Security Tools
Exam questions describe a task and ask which tool does it. The grouping below is by task rather than by name, because that is how the question arrives.
Security Tools · firsttry.app/cheatsheets/security-tools · original reference written from published exam objectives. Not affiliated with any certification body.
Which tool for which job
| Task | Tool |
|---|---|
| Discover live hosts and open ports | Nmap |
| Capture and inspect packets | Wireshark, tcpdump |
| Scan for known vulnerabilities | Nessus, OpenVAS, Qualys |
| Test a web application | Burp Suite, OWASP ZAP |
| Exploit a known vulnerability | Metasploit |
| Crack password hashes | Hashcat, John the Ripper |
| Attack a login form or service | Hydra, Medusa |
| Enumerate web directories | Gobuster, dirb, ffuf |
| Attack or audit wireless | Aircrack-ng, Kismet |
| Analyse malware statically | strings, PEiD, Ghidra |
| Aggregate and correlate logs | Splunk, Microsoft Sentinel, ELK |
| Search a host for indicators | Sysinternals, osquery, Velociraptor |
Nmap flags worth knowing
| Flag | What it does |
|---|---|
| -sS | SYN scan. Half open, the default for a privileged user |
| -sT | Full TCP connect scan. Noisier, no privileges needed |
| -sU | UDP scan. Slow |
| -sV | Service and version detection |
| -O | Operating system fingerprinting |
| -A | Aggressive: version, OS, scripts and traceroute |
| -p- | All 65535 ports |
| -Pn | Skip host discovery, treat the host as up |
| -T0 to -T5 | Timing. T0 is paranoid and slow, T5 is fast and loud |
| --script vuln | Run the vulnerability script category |
Wireshark and tcpdump filters
| Filter | What it shows |
|---|---|
| ip.addr == 10.0.0.5 | Wireshark: traffic to or from one host |
| tcp.port == 443 | Wireshark: one port |
| http.request.method == "POST" | Wireshark: POST requests only |
| tcp.flags.syn == 1 && tcp.flags.ack == 0 | Wireshark: connection attempts |
| dns | Wireshark: DNS traffic |
| host 10.0.0.5 | tcpdump: one host |
| port 53 | tcpdump: one port |
| -i eth0 -w out.pcap | tcpdump: capture an interface to a file |
Exams covered
Now test yourself
Memorizing a table is a start. Practice questions are what make it stick, and every answer carries the full explanation.