Penetration Testing and Bug-Bounty Hunting Tools

• Browser-proxy and app-logic GUIs.
  
  
• Vuln-scanners with exploits and payloads.
  
  
• Automated testing drivers.
  
  

There is lots of overlap, and tools can import/export among each other.

• Look at the developer tools / debugger in your browser.
  
  
• Burp:
  
  
  
  GUI app with intercepting-proxy, mainly does web-app testing.
  Can import nmap scan output into it.
  
  PortSwigger's "Burp Suite Editions"
  Professional version costs €349 per year.
  
  Free edition has the proxy and good traffic-recording and repeating and modification and parameter brute-forcing/fuzzing, but lacks the Scanner (which is a great module for trying classes of app vulns/exploits). Also, Free edition is throttled so it does iterations much slower.
  
  ZeroSec's "Learning the Ropes 101: Burp Suite Intro"
  InfoSec Institute's "Quick and Dirty BurpSuite Tutorial"
  PortSwigger's "The Burp Methodology"
  Jean Fleury's "Burp Suite For Beginners"
  Bugcrowd University - Introduction to Burp Suite (video)
  PortSwigger's "Burp Suite Support Center"
  The Defalt's "Bypass File Upload Restrictions Using Burp Suite"
  OccupyTheWeb's "How to Hack Web Apps, Part 3 (Web-Based Authentication)"
  OccupyTheWeb's "How to Hack Web Apps, Part 4 (Hacking Form Authentication with Burp Suite)"
  OccupyTheWeb's "How to Crack Online Web Form Passwords with THC-Hydra & Burp Suite"
  Ryan Wendel's "Burp Suite Tips - Volume 1"
  Articles in Hacking Articles' "Web Penetration Testing"
  
  Yeah Hub's "19 Most Useful Plugins for Burp Suite"
  Offensive Security by Automation's "Worthwhile BurpSuite Plugins"
  Regala / burp-scope-monitor
  Trust Foundry's "The Top 8 Burp Suite Extensions That I Use to Hack Web Sites"
  
  HUNT Suite Proxy Extensions (indicates parameters where you should look manually for bugs)
  Do Son's "HUNT Burp Suite Extension"
  Ranjith's "HUNT = Burp Suite Pro/Free and OWASP ZAP Extensions"
  
  PortSwigger's "Burp Collaborator"
  integrity-sa / burpcollaborator-docker
  
  Backslash Powered Scanner (Burp extension):
  PortSwigger / backslash-powered-scanner
  James Kettle's "Backslash Powered Scanning: hunting unknown vulnerability classes"
  
  Get lists from danielmeissler / SecLists and fuzzdb-project / fuzzdb and plug them into the Intruder module.
  
  Installed Burp Community Edition on my Mint 19.1 system, using
  PortSwigger's "Getting started with Burp Suite":

  
  
  # Initial download is a 95 MB ".sh" script file !
  
  sudo bash ./burpsuite_community_linux_v1_7_36.sh
  # says it's taking about 530 MB
  # installing into /opt/BurpSuiteCommunity
  # creating symlinks in /usr/local/bin
  
  # go to Start menu and find Burp Suite Community Edition
  
  # Get Welcome screen that says you can only do Temporary projects with this edition
  # Click through next screen, accepting default config values
  # Get to main screen - Temporary Project
  # Don't exit the app; keep it running while setting up the browser
  # in following steps:
  
  # In Firefox browser, go to Preferences / General / Network Settings.
  # Select Manual Proxy Configuration, HTTP Proxy 127.0.0.1, Port 8080,
  # and Use this proxy server for all protocols.
  
  # Click "Intercept is On" button in app to make
  # it change to "Intercept is off".
  
  # Install Burp's trusted root certificate in the browser, so the proxy can
  # generate a new cert for each SSL session/site it intercepts
  # https://support.portswigger.net/customer/portal/articles/1783075-installing-burp-s-ca-certificate-in-your-browser
  Go to http://burp/ in browser
  # Request should be intercepted by Burp application
  # See a page saying "Welcome to Burp Suite Community Edition."
  # If instead you get some domain-parking service, the proxy is not working.
  # Click on "CA Certificate" in upper-right of page.
  # Save certificate file to disk.
  
  # In Firefox browser, go to Preferences / Privacy & Security /
  #		Certificates / View Certificates / Authorities
  # Click Import.  Choose the file you saved to disk.
  # Check "Trust this authority to identify websites".
  
