My Pentest Toolkit & Lab Setup — Hack2Harden

• Host: Windows 11 (AMD Ryzen Threadripper 2950)

• Memory: 32 GB RAM

• Storage: 1 TB NVMe (fast snapshots and VM disk resizing matter)

• VM host: VMware Workstation (latest)

Offensive VM: Kali Linux kali-2024.3 vmware-amd64

• • VM config: 4 processors, 8 GB RAM (adjust per lab)

• Network mode:

  • Use Host-only networks for isolated vulnerable VMs.

  • Use NAT only when you must reach the internet (CTF VPNs).

  • Never attach lab VMs to an unfiltered bridged network — that risks accidental exposure.

• Snapshots: take a snapshot before every engagement.

2. Core tooling (what I actually use — categorized)

Recon & scanning

• rustscan - lightning fast port scanning

• nmap — full scans, version detection, NSE scripts.

  • quick example:

      sudo nmap -sC -sV -p- -oA nmap/full 10.10.10.10
    

• ffuf — fast web fuzzing.

  • install (if not present): sudo apt install ffuf or go install github.com/ffuf/ffuf@latest

Web app

• Burp Suite — main web proxy and intruder. (Community ok; Pro if you have license)

• ffuf — dir busting and fuzzing.

• sqlmap — automated SQLi checks.

  • install: sudo pip install sqlmap (or apt install sqlmap where available)

• hydra — HTTP / form brute force for testing.

• netcat — simple shells, listeners, and servers.

• python — web servers and scripts.

Windows / Active Directory (AD)

• Impacket — common AD toolkits (wmiexec, psexec, secretsdump etc.).

  • install: python3 -m pip install impacket or clone and python3 -m pip install . in repo

• NetExec — AD enumeration and automation (install per repo instructions).

• Bloodhound — AD graphing for visibility.

• Responder — NBNS/LLMNR poisoning to capture hashes.

• ntlm_theft (or equivalent NTLM relay/harvesting tools) — for specific NTLM workflows.

Privilege escalation & post-exploitation

• linpeas.sh, winPEAS — *Linux & Windows local-privilege checks.

• PowerUp.ps1 — Windows PowerShell privilege escalation checks.

• chisel — quick TCP/HTTP reverse-forward tunnels for pivoting.

• netcat — raw sockets and simple shells.