information gathering

cisco-torch
to find telnet/ssh, web, ntp and snmp services and launch a dictionary attack against whatever is discovered

cookie cadger
tool that monitors HTTP GET requests from a browser

DMitry used to gather subdomains, email addresses, uptime info, tcp port scan, whois lookups and more. ideal for gaining information on a server

DNSRecon
important for hacking DNS server, fucks shit up. must use

dnstracer
same as above, must use

dotdotpwn
used to gain information about http/ftp/tftp servers

dnswalk
used to test stability of dns server

Fierce
used to gain information to find likely targets on a server

fragroute
testing of network intrusion detection systems, firewalls and basic tcp/ip stack behaviour

hping3
port scanning, network testing, tcp/ip stack auditing

lbd
load balancing detector for DNS/HTTP servers. MUST USE.

maltego teeth
important software for testing. MUST USE


vulnerability analysis
hexorbase
dataase application performs sql queries and bruteforce against mysql

sqlmap
used to test security of mysql

web attacks
apache-users
find the usernames on any system that uses apache with the userdir module

sqlsus
mysql injection tool

webslayer
brute force using GET and POST. MUST use this as know how to fix through hacking module
webspoilt
arp ddos attack (like hacking module)


WPSCAN
to find weakness in wordpress MUST USE



stress testing
DHCPig
DHCP exhaustion attack MUST USE

SlowHTTPTest
trying to get dos on HTTP server MUST USE

exploitation tools
sqlmap
same as above


sniffing and spoofing
DNSChef
everything to do with DNS, MUST USE

isr-evilgrade
pen testing for webserver and dnsserver

password attacks
burp suit
brute force with manual/automated options

crunch
word generator, must use for brute force

DBPwAUDIT
checks for password strength in mysql

patator
MUST USE
brute force FTP, telnet, http, mysql
dns
dns reverse lookup

weevely
php web shell