  # Normal browsing works with app running, proxy used, intercept off.
  # See "HTTP History" tab to look at all the traffic that went through.
  
  # Proxy works fine with Windscribe VPN running too.
  
  # Some web sites react strangely to this setting, turn it off:
  # In ZAP, go to Tools / Options / Local Proxy and turn off "Remove Unsupported Encodings"
  
  # I don't see anything for overall project management: OSINT, reporting, etc.
  

  
  It's a good practice to set the Target - Scope before connecting to the proxy and the network. You don't want to hit anything unintentionlly.
  
  To run Burp on your computer and have Wi-Fi from your phone go through Burp, you set your phone to use an HTTP proxy, with Server address set to your computer and Port number set to 8080 (as usual), and Burp's Proxy Listener set to "All Interfaces" instead of just "Loopback".
  
  Later decided to remove Burp and concentrate on OWASP ZAP instead:

  
  sudo /opt/BurpSuiteCommunity/uninstall
  

  
  
  
  
  
  
•   OWASP ZAP (zaproxy; Zed Attack Proxy):
  
  
  
  GUI app with intercepting-proxy, mainly does web-app testing.
  Has limited port-scanner; I think it can't import nmap output.
  I don't see any connection to Metasploit.
  Has some kind of Selenium component in it, so it can drive a browser and do AJAX spidering.
  Uses dirbuster code in the "forced browsing" component to find pages or files that don't appear anywhere in the application pages.
  Uses Wappalyzer.
  Uses sqlmap core.
  Has a CMS scanner.
  
  OWASP ZAP
  
  OWASP Zed Attack Proxy Project
  HUNT Suite Proxy Extensions
  
  zaproxy / zaproxy Wiki
  reddit's /r/OWASP
  OWASP ZAP User Group
  zaproxy's "FAQmobile"
  
  Kali Linux's "ZAP -- Most Used Web Vulnerability Scanner"
  Devopedia's "OWASP ZAP"
  zaproxy / zap-core-help (to run ZAP from CLI)
  Grunny / zap-cli (to control ZAP from CLI)
  
  Has a scripting language (Zest) based on JSON. Used to send bug-reproducing scripts to companies (if you wish), define scan-rules, more.
  
  Understands concepts of:

  • Context: a set of URLs, usually representing one web-app.
  • Session Management Method: how web sessions are handled by the server (cookie-based, HTTP authentication, query-param based, etc).
  • Authentication Method: how a new session is established.
  • User Management: relating users to authorization for operations.

  See "Session Properties" dialog (icon for it on toolbar).
  And fields in that dialog can be filled in automatically after you login through the browser; select the HTTP request recorded and send it to dialog.
  There are regex properties to tell app when a state is logged-in or logged-out.
  
  Installed OWASP ZAP on my Mint 19.1 system:

  
  
  sudo sh -c "echo 'deb http://download.opensuse.org/repositories/home:/cabelo/xUbuntu_18.04/ /' > /etc/apt/sources.list.d/home:cabelo.list"
  wget -nv https://download.opensuse.org/repositories/home:cabelo/xUbuntu_18.04/Release.key -O Release.key
  sudo apt-key add - < Release.key
  sudo apt update
  sudo apt install owasp-zap
  
  # launch from CLI
  owasp-zap
  
  # In Firefox browser, go to Preferences / General / Network Settings.
  # Select Manual Proxy Configuration, HTTP Proxy localhost, Port 8080,
  # and Use this proxy server for all protocols.
  
  # In OWASP ZAP, go to Tools / Options / Dynamic SSL Certificates.
  # You should see a certificate's text in the big text pane.
  # Click on Save and save a ".cer" file to disk.
  
  # earlier, I created a profile called "testing" for Firefox, so run:
  firefox -P testing -no-remote
  
  # In Firefox browser, go to Preferences / Privacy & Security /
  #		Certificates / View Certificates / Authorities
  # Click Import.  Choose the file you saved to disk.
  # Check "Trust this authority" for everything.
  

  
  Installed OWASP ZAP on my Kubuntu 20.10 system:

  
  
  flatpak install ZAP
  # Couldn't get it to work: Quick Start / Manual wouldn't launch any browser,
  # and I couldn't figure out how to set the cert and proxy in
  # any browser except Firefox.  I don't want to use Firefox, since that's
  # my main browser.
  
  snap install --classic zaproxy
  # Same problems.
  
