Threats, attacks & vulnerabilities
Security Assessment Tools
Overview
These are the core tools referenced throughout this section and the rest of the roadmap — organized by which layer of a system they operate on.
Key concepts
- Network/system: Nmap, Nessus
- Web application: Burp Suite, OWASP ZAP
- Analysis: Wireshark, Sysmon, SIEM
Tools & techniques
| Tool | Purpose | When to use |
|---|---|---|
| Nmap | Network/port/service discovery | Recon and asset discovery |
| Nessus | Vulnerability scanning | Authorized internal scans |
| Burp Suite | Web app traffic testing | Web application assessments |
| Wireshark | Packet capture/analysis | Traffic investigation |
| SIEM | Log collection, correlation, alerting | Ongoing monitoring/SOC work |
How it works
Network & system tools
| Tool | Purpose |
|---|---|
| Nmap | Discovers devices, open ports, services, and OS information on a network. |
| Nessus | Vulnerability scanner — identifies known weaknesses, missing patches, and insecure configurations. |
Web application tools
| Tool | Purpose |
|---|---|
| Burp Suite | Web-security testing platform for inspecting and testing web app traffic. |
| OWASP ZAP | Web-application security scanner for finding common vulnerabilities. |
Analysis tools
| Tool | Purpose |
|---|---|
| Wireshark | Captures and inspects network traffic packet-by-packet. |
| Sysmon | Windows system-monitoring tool that records detailed security-related events. |
| SIEM | Collects, analyzes, and alerts on security logs across an environment. |