30 Tools for Six Core Information Security Tasks: From Recon to Forensics

An administrator inherits a modest infrastructure consisting of one website, a database, and a single server. A file labeled "old passwords DO NOT DELETE" sits on the previous admin's desktop, while accounting requests renewal of a certificate for an undocumented asset named test2 that has been billed for three years.

Reconnaissance – discovering assets on the network

Subfinder accepts a domain and queries passive sources to return subdomain names. Censys reveals how hosts, services, and certificates appear from the public internet, including observation dates that may predate current hardware. OWASP Amass maps multiple domains and historical address changes using both passive and active techniques. theHarvester extracts email addresses, subdomains, and organizational traces from open sources. SpiderFoot correlates findings across modules to build relationship graphs. All discoveries should be recorded with name, source, date, and confirmer, such as "test2 – accounting test server, confirmed by Lena."

Web testing – inspecting hidden application behavior

Burp Suite acts as a proxy to compare requests and responses between different user accounts in its Repeater tool. ZAP supports both passive observation and active checks while reviewing login sequences. Nuclei runs repeatable checks via templates and helps interpret version-based versus behavior-based detections. ffuf performs web fuzzing of paths and parameters, requiring manual review of 200 responses that may hide "not found" pages. sqlmap tests specific parameters for SQL injection and supplies context for developer reports.

Infrastructure scanning – visibility from inside and outside

Nmap identifies open ports and services while noting filtered states that depend on the scanner's network location. Wireshark captures packet-level details of DNS queries and connection attempts even when HTTPS content remains encrypted. Greenbone Community Edition / OpenVAS allows scheduled scans and comparison of results after signature database updates. Lynis audits Linux or Unix-like systems for configuration improvements relevant to their role as web servers or developer workstations. testssl.sh evaluates TLS versions and ciphers, accounting for load balancers that may override backend settings.

Incident response – handling nighttime server anomalies

Zeek produces structured logs such as conn.log for tracking communication partners and data volumes. Wazuh collects host events and file integrity changes, testable by modifying monitored files on a test system. Suricata raises alerts on matching traffic rules, providing signature names, addresses, and timestamps. Sigma offers a portable rule format translatable to various log systems, requiring verification that command-line fields exist in the target logs. YARA scans files for string and byte patterns, with rules tuned to avoid excessive false positives on common binaries.

Forensics – examining yesterday's disk image

Autopsy parses disk images to locate files, directories, and metadata such as nightly exports. Velociraptor enables remote artifact collection across dozens of machines while minimizing data volume. Plaso builds timelines from supported logs and files, preserving source attribution for each timestamp. Timesketch supports collaborative review of timelines and timezone verification across sources.

Development security – preventing secrets in builds

Gitleaks searches Git history for tokens that were later removed from the current commit. Trivy scans container images for vulnerable packages and identifies those inherited from base images. OWASP Dependency-Check matches project dependencies against published vulnerabilities, requiring confirmation of exact library names and versions. Semgrep detects code patterns described in rules to locate deprecated function calls. Checkov analyzes infrastructure-as-code such as Terraform configurations for overly permissive settings before and after deployment.

Proper documentation now includes the purpose of test2, reachable hosts, and the correct certificate location, allowing future renewals to reference a single accurate record.