Commercial adversary-simulation platform; used for red team operations and purple-team exercises.
What it does: command-and-control framework, post-exploitation tooling, and emulation of advanced adversary tradecraft.
When I use it: controlled, authorized engagements for emulating persistent adversaries and testing detection capabilities at scale.
Defensive notes: monitor for unusual beaconing patterns, long‑lived TLS sessions to unknown endpoints, and PowerShell/WMIC process chains. Implement egress filtering and network-based detection signatures.
Pros: realistic adversary simulation, rich toolset for reporting. Cons: commercial, expensive, and often targeted by defenders as a red flag.
2. Metasploit Framework
Open-source exploitation framework (with commercial Pro edition) — staple in labs for learning exploitation and post-exploit automation.
What it does: modular exploit and payload delivery, auxiliary scanners, and post-exploitation modules.
When I use it: lab exercises, proof-of-concept research, and to validate detection rules against known exploit patterns.
Defensive notes: deploy honeypots, log exploit attempts, and correlate exploit signatures with IDS/IPS events. Ensure hosts have up-to-date patching and mitigations.
Pros: large community, many modules; Cons: noisy on the network and easily detected if not tuned for stealth.
3. BloodHound (Active Directory Enumeration)
Graph-based AD analysis to identify privilege escalation paths and misconfigurations.
What it does: collects AD objects/relationships and visualizes attack paths between users, groups, and computers.
When I use it: after domain enumeration in labs or during engagements where AD assessment is authorized.
Defensive notes: monitor LDAP querying patterns, unusual high-volume enumeration, and constrain unnecessary privileges. Harden ACLs and use group policy to minimize misconfigurations.
Pros: exposes complex attack paths quickly; Cons: requires careful data handling and explanation to stakeholders.
4. Wireshark & Scapy (Network Analysis & Packet Crafting)
Packet capture, deep protocol inspection, and low-level packet crafting for defensive analysis and testing.
What it does: Wireshark inspects packet captures; Scapy crafts and sends arbitrary packets for testing firewalls, IDS, and protocols.
When I use it: diagnosing protocol issues, validating detection signatures, and testing how devices respond to malformed or crafted traffic.
Defensive notes: ensure PCAP retention and indexing for rapid detection. Be careful sending crafted traffic on production networks — prefer isolated lab environments.
Pros: indispensable for protocol-level understanding; Cons: crafting packets can be dangerous on live networks if misused.
5. Flipper Zero & Proxmark (RF / Embedded)
Portable hardware tools for testing RFID, sub-GHz, and simple embedded protocols.
What it does: Flipper Zero is a multi-tool for sub-GHz, RFID, NFC, Bluetooth LE sniffing; Proxmark offers deeper RFID frame analysis and emulation.
When I use it: physical security assessments and lab experimentation with access controls and IoT devices (with authorization).
Defensive notes: physical access controls, RFID tag rotation, and RF monitoring help mitigate these attack vectors. Follow local laws when using RF tools.
Pros: portable and practical for wireless/physical assessments; Cons: legal constraints and operator learning curve.
Flipper Zero on Amazon
Proxmark3 on Amazon