VAPT Tools: What Testers Use at Each Stage and Why

1Discovery and Information Gathering

• Nmap: finds live hosts, open ports and service versions. It is the first tool on almost every network test.
• Public sources: domain records, search engines and code sites, covered in OSINT for beginners. No special tool is needed, only patience.

2Vulnerability Assessment

• Nessus: scans hosts for known flaws and misconfigurations. Credentialed scans, where you log in to the machine, find far more than scans from outside.
• What the scanner cannot do: decide which findings are real and which matter. A scan gives candidates; you still check each by hand.

3Web and API Testing

• Burp Suite: the intercepting proxy that sits between browser and site, so you can read and change every request.
• OWASP ZAP: a free scanner and proxy, useful for automated checks and for learning.
• ffuf: finds hidden paths and parameters by trying wordlists.
• sqlmap: confirms and exploits SQL injection once you have found a likely one.

4Exploitation and Passwords

• Metasploit: a framework of tested exploits and payloads, used to prove that a flaw can be used and to remove false positives.
• Hashcat and John the Ripper: crack password hashes captured in a lab or an agreed test, to show how weak passwords fall.
• Netcat: a small tool for connections, shells and file transfer.

5Network Analysis and Active Directory

• Wireshark and tcpdump: capture and read network traffic.
• BloodHound: maps relationships inside Active Directory to show attack paths to high-value accounts.
• Pivoting tools: tunnels and port forwards that reach networks you cannot see directly.

6Mobile and Desktop Applications

• MobSF, jadx and apktool: read and analyse an Android app. Frida and objection: change an app's behaviour while it runs, for example to bypass certificate pinning in a lab. See Android app penetration testing.
• Sysinternals Process Monitor, dnSpyEx and ILSpy: watch what a desktop program does and read its code. See thick-client penetration testing.

7The Report

No tool writes the report. A VAPT is judged by whether the client can understand each finding, repeat it and fix it: evidence, impact, steps and a specific remedy. Our guide to writing a penetration testing report and the sample graded report show the standard. CVSS scores help rank the findings.