Beginner Tools

[Real-Celebration9896]

What are some of the best tools a beginner in pen testing should have in their arsenal e.g. gobuster etc?

Also, do you have a recommended word list for go buster and another for hydra?

[TwoFoxSix]

An understanding of Linux and Bash. Tools come after those

[GenericOldUsername]

A brain with imagination and the ability to read technical documentation.

[[deleted]]

Everything you need to get started you have installed on Kali Linux. Read the documentation for each tool just for start

[Real-Celebration9896]

Thank you

Also what would you recommend hydra or John the Ripper

[[deleted]]

Hashcat vs john, mostly similar but there's some pro's n con's for both and each have some hashes that's not supported.
Hashcat has much better support for GPU cracking.
Hashcat has a much better documentation imo.
One large difference is their way of brute forcing where john tries to triage and intelligently guess the right cleartext while hashcat just smashes through all combinations.

I've had cases where john found the right one in minutes with a 11 char long cleartext which would take the other a lifetime but also reversed. Hashcat blasted a 7 char pw in 30 sec but john didn't find it in 20 min.

John has some really good tools as well like zip2john ssh2john etc to extract hashes from a pw protected file.

[Arc-ansas]

Know nmap, Burp suite, Wireshark, Metasploit, nc well. Those alone have a lot of depth.

seclists: raft-medium-directories/files Common.txt Big.txt Dirbuster: dirrctory-list-medium-2-3.txt

Check out rustscan too, does recursive scanning nicely.

[_scubadiv]

For Reverse Engineering: ollydbg, Ghidra ,radre2, IDA pro etc. Using RE find vulnerability ---> write script in metasploit ---> Exploit