Security Tools

Security Tools: A Defensive Toolkit Overview

Modern security work is powered by a well-understood set of open-source and commercial tools. Whether you are on a red team (offensive, authorized testing), a blue team (detection and defense), or just learning, the same tools appear again and again. This guide organizes the essential toolkit by category, explains what each tool actually does, and shows how to use them only in environments you own or are explicitly authorized to test — labs, CTFs, and intentionally vulnerable targets.

Understanding tools defensively matters even if you never touch offense: knowing how a scanner fingerprints your services tells you what an attacker sees, and knowing how a packet capture reveals a handshake tells you what your monitoring should catch.

The Toolkit at a Glance

Reconnaissance and Scanning

Reconnaissance answers "what is here?" — which hosts are alive, which ports are open, and which services and versions are running. This is the foundation of both attack surface mapping and defensive inventory.

Nmap

Nmap (Network Mapper) is the de facto standard for host discovery and service enumeration. It sends crafted packets and interprets responses to determine host state, open ports, service versions, and OS fingerprints. The Nmap project maintains scanme.nmap.org as an explicitly authorized public target for learning.

# Host discovery only (no port scan) on a lab subnet you own
nmap -sn 192.168.56.0/24

# Service/version detection + default scripts against the authorized target
nmap -sV -sC scanme.nmap.org

# Faster top-1000 TCP scan with OS guess (run against your own VM)
sudo nmap -T4 -O 192.168.56.101

# Scan specific ports and output all formats for later review
nmap -p 22,80,443 -oA scan_results scanme.nmap.org

Masscan

Masscan is an asynchronous scanner built for speed — it can sweep large address ranges far faster than Nmap by not tracking per-connection state. In practice, teams use Masscan for a fast open-port sweep, then hand the results to Nmap for accurate version detection. Its aggressive rate makes it easy to overwhelm a network, so keep it strictly in your own lab.

Web Application Testing Proxies

An intercepting proxy sits between your browser and a web app, letting you pause, inspect, and modify HTTP(S) requests and responses. This is the core workflow for web application security testing.

Burp Suite and OWASP ZAP

Burp Suite (Community and Professional editions) and OWASP ZAP (fully free and open source) are the two dominant proxies. The typical workflow: configure your browser to route traffic through the proxy, install the proxy's CA certificate so HTTPS can be decrypted, then browse the target app. The proxy records the HTTP history, and you can:

1. Intercept a request in-flight, modify a parameter, and forward it.
2. Spider/crawl the app to map every reachable endpoint.
3. Repeat a request many times with tweaks (Burp Repeater / ZAP Manual Request).
4. Fuzz parameters (Burp Intruder / ZAP Fuzzer) to probe input handling.

Set these up against OWASP Juice Shop — a deliberately vulnerable app you run locally — so every request stays in your own lab.

Packet Analysis

Packet analysis lets you see the raw traffic on the wire. It is essential for troubleshooting, forensics, and understanding protocols.

Wireshark and tcpdump

tcpdump is a command-line capture tool ideal for servers and headless boxes; Wireshark is the graphical analyzer with deep protocol dissection and display filters. A common pattern is to capture with tcpdump into a .pcap file, then open it in Wireshark to analyze.

# tcpdump: capture HTTP traffic on eth0 to a file (your own host)
sudo tcpdump -i eth0 -w capture.pcap 'tcp port 80'

# tcpdump: capture only traffic to/from one lab host, verbose
sudo tcpdump -i eth0 -nn host 192.168.56.101

# Wireshark DISPLAY filters (typed into the filter bar):
tcp.flags.syn == 1 and tcp.flags.ack == 0   # SYN packets (start of handshake)
tcp.analysis.retransmission                 # retransmits (network trouble)
http.request.method == "POST"               # POST requests only
tls.handshake.type == 1                      # TLS ClientHello

Reading a TCP three-way handshake in Wireshark: you will see a SYN from the client, a SYN, ACK from the server, then an ACK from the client. Only after that does application data flow. Recognizing this pattern helps you spot scan artifacts (SYNs with no completion) and connection resets.

