Q: Where do you find the latest and most effective tools in Pentesting/Red Team Ops? How do you check their authenticity and start utilizing them?
Siddharta, Red-Blue Teaming + Advanced Adversary Simulation
– My primary source is Twitter. Following these accounts will help a lot in keeping up with the pace of the latest resources, whether they be tools, zero-days, major security events, conferences, and so on. The Twitter accounts are @Dinosn and @CyberWarship. You can also look at kitploit.com
I usually don’t just git clone and start using the new tools, I have an arsenal of existing tools. The most important advice I can give is: to go after techniques, tactics, and procedures because tools come and go, they will be there always because someone is working to modify it, or someone has new ideas to implement. Many of my friends I know, make tools themselves and they’re highly customizable. So the choice of tools and their effectiveness lies in these two points:
Is the tool enabling me to implement and exercise the latest techniques?
Is the tool well built and well maintained if a tool? If it delivers a very specific need, no matter which type, or it’s outdated, then it’s better to read the source code (open-source) and customize it to current needs.
Another big thing is communities – Discord, Slack, Telegram, online forums, even LinkedIn, I prefer Discord. So there’s a community with common interests and goals in mind, and they are in their own journey, some are advanced users, some are at intermediate and some are mere beginners, but they’re all distinct. Whenever I seek help regarding the choice of tooling and even techniques, I often get relevant and genuine help.
Pradeep, DevOps Engineer
– Our pentesting tools are decided based on how well they suit our needs. We extensively trial them to see if they match/exceed those needs. We are sure of their authenticity when they are acquired from the software maker. Some are free tools as well. In those cases, we check for how widely they are being used, the developers behind it, the community behind it, etc.
Kapil, Security Operations
– Mostly use open-source communities like Kali for PT.
Mirza, Testing
– Google for them or ask around in testing forums, like the Ministry of Testing Club.
The SecPro is a weekly security newsletter to help you stay sharp and upgrade your skills with trending threat insights, practical tutorials, hands-on labs, and useful resources. Build skills in as little as 10 minutes. Join the newsletter here.
