerous relationships, weak configurations, certificate-service problems, exposed credentials, and authentication weaknesses.
BloodHound
Purpose: Visualize Active Directory relationships and attack paths.
BloodHound converts complex Active Directory relationships into a graph, making it possible to identify unexpected privilege relationships and paths to sensitive systems.
Install / Project:
https://github.com/SpecterOps/BloodHound
Data collectors enumerate permitted directory information and BloodHound analyzes the resulting graph.
Impacket
Several tools commonly seen in Active Directory testing — including secretsdump and GetUserSPNs — are actually part of the Impacket project.
Install / Project:
https://github.com/fortra/impacket
secretsdump
Purpose: Credential and authentication-data extraction during authorized assessments and forensic work.
secretsdump.py supports several Windows credential-storage mechanisms.
Because its output may contain highly sensitive authentication material, access to this utility and its results should be carefully controlled.
GetUserSPNs
Purpose: Identify Active Directory accounts associated with Service Principal Names.
GetUserSPNs is frequently used when auditing service-account configuration and exposure to Kerberos-related password attacks.
Kerbrute
Purpose: Kerberos-based Active Directory account enumeration and authentication testing.
Kerbrute is useful for auditing account exposure through Kerberos.
Install:
https://github.com/ropnop/kerbrute
Because repeated authentication attempts may trigger security controls or account policies, understand the environment before testing.
Certipy
Purpose: Audit Active Directory Certificate Services (AD CS).
Certipy can enumerate Certificate Authorities, templates, permissions, and AD CS configurations to identify potentially dangerous certificate configurations.
Install / Documentation:
https://github.com/ly4k/Certipy
Python installation:
pip install certipy-adCertipy is especially valuable because insecure certificate templates and AD CS configurations can create privilege-escalation paths that are easy to overlook during a traditional AD review.
Responder
Purpose: Analyze and test Windows name-resolution and authentication behavior.
Responder is widely used in authorized internal network assessments involving protocols such as LLMNR and NBT-NS.
Install:
https://github.com/lgandx/Responder
Responder can capture authentication exchanges, so testing should be performed only on networks where you have explicit authorization.
3. Access & Privilege Escalation Assessment
Once legitimate access to a test system has been obtained, security professionals often evaluate whether that account has unintended paths to higher privileges.
Evil-WinRM
Purpose: WinRM client designed for Windows security assessments.
Evil-WinRM provides a convenient shell interface for authorized Windows Remote Management sessions.
Install:
https://github.com/Hackplayers/evil-winrm
Ruby installation:
gem install evil-winrmLinPEAS
Purpose: Linux privilege-escalation enumeration.
LinPEAS examines a Linux system for configuration weaknesses, unusual permissions, credentials, services, scheduled jobs, containers, and many other potential escalation indicators.
Install:
https://github.com/peass-ng/PEASS-ng
The PEASS-ng project also contains WinPEAS for Windows environments.
pspy
Purpose: Observe Linux processes without requiring root.
pspy is particularly useful for watching commands and scheduled jobs executed by other users.
Install:
https://github.com/DominicBreuker/pspy
This can help administrators identify unexpected privileged scripts and insecure cron jobs.
GTFOBins
Purpose: Reference database for Unix binaries that can interact with security boundaries.
GTFOBins documents legitimate Unix programs whose features may become security-relevant when combined with sudo permissions, SUID configuration, file capabilities, or other privileges.
Reference:
https://gtfobins.github.io/
GTFOBins is a website/reference rather than a traditional application that needs to be installed.
It is equally useful defensively when reviewing dangerous sudo configurations.
Chisel
Purpose: TCP/UDP tunneling over HTTP using SSH.
Chisel is a compact networking utility frequently used in security labs and authorized penetration tests when testing segmented networks.
Install:
https://github.com/jpillora/chisel
Because tunneling can bypass normal network paths, use it only where network pivoting is explicitly permitted by the assessment scope.
4. Password Auditing
Password auditing helps organizations determine whether captured or exported password hashes can withstand realistic offline attacks.
Hashcat
Purpose: GPU-accelerated password recovery and auditing.
Hashcat supports a huge number of hash algorithms and can perform dictionary, mask, rule-based, and hybrid attacks.
Download:
https://hashcat.net/hashcat/
Example syntax:
hashcat -m HASH_MODE hashes.txt wordlist.txtThe correct hash mode depends on the password-hash format being tested.
John the Ripper
Purpose: Password-security auditing and recovery.
