Thread by @CristiVlad25

These 5 tools and techniques have completely transformed my pentesting and appsec assessments:

(thread)

1. Burp Suite PRO + Extensions (@PortSwigger)

This is my bread and butter. Honestly, when testing web and mobile applications, I don’t think I could do without.

2. Source Code Analysis/Review

Be it a mobile or web app, it’s never a bad idea to look into the code, in addition to all the dynamic testing.

I often find a lot of insecurities in my clients’ code. I also get a lot of help from #AI tools, such as #gpt3.

3. Masscan + Nmap + httpx (@pdnuclei)

In network/infrastructure pentests, when mapping the attack surface, one technique I use is a bash script that combines masscan, nmap, and httpx seamlessly for automation. If you’re smart you can reverse-engineer my process.

4. Nox (@NoxAppPlayer)

After using Genymotion avidly for a long time, I can say hands-down that Nox does a far better job in dynamically testing Android apps.

5. VPS

I use @HelloPaperspace because it let's me pay per hour of usage. And they’ve got nice prices, IMO.

Plus, I’ve made myself a script to install all I need for recon-related stuff in one go.

You can check them out via my referral: bit.ly/cristipaperspa…

6. There's much more that I haven't touched. Plus tips for cloud security assessments, internal pentests, and red teaming. Stay tuned.

Like, retweet this, and follow me for more @CristiVlad25

#infosec #pentesting #cybersecurity #ethicalhacking #bugbounty

1.1. I've also made a course on Burp Suite: bit.ly/burpforpros