  # launch from GUI
  # update add-ons
  # go to Safe mode
  
  # Unable to change proxy settings inside any chromium-based browser
  # installed as snap or flatpak.
  
  # Firefox is installed as deb, but it's my main browser, don't want to mess with it.
  
  sudo apt install midori
  # In Midori browser, go to Hamburger / Preferences / Network.
  # Select HTTP Proxy Server, HTTP Proxy http://localhost, Port 8080.
  
  # In OWASP ZAP, go to Tools / Options / Dynamic SSL Certificates.
  # You should see a certificate's text in the big text pane.
  # Click on Save and save a ".cer" file to disk.
  
  # Use a chromium browser to save that certificate into the system store.
  # Settings / Privacy and security / Security / Manage certificates / Authorities / Import / All Files
  
  ...
  

  
  Getting started:

  

  1. Launch ZAP ("owasp-zap" on CLI, or through GUI). In upper-left corner, select Safe Mode.
     
     
  2. Launch the browser. Make sure it's using the ZAP proxy.
     
     
  3. Don't type an URL into ZAP's "Quick Start" tab; ZAP would start crawling the site right away.
     
     
  4. Go to the browser and browse the target site a bit.
     
     
  5. Then go to ZAP and look in the Sites and History tabs.
     
     
  6. ZAP analyzes all the requests and responses it records ("passive scanning"), and reports any potential issues in the Alerts tab.
     
     Select a request in the Alerts tab, and see the request or response headers and data. Double-click on the request in the Alerts tab to get an explanation of the issue.
     
     
  7. Set a limit on things by adding the specific target site to the "Default Context". Delete any traffic to other sites out of the Sites tab.
     
     
  8. Each "Context" is supposed to represent a web-application.
     
     
  9. Once you've set the Context, you can change from "Safe" mode to "Protected" mode. This will let you attack anything in the Context.
     
     Safe == can't do anything dangerous
     Protected == can do dangerous things only in Context/Scope,
     Standard == can do anything to anything,
     Attack == automatically attacks any new items that appear in Context/Scope.
     
     
     
  10. At the right end of the tabs list that starts with Alerts, click on the green "+" symbol. Click on Spider, and click on New Scan.
      
      It should spider only the site you specified, finding all the pages. Maybe click the Stop icon after it has spidered a dozen pages. Look at Alerts again.
      
      
  11. If you have permission to attack the site, find Active Scan and click New Scan. A dialog will appear to define the scope; click Select and then Default Context (where you put the site). Then start the scan. (Not sure what to do with Recurse)
      
      It should scan only the site you specified, trying lots of parameters. Maybe click the Stop icon after it has done a few pages. Look at Alerts again.
      
      
  12. When you get going on a real app, after manual browsing but before Active Scanning, go to Tools / Options / Anti CSRF Tokens and add any token names that might be custom. Also go to Tools / Options / Active Scan and enable "Handle anti CSRF tokens".
      
      

  
  Later un-installed OWASP ZAP:

  
  
  # went into my testing profile of Firefox
  # deleted OWASP proxy out of list in FoxyProxy
  # deleted OWASP's CA certificate out of certificate store
  
  sudo apt remove owasp-zap
  
  cd ~
  rm -fr .ZAP
  

  Installed the weekly release of OWASP ZAP:

  
  
  # downloaded weekly .zip file from https://github.com/zaproxy/zaproxy/wiki/Downloads
  
  extract from .zip to somewhere such as /usr/local/bin
  
  # create file /usr/local/bin/owasp-zap containing:
  #!/bin/bash
  cd /usr/local/bin/ZAP_D-2019-03-04
  ./zap.sh
  
  chmod a+x   # on that file
  
  # launch from CLI
  owasp-zap
  
  # earlier, I created a profile called "testing" for Firefox, so run:
  firefox -P testing -no-remote
  
  # In Firefox browser, go to Preferences / General / Network Settings.
  # Select Manual Proxy Configuration, HTTP Proxy localhost, Port 8080,
  # and Use this proxy server for all protocols.
  
  # In OWASP ZAP, go to Tools / Options / Dynamic SSL Certificates.
  # You should see a certificate's text in the big text pane.
  # Click on Save and save a ".cer" file to disk.
  