Vulnerability Scanners

Vulnerability scanners compare discovered services against databases of known issues and misconfigurations.

Nessus, OpenVAS, and Nuclei

Nessus (commercial, free for home use via Nessus Essentials) and OpenVAS/Greenbone (open source) are full network vulnerability scanners with large signature sets. Nuclei is a fast, template-based scanner: each check is a YAML template describing a request and a matcher, and the community maintains thousands of them. Nuclei is popular because it is transparent (you can read exactly what each template does) and easily extended.

# Nuclei against a LOCAL lab target, using community templates
nuclei -u http://localhost:3000 -t http/technologies/

# Update the template store, then run a tagged subset
nuclei -update-templates
nuclei -u http://192.168.56.101 -tags cve,misconfig

Exploitation Frameworks (Lab Context)

Metasploit Framework is a modular platform for validating vulnerabilities: it bundles exploit modules, payloads, and post-exploitation tooling. Conceptually you select a module, set options (target, payload), and run it. The canonical safe learning target is Metasploitable, a deliberately vulnerable Linux VM built for exactly this. Use exploitation frameworks only against such intentionally vulnerable lab machines — never against production or third-party systems.

Password Auditing (Your Own Hashes)

Hashcat (GPU-accelerated) and John the Ripper recover plaintext from password hashes. Defensively, these tools audit password strength: dump the hashes from a system you administer and see how quickly weak passwords fall. This justifies stronger password policies and slow hashing algorithms (bcrypt, Argon2). Recovering your own forgotten password is another legitimate use.

# hashcat: audit YOUR OWN bcrypt hashes with a wordlist (-m 3200 = bcrypt)
hashcat -m 3200 my_hashes.txt rockyou.txt

# john: crack a shadow file you exported from your own test box
john --wordlist=rockyou.txt my_shadow.txt
john --show my_shadow.txt

Directory and Content Discovery

ffuf and gobuster brute-force paths, files, and virtual hosts using wordlists to find endpoints not linked in the UI. Point them only at your own lab apps.

# ffuf: discover directories on your local Juice Shop instance
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://localhost:3000/FUZZ

# gobuster: directory mode against a lab VM
gobuster dir -u http://192.168.56.101 -w common.txt -x php,txt

Defensive / Blue-Team Tooling

Defense relies on visibility. The blue-team stack collects, correlates, and alerts on activity.

SIEM, IDS/IPS, EDR, and osquery

1. SIEM (Splunk, Elastic/ELK Stack, Wazuh) — centralizes logs and runs correlation rules to surface suspicious patterns.
2. IDS/IPS (Suricata, Snort) — inspect network traffic against signatures; IDS alerts, IPS can block inline.
3. EDR — endpoint agents that record process, file, and network activity and detect malicious behavior on hosts.
4. osquery — exposes the OS as a SQL database so you can query system state (running processes, listening ports, installed packages) across a fleet.

Practice Exercises

1. Install Kali Linux (or a tools VM) in VirtualBox/VMware and place it on a host-only network so it cannot reach the internet or your LAN.
2. Run nmap -sV -sC scanme.nmap.org and identify the open ports and service versions; then repeat against a local Metasploitable VM.
3. Capture traffic in Wireshark while loading a page, apply the filter tcp.flags.syn == 1, and locate a complete TCP three-way handshake.
4. Deploy OWASP Juice Shop locally, configure OWASP ZAP as an intercepting proxy, and modify a request in-flight to observe the app's response.
5. Run nuclei with community templates against your local Juice Shop and review which findings are true positives.
6. Stand up a Wazuh or ELK Stack instance, forward logs from a lab host, and build a dashboard that alerts when an SSH login fails repeatedly.