| Answer | Hint | % Correct |
|---|---|---|
| Nmap | Most widely used network port scanner | 68%
|
| Wireshark | Protocol analyzer for eavesdropping on and dissecting network traffic | 58%
|
| Hashcat | Password cracking tools used to reverse engineer hashed passwords (1) | 42%
|
| John the Ripper | Password cracking tools used to reverse engineer hashed passwords (2) | 42%
|
| Burp Suite | Automated vulnerability scanner for web apps | 37%
|
| Metasploit | Most popular exploitation framework. Supports thousands of plug-ins covering different exploits | 37%
|
| Hydra | Password cracking tools used to reverse engineer hashed passwords (3) | 32%
|
| Nessus | Commercial vulnerability scanner for a wide variety of devices | 32%
|
| Sqlmap | Automates SQL injection attacks against web applications with database backends | 32%
|
| Secure Shell (SSH) | Provides secure encrypted connections between systems | 26%
|
| Shodan | Search engine for vulnerable IOT devices | 26%
|
| Social Engineering Toolkit (SET) | Framework for automating the social engineering process | 26%
|
| WHOIS | Gets information from public records about domain ownership | 26%
|
| Aircrack-ng | Wireless network security testing tool (1) | 21%
|
| DirBuster | Brute-force tool used to enumerate files and directories on a web server | 21%
|
| Gobuster | Tool for discovering URIs in web servers using Brute Force | 21%
|
| Maltego | Commercial product for visualizing OSINT data | 21%
|
| Browser Exploitation Framework (BeEF) | Automated social engineering toolkit for accessing victim's browser | 16%
|
| Domain Information Groper (DIG) | Tool for DNS zone transfers (AXFR). AXFRs show DNS information through replicated DNS databases | 16%
|
| SearchSploit | Command-line tool to search database of exploits | 16%
|
| Empire | Windows PowerShell scripts used to automate Penetration Testing (2) | 11%
|
| GDB | Open-source debugger for Linux | 11%
|
| IDA | Commercial debugging tool that works on Windows, Mac, and Linux | 11%
|
| Medusa | Password cracking tools used to reverse engineer hashed passwords (4) | 11%
|
| Mimikatz | Retrieves sensitive credential information from Windows memory | 11%
|
| Ncat / NETCAT | Easy way to read and write data over network connections | 11%
|
| Nikto | Open-source web application vulnerability scanners (1) | 11%
|
| Nslookup | Identifies IP addresses belonging to an organization | 11%
|
| APKX / APK Studio | Decompile Android app packages | 5%
|
| Cain & Abel | Password cracking tools used to reverse engineer hashed passwords (6) | 5%
|
| Censys | Probes IP addresses across the internet through a search bar | 5%
|
| CeWL | Custom wordlist generator that searches websites for keywords that can be used in a dictionary attack | 5%
|
| Ettercap | Comprehensive suite for network attacks, including MitM attacks | 5%
|
| FOCA | Finds metadata in Office docs, PDFs, and other common file formats | 5%
|
| Hping | Command-line tool that allows testers to artificially generate network traffic | 5%
|
| Impacket | Set of network tools that provide low-level access to network protocols | 5%
|
| OllyDbg | Windows Debugger for binary code at assembly language level | 5%
|
| OpenVAS | Open-source alternative for vulnerability scans | 5%
|
| Peach | Fuzzing tools that generate artificial input designed to test apps (1) | 5%
|
| PowerSploit | Windows PowerShell scripts used to automate Penetration Testing (1) | 5%
|
| Recon-ng | Modular web recon framework that organizes and manages OSINT work | 5%
|
| theHarvester | Finds email addresses, employee names, and infrastructure details of an organization | 5%
|
| WiFite | Wireless network security testing tool (2) | 5%
|
| WinDbg | Windows Debugger created by Microsoft | 5%
|
| XSSer | Tests and exploits web app XSS vulnerabilities | 5%
|
| AFL | Fuzzing tools that generate artificial input designed to test apps (2) | 0%
|
| Airgeddon | Audits wireless networks | 0%
|
| Drozer | Security audit and attack framework for Android devices and apps | 0%
|
| FindBugs | Java software testing tools that perform static analysis of code (1) | 0%
|
| find-sec-bugs | Java software testing tools that perform static analysis of code (2) | 0%
|
| Immunity Debugger | Supports Penetration Testing and the reverse engineering of malware | 0%
|
| Kismet | Wireless network security testing tool (3) | 0%
|
| Patator | Password cracking tools used to reverse engineer hashed passwords (5) | 0%
|
| Proxychains | Allows testers to force connections through a proxy server for MITM alteration | 0%
|
| Responder | Toolkit used to answer NetBIOS queries from Windows systems on a network | 0%
|
| SIPVicious | Audits SIP-based VoIP systems | 0%
|
| SonarQube | Open-source inspection tool for continuous software testing | 0%
|
| Sqlninja | Exploits web apps through SQL injection | 0%
|
| SSLyze | Python tool that analyzes SSL/TLS configurations through server connection | 0%
|
| Sublist3r | Linux tool for finding hidden subdomains | 0%
|
| Ubertooth | OS Bluetooth monitoring and dev platform for accessing vulnerabilities | 0%
|
| W3AF | Open-source web application vulnerability scanners (2) | 0%
|
| Wapiti | Web app black-box vulnerability scanner | 0%
|
| YASCA | Open-source software testing tool that includes scanners for various languages | 0%
|
| Yersinia | Exploits vulnerabilities in network protocols | 0%
|