  # In Firefox browser, go to Preferences / Privacy & Security /
  #		Certificates / View Certificates / Authorities
  # Click Import.  Choose the file you saved to disk.
  # Check "Trust this authority" for everything.
  
  # the proxy threw some error, had to quit browser and ZAP and
  # then run again, all fine now
  
  # new HUD feature is annoying, in ZAP go to Tools / Options / HUD
  # to turn it off for now
  

  If you launch ZAP and a new weekly release is available, ZAP will tell you about it, and give you a "Download" button. Download it, but don't launch it. Quit out of ZAP. Then:

  
  sudo bash
  cd ~/.ZAP_D/plugin
  mv ZAP_WEEKLY_D-*.zip /usr/local/bin
  cd /usr/local/bin
  rm -fr ZAP_D-*
  unzip ZAP_WEEKLY_D-*.zip
  xed owasp-zap		# and change it to point to the new tree
  rm ZAP_WEEKLY_D-*.zip
  

  
  If menu items are greyed-out and you can't figure out how to edit a Request, check to make sure the mode is set to "Standard" or higher.
  
  From someone on reddit 5/2022:
  "There are certain challenges in portswigger labs that cannot be done using zap. For example, the host header injection won't work in zap due to the way zap programmed when resolving the url. SSRF labs as well because the server of the labs are not connected to the internet and only connected to the burp collaborator server."
  
  Cyber Army's "Authenticated Scan using OWASP-ZAP"
  
  
  
• Caido:
  
  Caido
  
  
  
• Vega Vulnerability Scanner:
  
  Subgraph's "Vega Vulnerability Scanner"
  
  TokyoNeon's "Scan Websites for Potential Vulnerabilities Using Vega in Kali Linux"
  
  
  
• Arachni:
  
  Arachni / arachni
  
  Mozes Cermak's "Scan Websites for Vulnerabilities with Arachni"
  
  
  
• Pappy:
  
  Synex's "Pappy Proxy"
  
  
  
• SecApps Suite from Websecurify:
  
  SecApps Suite
  
  
  
• mitmproxy:
  
  mitmproxy
  MobSF / httptools
  
  
  
• Telerik Fiddler:
  
  Telerik Fiddler
  
  
  
• Pown CDB:
  
  pownjs / pown-cdb
  
  
  

Non-GUI ways of driving web pages or accessing URLs:

• A few HTTP operations, no JavaScript:
  
  

  • curl:
    
    "curl PAGEURL"
    "curl --head PAGEURL"
    From curl docs: "We hide HTTP/2's binary nature and convert received HTTP/2 traffic to headers in HTTP 1.1 style."
    "curl --head --http2 PAGEURL"
    "curl --head --http3 PAGEURL"
    
    
    
  • http:
    
    "sudo dnf install httpie"
    "http google.com"
    "http --headers https://www.billdietrich.me/"
    Apparently always does HTTP 1.1; no way to specify HTTP 2 or 3.
    
    
  • fetch:
    
    
    
    
  • wget:
    
    "wget --server-response billdietrich.me"
    "wget --server-response --inet6-only billdietrich.me"
    Apparently always does HTTP 1.1; no way to specify HTTP 2 or 3.
    Linux Shell Tips article
    
    
    
  • wget2:
    
    Bobby Borisov article
    https://gitlab.com/gnuwget/wget2
    Supports HTTP 1.1 and 2.
    
    
  
  
  
  
• A sequence of HTTP operations, with detailed control and visibility:
  
  GUI or headless browser using a proxy, then:
  
  

  • Burp with scripting:
    
    
    
    
  • ZAP with scripting:
    
    
    
    
  
  
  
  
• A lot of HTTP operations, with varying parameters:
  
  GUI or headless browser using a proxy, then:
  
  

  • Burp with module:
    
    
    
    
  • ZAP with module:
    
    
    
    
  
  
  
  
• Non-GUI to complicated pages with lots of JavaScript:
  
  Headless or text browser driven by something.
  
  Browsers:
  
  

  • Headless Firefox:
    
    MDN's "Headless mode"
    "About:profiles", create a profile, "firefox -P NEWPROFILENAME -headless"
    
    
    
  • Headless Chrome:
    
    hc
    google-chrome --headless --disable-gpu --dump-dom https://somedomain/somepage
    
    
    

  Run GUI from cron job: need to run as a valid user instead from root.

