A penetration tester's effectiveness has very little to do with how many tools they can name. It has everything to do with knowing which tool answers which question at which stage of an engagement, and how the output of one stage becomes the input to the next. Rather than list every tool in the field, this guide walks through a real engagement in order, the five stages it actually moves through, and the specific tools that carry each one.
Phase one: reconnaissance builds the target map
Every engagement starts the same way: working out what is actually there before touching anything. Nmap remains the standard for active network scanning, identifying live hosts, open ports, and running services, and its scripting engine extends that into basic vulnerability and misconfiguration checks. Alongside it, OSINT tooling builds the picture from the outside: theHarvester pulls emails, subdomains, and employee names from public sources, and Amass maps external attack surface through subdomain enumeration and DNS reconnaissance.
At this stage the goal is not exploitation, it is scope. A tester who under-invests in recon ends up testing what is easy to find rather than what is actually there, and that gap is exactly where real compromises tend to live. Everything in the phases that follow depends on how thoroughly this one was done.
Phase two: initial access is won or lost on the web layer
For most external engagements, the path in runs through a web application, which is why Burp Suite is close to non-negotiable. Its proxy sits between browser and application, intercepting and modifying requests in real time, and its scanner, repeater, and intruder tools cover everything from manual parameter tampering to automated fuzzing. OWASP ZAP offers a genuinely capable free alternative, particularly useful for teams building automated scanning into a pipeline rather than doing purely manual testing.
Where the map from phase one identifies a login form, an outdated plugin, or an exposed API, this phase is where that becomes an actual finding. Metasploit sits alongside this stage for turning a known vulnerability into a working exploit quickly, with a maintained library of exploit modules and payload generation, though most real footholds today come from a specific application flaw, phishing, or credential reuse rather than an unpatched CVE. Manual exploitation still matters just as much: understanding what a public exploit is actually doing, and adapting it when it does not work out of the box against a slightly different configuration, is what separates a tester who can only run known-good tooling from one who can handle a real engagement when nothing behaves exactly like the lab. TryHackMe's Jr Penetration Tester path rebuilds this exact judgement, with a fully rewritten web security module covering the full OWASP Top 10 against live, vulnerable targets rather than static examples.
Phase three: Active Directory turns a foothold into something worth having
A single compromised workstation is rarely the goal. Once inside a corporate network, Active Directory is where a foothold either turns into real access or goes nowhere. The typical sequence starts with authenticated enumeration: NetExec (the actively maintained successor to CrackMapExec) sweeps the domain for reachable hosts, shares, and valid credentials at scale. That enumeration feeds directly into BloodHound, which maps AD trust relationships and permission chains as a graph, surfacing attack paths from a low-privilege foothold to domain admin that would be nearly impossible to spot manually.
From there, Mimikatz remains the reference tool for credential extraction from memory, and Rubeus handles Kerberos abuse specifically, ticket requests, Kerberoasting, and ticket manipulation, often the exact step that turns a BloodHound-identified path into an actual privilege escalation. This is the area TryHackMe's Jr Penetration Tester path expanded most significantly in its 2026 rebuild, adding a full nine-room module covering exactly this sequence, enumeration through credential harvesting through lateral movement, because it reflects how central AD compromise has become to what a junior pentester is actually expected to demonstrate in an interview.
Phase four: command and control decides whether the access holds up
Once a foothold exists, something has to manage communication with it, and the choice of framework says a lot about the engagement's actual goal. Cobalt Strike remains the commercial standard for red team engagements specifically, built around long-term, stealthy operation with detailed control over network traffic patterns. Sliver has become the leading open-source alternative, cross-platform and actively maintained, popular precisely because it is free and fully inspectable.
The skill being tested at this stage is different from everything before it. It is patience and operational security: staying quiet enough, for long enough, that the question the engagement is actually answering, would a real blue team have caught this, gets a genuine answer rather than an obvious one.
Phase five: the report is the only part of the engagement most people ever see
None of the previous four stages matter if the findings never make it into something someone can act on. A professional penetration test report explains what was found, how it was found, what the actual business impact is, and what to fix first, in language a technical team can implement and a non-technical stakeholder can understand. This is consistently the most underdeveloped skill among newer testers, and it is also the one clients and employers judge most directly, because the report is usually the only artefact of the engagement anyone outside the testing team ever actually reads.
Toolkit quick reference by phase
| Phase | Goal | Tools |
|---|---|---|
| 1. Reconnaissance | Map the target before touching anything | Nmap, theHarvester, Amass |
| 2. Initial access | Turn a web flaw or vulnerability into a foothold | Burp Suite, OWASP ZAP, Metasploit |
| 3. Active Directory | Turn a foothold into domain-level access | NetExec, BloodHound, Mimikatz, Rubeus |
| 4. Command and control | Operate on compromised hosts undetected | Cobalt Strike, Sliver |
| 5. Reporting | Turn findings into an actionable deliverable | Written reports mapped to business impact |
The tool list is not the hard part
It is genuinely easy to install every tool in this guide in an afternoon. It is much harder to know which one to reach for when an engagement stalls, why a working exploit against one target configuration fails against a slightly different one, or when quiet persistence matters more than speed. That judgement only builds by moving through all five phases end to end, repeatedly, against real targets, not by memorising a checklist of software.
That is the actual argument for treating this as a toolkit to build fluency in, not a shopping list to complete. The testers who get hired and who get invited back for the next engagement are the ones who can move through this whole chain under real conditions, adapt when a phase does not go to plan, and explain clearly afterward what it means for the client's actual risk.
Frequently asked questions
Do I need to learn every tool in this guide to get a junior pentesting job? No. Depth in the core workflow, recon, web testing, basic exploitation, and Active Directory fundamentals, matters far more than breadth across every tool. C2 frameworks and advanced evasion tend to come later, once the fundamentals are solid.
Is Metasploit still relevant if most real footholds come from phishing or credential reuse? Yes. It remains essential for quickly validating exploitability and for post-exploitation modules once you already have access, even on engagements where the initial foothold came from somewhere else entirely.
Why does Active Directory tooling matter so much for a junior pentester specifically? Because most corporate engagements happen inside an AD environment, and the gap between a low-privilege foothold and a meaningful compromise is almost always an AD misconfiguration. Interviewers test this directly because it reflects real, common engagement outcomes.
What is the difference between Cobalt Strike and Sliver? Cobalt Strike is the commercial standard, widely used in professional red team engagements with mature tradecraft support. Sliver is a free, actively maintained, cross-platform alternative that has become popular precisely because it is open source and fully inspectable.
How important is report writing compared to the technical skills? More important than most new testers expect. A technically excellent engagement with a weak report gets misread or ignored by the client. The report is usually the only part of the engagement anyone outside the testing team actually reads.
Where should a beginner actually start with this toolkit? With reconnaissance and web application testing, since they require the least prior context and produce fast, visible results. Active Directory tooling and C2 frameworks are worth adding once those fundamentals are comfortable, which is exactly the order TryHackMe's Jr Penetration Tester path is structured around.
Nick O'Grady