Tool Index — Every Named Tool in One View
The tables below collect every tool the toolkit sections added to this guide — the tools the official PT0-003 objectives name that engagements are expected to recognize on sight. Use them as the final revision pass: cover the third column and name the job from the tool; then cover the first column and name the tool from the job.
Reconnaissance (Chapter 2)
| Tool | Domain | What it does — one line |
|---|---|---|
| Amass | 2 | Enumerates subdomains from many merged OSINT and DNS sources |
| SpiderFoot | 2 | Automates OSINT collection across 100+ sources and correlates it |
| Wayback Machine | 2 | Serves archived snapshots of pages, including deleted ones |
| DNSdumpster | 2 | Draws a domain's DNS records and hosts as a graph |
| Hunter.io | 2 | Finds employee email addresses and the company address format |
| WiGLE | 2 | Archives observed, geolocated wireless networks worldwide |
| InSSIDer | 2 | Surveys a live WLAN — channels, signal, overlapping APs |
| OSINT Framework | 2 | Reference chart of OSINT sources; collects nothing itself |
Vulnerability discovery (Chapter 3)
| Tool | Domain | What it does — one line |
|---|---|---|
| TruffleHog | 3 | Finds secrets in git history and verifies them live |
| Trivy | 3 | Scans container images and filesystems for CVEs |
| Grype | 3 | Matches SBOM contents against vulnerability data |
| Kube-hunter | 3 | Scans a Kubernetes cluster for exploitable weaknesses |
| Docker Bench | 3 | Audits a Docker host against the CIS benchmark |
| PowerSploit | 3 | PowerShell framework; PowerUp maps local privesc weaknesses |
Attacks and exploits (Chapter 4)
| Tool | Domain | What it does — one line |
|---|---|---|
| Rubeus | 4 | Kerberos attacks: Kerberoasting and AS-REP roasting |
| Certify | 4 | Finds and abuses vulnerable AD CS certificate templates |
| Seatbelt | 4 | Sweeps a Windows host's security posture on landing |
| Evil-WinRM | 4 | Interactive WinRM shell, password or pass-the-hash |
| PowerUpSQL | 4 | Discovers and escalates through SQL Server instances |
| Pacu | 4 | Exploitation framework for AWS accounts |
| Prowler | 4 | Cloud checks mapped to CIS controls, PASS/FAIL output |
| ScoutSuite | 4 | Multi-cloud posture audit as one HTML report |
| Aircrack-ng | 4 | Captures and cracks WPA/WPA2 handshakes; whole Wi-Fi suite |
| Kismet | 4 | Passive wireless detection and logging, incl. hidden SSIDs |
| WiFi-Pumpkin | 4 | Rogue AP / evil-twin framework with captive portals |
| WPAD | 4 | Proxy auto-discovery mechanism abused to hijack proxy settings |
| SET | 4 | Social-Engineer Toolkit: cloned pages, credential harvesters |
| Gophish | 4 | Phishing campaigns with per-user tracking and metrics |
| Evilginx | 4 | AiTM reverse proxy that steals post-MFA session cookies |
| BeEF | 4 | Controls hooked browsers and runs exploitation modules |
| Scapy | 4 | Crafts, sends, and dissects packets field by field |
| MobSF | 4 | Static and dynamic analysis platform for mobile apps |
| Frida | 4 | Runtime instrumentation; bypasses root and pinning checks |
| Drozer | 4 | Explores an Android app's IPC attack surface on-device |
| ADB | 4 | Android Debug Bridge — the mobile tools' transport |
| tcprelay | 4 | Tunnels USB/SSH access to a jailbroken iOS device |
| Bluestrike | 4 | Bluetooth attack-surface testing |
| Caldera | 4 | BAS platform chaining ATT&CK abilities in operations |
| Atomic Red Team | 4 | Library of single-technique ATT&CK detection tests |
| Infection Monkey | 4 | Self-propagating BAS agent testing segmentation |
| PowerView | 4 | PowerShell enumeration of AD objects and ACLs |
| Medusa | 4 | Parallel online logon brute-forcer for network services |
| Wfuzz | 4 | Web fuzzer using the FUZZ keyword with result filtering |
| WPScan | 4 | WordPress scanner: plugins, themes, users, known flaws |
| Postman | 4 | Interactive API request workbench for testers |
| ZAP | 4 | OWASP's free web scanner: proxy, spider, active scan |
Post-exploitation (Chapter 5)
| Tool | Domain | What it does — one line |
|---|---|---|
| Covenant | 5 | Collaborative .NET C2 with multi-operator Grunt tasking |
| sshuttle | 5 | Transparent subnet routing through a plain SSH login |
| Netcat | 5 | Raw connect/listen utility: shells, transfers, manual relays |
Final set. Question 1. A scenario needs the AWS account audited against CIS controls with evidence for the report. Pacu or Prowler? Answer: Prowler — Pacu exploits; Prowler produces the PASS/FAIL control evidence. Question 2. Which single tool both discovers subdomains (Chapter 2) and never sends traffic to the target when used through third-party sources — and which archive recovers the page the target deleted? Answer: Amass (source-driven enumeration) and the Wayback Machine. Question 3. Your only access is an SSH login on a jump host, and your local scanner must reach the whole internal subnet. Name the tool. Answer: sshuttle.
End of the Toolkit. Every tool name, category, and distinction follows the official CompTIA PT0-003 exam objectives. Tool-output samples in this book are illustrated examples created for this book and are labelled as such wherever they appear.
Want the full CompTIA PenTest+ (PT0-003) package?
This guide is free to read. Get the full PT0-003 practice exam — 750 questions plus 10 PBQs — with the complete PDF and online access.
Get PT0-003 Full Access — $10