  * * * * * su MYUSERNAME -c "DISPLAY=:0.0 /usr/bin/firefox -new-window x.com/iqms/packetloss/iqmspacket2.html";

  
  Drivers:
  
  

  • Selenium:
    
    seleniumhq
    
    Firefox:
    MDN's "Automated testing with headless mode"
    MDN's "Setting up Selenium in Node" (Firefox)
    Chrome:
    selenium-with-headless-chrome
    
    
    
  
  
  
  
• GUI to complicated pages with lots of JavaScript:
  
  GUI browser with macro-engine extension.
  
  

  • iMacros for Firefox:
    
    Firefox browser extension.
    Extension
    
    But in free version: only macros saved as bookmarks can be saved/played; can't save data to a file.
    
    
    
  • UI.Vision Kantu for Firefox:
    Firefox browser extension.
    Extension
    Selenium IDE commands
    
    But in Kantu 5.1.9 after doing an "open" command in a macro, I get "No ipc available for the playing commands tab".
    Have to install XModules - Extension Modules for Kantu ?
    On Linux, download ZIP file, extract files to a directory "XModules", then:

    
    sudo bash
    mv XModules /opt
    cd /opt/XModules
    chmod +x *
    bash ./1install.sh
    

    But that didn't fix the problem.
    Found that, after opening Kantu window, only first macro run will have the "open-IPC" problem. Just run the macro again and it works. Filed a bug report.
    
    Kantu window stuck in foreground, in front of normal browser window, so can't get "Enter" to work. Filed a bug report.
    
    You can create a bookmarklet to run a Kantu Macro:

    javascript:(function() {try {var evt = new CustomEvent('kantuRunMacro', {detail: {name: 'NAMEOFMACRO',from: 'bookmark',storageMode: 'browser',closeKantu: true} }); window.dispatchEvent(evt);} catch (e) {alert('Kantu Bookmarklet error: ' + e.toString());} })();

    
    Empty tabs/windows:

    Weirdness with empty tabs/windows:
    
    

    • You can run a macro from an empty tab when started from the Kantu extension. The Kantu extension can load a new webpage by itself.
      
      
    • You can not run a macro from an empty tab when started from a bookmark. The reason is that these JavaScript "bookmarklets" need a "normal website" to work. So on an empty tab or e. g. the Chrome settings page the bookmark fails to run and thus Kantu is never started.
      
      

    
    
    
    
    
    
  
  
  
  

•   Metasploit:
  
  
  Text-UI app, framework of modules, heavily focused on exploits and payloads. A GUI front-end is available: Armitage.
  
  Rapid7 Metasploit
  There are Pro, Student, and Framework versions. Most features are in Pro version, which is VERY expensive (multiple thousands of $ per year). Other two versions are free.
  
  Also Nexpose, which is a larger framework that integrates with Metasploit ? Not sure.
  
  Very basic nmap-metasploit-meterpreter intro: The Cyber Mentor's "Pentesting for n00bs: Episode 1 - Legacy (hackthebox)" (video)
  Ceos3c's "Hacking with Metasploit: Basic Commands"
  Ceos3c's "Metasploit Workspaces - How to work with them"
  Ceos3c's "Metasploit failed to connect to the Database: FIXED"
  Ceos3c's "Information Gathering with Metasploit: Shodan"
  DRD_'s "Use Metasploit's WMAP Module to Scan Web Applications for Common Vulnerabilities"
  DRD_'s "Discover Open Ports Using Metasploit's Built-in Port Scanner"
  DRD_'s "Exploit Shellshock on a Web Server Using Metasploit"
  OccupyTheWeb's "Getting Started with Metasploit"
  OccupyTheWeb's "Metasploit for the Aspiring Hacker, Part 1 (Primer & Overview)"
  Gr3yC1oud's "Metasploit Tutorial : Set up ~ 1"
  Offensive Security's "Metasploit Unleashed" (free online course)
  SecurityTube's "Metasploit Framework Expert (SMFE) Course Material" (videos)
  pentest_it's "How to add a module to Metasploit from Exploit-DB"
  Threat Week's "Database Service Enumeration" (once you have DB login credentials)
  
  From people on reddit:
  "You need to download everything to add to it. Look up a null byte video or hak5 they go pretty in depth with how metasploit works and all the tools and extensions you need for it to run smoothly."
  "Just because the tool says the web app is vulnerable doesn't mean it is per se. Lots of times the exploit runs but AV or firewall will kill the bind shell / rev shell whatever. Then we get that fun 'exploit completed but no session created' message."
  