John the Ripper is one of the oldest and most established password-auditing tools.
Download / Project:
https://www.openwall.com/john/
A typical wordlist-based audit resembles:
john --wordlist=wordlist.txt hashes.txtSecLists
Purpose: Security testing wordlist collection.
SecLists contains collections for:
- Password auditing
- Directory discovery
- DNS/subdomain discovery
- Usernames
- Web fuzzing
- Payload testing
- Application-specific testing
Install / Download:
https://github.com/danielmiessler/SecLists
On Kali Linux it is commonly available through:
sudo apt install seclistsWordlists should be treated as input data rather than as a password-cracking tool themselves.
5. Windows Forensics
Windows stores an enormous amount of historical information in artifacts such as the Registry, NTFS metadata, Jump Lists, ShellBags, Amcache, and the Application Compatibility Cache.
Eric Zimmerman’s forensic utilities are particularly valuable for analyzing these artifacts.
Main tool collection:
https://ericzimmerman.github.io/
AmcacheParser
Purpose: Parse Windows Amcache artifacts.
Amcache can provide evidence concerning applications and executables observed on a Windows system.
Download:
https://github.com/EricZimmerman/AmcacheParser
MFTECmd
Purpose: Parse NTFS filesystem metadata.
MFTECmd analyzes artifacts including the NTFS $MFT, which can provide extensive information about files and filesystem activity.
Download:
https://github.com/EricZimmerman/MFTECmd
SBECmd
Purpose: Parse Windows ShellBags.
ShellBags can reveal folders a user interacted with, including directories that may no longer exist.
Download:
https://github.com/EricZimmerman/SBECmd
JLECmd
Purpose: Analyze Windows Jump Lists.
Jump Lists can provide evidence of recently or frequently accessed files and applications.
Download:
https://github.com/EricZimmerman/JLECmd
AppCompatCacheParser
Purpose: Parse Windows Application Compatibility Cache data.
Often referred to as Shimcache, this artifact can provide useful evidence regarding programs present or observed on a Windows machine.
Download:
https://github.com/EricZimmerman/AppCompatCacheParser
Windows Registry and Scheduled Tasks
Do not overlook tools already included with Windows.
Registry
reg queryRegistry analysis can reveal persistence mechanisms, device history, application settings, user activity, and other forensic artifacts.
Scheduled Tasks
schtasks /queryScheduled tasks should be reviewed during both incident response and persistence investigations.
6. Memory & Malware Analysis
Disk evidence tells only part of the story. RAM can contain processes, network connections, injected code, command history, credentials, encryption material, and artifacts that never touched disk.
Volatility 3
Purpose: Memory forensics.
Volatility is one of the best-known frameworks for analyzing memory images.
Install / Project:
https://github.com/volatilityfoundation/volatility3
Python installation:
pip install volatility3Example:
vol -f memory.raw windows.pslistPlugins can inspect processes, DLLs, network information, registry data, suspicious memory regions, and numerous other artifacts.
capa
Purpose: Identify capabilities within executable files.
Mandiant’s capa attempts to explain what a program can do based on characteristics discovered in binaries.
Install / Project:
https://github.com/mandiant/capa
For example:
capa suspicious.exeThis can provide analysts with a quick starting point before deeper reverse engineering.
olevba
Purpose: Analyze VBA macros contained in Microsoft Office documents.
olevba is part of the oletools project.
Install / Project:
https://github.com/decalage2/oletools
Python installation:
pip install oletoolsExample:
olevba suspicious.docmIt is particularly useful when examining potentially malicious Office documents.
YARA
Purpose: Identify files and memory using pattern-matching rules.
YARA allows analysts to describe characteristics associated with malware families, suspicious files, or other data.
Install / Project:
https://github.com/VirusTotal/yara
Basic syntax:
yara rules.yar /path/to/filesYARA has become a fundamental component of malware research and threat hunting.
TShark
Purpose: Command-line packet analysis.
TShark is the command-line counterpart to Wireshark.
Install / Download:
https://www.wireshark.org/download.html
Example:
tshark -r capture.pcapDisplay filters can dramatically narrow large captures:
tshark -r capture.pcap -Y dns7. Detection & Hardening
Offensive knowledge becomes considerably more useful when it is turned around and used to detect the same behaviors.
These tools focus on endpoint visibility, threat hunting, configuration auditing, persistence detection, and incident response.
Velociraptor
Purpose: Endpoint visibility, digital forensics, and threat hunting at scale.