  
  
  
  
• Armitage:
  
  A front-end that provides a GUI and workflow and collaboration tools on top of Metasploit.
  Armitage
  
  Tightly integrated with Metasploit Framework, and requires it to run.
  Can direct operations through nmap and Metasploit add-ons.
  
  Raphael Mudge's "Tutorial: Hacking Linux with Armitage"
  
  
  
• DarkSpiritz:
  
  M4cs / DarkSpiritz
  
  
  
• Sn1per:
  
  Sn1per
  
  
  
• Tulpar:
  
  tulpar
  
  anilbaranyelken's "Tulpar - Python Web Application Vulnerability Scanner + Telnetlib"
  
  
  
• OpenVAS:
  
  
  
  "OpenVAS is THE open source vulnerability scanner. OpenVAS started under the name of GNessUs, a fork of the previously open-source Nessus scanning tool (which costs you money now). OpenVAS is also under the GNU General Public License (GPL)."
  from Ceos3c's "How to install OpenVAS on Kali Linux"
  Also called "Greenbone Security Assistant" ?
  
  OpenVAS
  Launchpad: Mohammad Razavi's "openvas vulnerability scanner" (no way to file bugs there)
  mikesplain / openvas-docker
  
  Barrow's "Install OpenVAS for Broad Vulnerability Assessment"
  Barrow's "Perform a Large-Scale Network Security Audit with OpenVAS's GSA"
  
  Jon Masters' "Get OpenVas Working Properly in Kali"
  Ceos3c's "Vulnerability Scanning With Metasploit" (how to run OpenVAS from inside Metasploit)
  
  Greenbone Community Portal
  reddit's /r/openvas
  
  Tried to install OpenVAS9 non-Docker on my normal Mint 19.1 desktop,
  mostly following Launchpad: Mohammad Razavi's "openvas vulnerability scanner":

  
  
  sudo add-apt-repository ppa:mrazavi/openvas
  sudo apt update
  
  #only on Kali:      sudo apt dist-upgrade
  
  sudo apt install openvas9
  # it installed Redis local database, which I removed earlier
  password    a42db2d2-1351-4f46-b950-887f8383c79f
  # clumsily managed to hit ctrl-C while it was going,
  # had to do again, hope it's okay
  
  sudo apt install sqlite3
  # next few steps download maybe 1 GB of scripts and signatures etc
  sudo greenbone-nvt-sync
  sudo greenbone-scapdata-sync
  sudo greenbone-certdata-sync
  # last two gave a couple of "xsltproc: not found" errors at the end
  
  sudo service openvas-scanner restart
  sudo service openvas-manager restart
  #sudo openvasmd --migrate #only for upgrade from an older version
  sudo openvasmd --rebuild --progress
  # gave "Rebuilding NVT cache... failed."
  
  # To enable pdf reports:
  sudo apt install texlive-latex-extra --no-install-recommends
  # but it got stuck on that, at 93% and 14%
  # failed on libpotrace0_1.14-2_amd64.deb
  # and texlive-pictures_2017.20180305-1_all.deb
  sudo apt install texlive-fonts-recommended --no-install-recommends
  # also complains about libpotrace0_1.14-2_amd64.deb 
  # tried    sudo apt install libpotrace0    same error
  
  sudo apt install libopenvas9-dev
  
  # For web interface for version 9, go to https://localhost:4000
  Use "admin" as username and password.
  
  # Added security exception in browser, able to log in and see interface.
  
  Scans - Tasks - purple Task Wizard icon in upper-left.
  Selected address 192.168.0.1
  Start Scan
  # "Internal error", "(Status code 500) Operation 'Run Wizard' failed".
  
  Turned off Windscribe VPN, no difference.
  Tried http://localhost:4000, doesn't work.
  

  Can't even figure out where to file bug reports about this.
  