Velociraptor allows investigators to query and collect forensic information from large numbers of endpoints.
Download / Project:
https://docs.velociraptor.app/downloads/
It uses the Velociraptor Query Language (VQL) to perform targeted collection and analysis.
osquery
Purpose: Query operating-system information using SQL.
osquery represents system information through SQL-style tables.
Install / Download:
https://osquery.io/downloads/
For example:
SELECT * FROM processes;Tables can expose processes, users, listening ports, packages, startup items, certificates, interfaces, and much more.
Chainsaw
Purpose: Rapid Windows Event Log analysis.
Chainsaw can search Windows EVTX logs and apply Sigma detection rules to identify suspicious activity.
Install:
https://github.com/WithSecureLabs/chainsaw
A common defensive workflow combines:
Windows Event Logs → Chainsaw → Sigma Rules → Investigation
Autoruns
Purpose: Identify Windows autostart locations.
Autoruns is part of Microsoft’s Sysinternals suite and exposes an enormous collection of locations from which software can automatically execute.
Official Download:
https://learn.microsoft.com/sysinternals/downloads/autoruns
It is particularly useful when hunting malware persistence.
Autoruns examines areas including:
- Run/RunOnce keys
- Services
- Scheduled tasks
- Explorer extensions
- Drivers
- Winlogon entries
- Browser components
- Codecs
- Boot execution
- AppInit DLLs
Lynis
Purpose: Linux/Unix security auditing and hardening.
Lynis evaluates system configuration and provides recommendations for improving security.
Install / Project:
https://github.com/CISOfy/lynis
On many Debian-based systems:
sudo apt install lynisRun an audit with:
sudo lynis audit systemrkhunter
Purpose: Unix/Linux rootkit and configuration checks.
Rootkit Hunter checks systems for known rootkit indicators, suspicious files, permissions, and other anomalies.
Project:
https://rkhunter.sourceforge.net/
On Debian-derived distributions:
sudo apt install rkhunterBuilding a Practical Security Toolkit
The real power of these tools comes from combining them rather than treating each application independently.
A penetration tester might use:
Subfinder
↓
httpx
↓
Naabu
↓
Nmap
↓
Web/Application TestingA Windows incident responder might instead follow:
Windows Event Logs
↓
Chainsaw + Sigma
↓
Autoruns
↓
Zimmerman Tools
↓
Memory Acquisition
↓
Volatility
↓
YARA / capaAnd an Active Directory security review could combine:
Active Directory
↓
BloodHound
↓
AD CS / Certipy
↓
Configuration Review
↓
Credential & Authentication Audit
↓
Detection and RemediationThe important lesson is that no single security tool provides the entire picture.
Reconnaissance tools tell you what exists.
Enumeration tools reveal how systems relate to each other.
Password-auditing tools expose weak credentials.
Forensic tools tell you what happened.
Threat-hunting tools help determine whether the same activity is occurring elsewhere.
Hardening tools help prevent it from happening again.
Quick Reference
| Category | Tools |
|---|---|
| Recon & Web | Nmap, ffuf, Naabu, Subfinder, httpx, sqlmap |
| Active Directory | BloodHound, Impacket, Kerbrute, Certipy, Responder |
| Access & PrivEsc | Evil-WinRM, LinPEAS, pspy, GTFOBins, Chisel |
| Password Auditing | Hashcat, John the Ripper, SecLists |
| Windows Forensics | AmcacheParser, MFTECmd, SBECmd, JLECmd, AppCompatCacheParser |
| Memory & Malware | Volatility 3, capa, olevba, YARA, TShark |
| Detection & Hardening | Velociraptor, osquery, Chainsaw, Autoruns, Lynis, rkhunter |
Final Thoughts
Learning cybersecurity is less about memorizing hundreds of commands and more about understanding which source of information answers which question.
Need to discover services? Start with Nmap.
Need subdomains? Subfinder.
Need to understand Active Directory relationships? BloodHound.
Need to audit AD CS? Certipy.
Need to investigate Windows artifacts? Zimmerman tools.
Need to inspect RAM? Volatility.
Need to understand an unknown binary? capa and YARA.
Need to hunt across endpoints? Velociraptor or osquery.
Need to investigate Windows logs? Chainsaw.
Once you understand what each tool contributes, these individual utilities become a complete security investigation toolkit.
Use them responsibly, document your authorization and scope, and remember that the same techniques used to find weaknesses during a penetration test can be used by defenders to detect and eliminate those weaknesses before an attacker finds them.