  Tried to install OpenVAS9 Docker-version on my normal Mint 19.1 desktop,
  mostly following mikesplain / openvas-docker:

  
  
  # get rid of some stuff from non-Docker attempt
  sudo apt remove openvas9
  sudo rm /etc/apt/sources.list.d/mrazavi-openvas-bionic.list
  sudo apt update
  
  sudo apt install docker
  sudo service docker start
  # Fails.  Rebooted, tried again, still fails.
  # Had to rip out and install Docker properly;
  # see Docker section of my Linux page
  # Got Docker working !
  
  sudo docker run -d -p 443:443 --name openvas mikesplain/openvas
  # This defines and loads a container and starts it running.
  # It downloaded over 1.5 GB of stuff, then gave error
  # "ERRO[0413] error waiting for container: context canceled"
  # But the -d means "run in detached mode", and "ps -ax" shows
  # a bunch of openvas* processes running, waiting for a connection
  # from a client.  "sudo docker top openvas" shows similar.
  # "sudo netstat -tulp" shows openvas listener on IPv6 but not IPv4.
  # "ip -c addr" shows a new "vethe*" network device.
  
  https://localhost:4000
  admin / admin to log in
  
  # stop the container
  sudo docker stop openvas
  
  # start the container (no need to define and load it again)
  sudo docker start openvas
  
  # didn't have to do this:
  # edit /etc/default/openvas-gsa to add:
  ALLOW_HEADER_HOST=localhost
  # then reboot
  
  # To use OpenVAS Manager:
  # sudo docker run -d -p 443:443 -p 9390:9390 --name openvas mikesplain/openvas
  
  # check status
  sudo docker top openvas
  
  # to run bash inside the container
  sudo docker exec -it openvas bash
  
  # running the app through browser:
  Greenbone Security Assistant version 7.0.3
  
  Scans - Tasks - purple Task Wizard icon in upper-left.
  Selected address 192.168.0.1
  Start Scan
  # "Internal error", "(Status code 500) Operation 'Run Wizard' failed".
  
  Scans - Tasks - blue star icon in upper-left
  # Was able to create a scan task, but then get 503 error when I run it.
  
  # tried creating /etc/docker/daemon.json containing:
  {
  	"dns": ["8.8.8.8", "8.8.4.4"]
  }
  # but it didn't help
  
  # Tried using Mint's System Monitor app to see how much RAM
  # Docker-OpenVAS was using, but it doesn't show up there !
  
  # Log files are in /var/log/openvas
  # Seems the 503 error is caused by
  # "Failed to connect to scanner (/var/run/openvassd.sock)"
  # The /var/run/openvas* files all seem to be root-only.
  sudo chmod a+rw /var/run/openvas*
  # Same error
  
  # Decided OpenVAS is a lost cause
  sudo docker stop openvas
  sudo docker rmi mikesplain/openvas
  apt remove openvas
  apt remove openvas9
  apt remove libopenvas9
  apt remove libopenvas9-dev
  apt remove greenbone-security-assistant
  apt remove greenbone-security-assistant-common
  sudo rm -fr /etc/default/openvas-manager
  sudo rm -fr /etc/default/openvas-gsa
  sudo rm -fr /var/run/openvas*
  sudo rm -fr /var/lib/openvas
  sudo rm -fr /etc/openvas
  sudo rm -fr /usr/share/openvas
  sudo rm -fr /var/log/openvas
  

  
  OpenVAS seems focused on port-scanning and applying exploits, nothing about managing the overall project or other phases such as OSINT. UI is web-based and felt clunky to me. A couple of times I ran into support channels that were abandoned; feels like it's not well-supported.
  
  9/2019 from someone on reddit:
  "Install docker and pull our openvas10 image. Instructions are on our github and docker hub. https://hub.docker.com/r/securecompliance/openvas"
  
  
  
  
• Nessus:
  
  Costs $2200/year.
  Tenable's "Nessus Professional"
  OccupyTheWeb's "How to Scan for Vulnerabilities with Nessus"
  
  
  
• SPARTA:
  
  Mostly for scanning and enumeration phases.
  Can run nmap, Nikto, netcat, more, and integrate their results.
  SPARTA
  
  WonderHowTo's "Discover & Attack Services on Web Apps or Networks with Sparta "
  
  
  
• Vault:
  
  abhisharma404 / vault
  
  
  

Some of the big tools in the previous two sections (such as OWASP ZAP and Metasploit) have APIs and/or CLI interfaces and headless operation that let them be driven as testing engines.

• Selenium:
  
  SeleniumHQ
  Guru99's "Selenium Tutorial for Beginners"
  Katalon Studio (runs on top of Selenium)
  
  
  
• Playwright:
  
  Shantnu Tiwari article
  
  
  
• OWASP OWTF (Offensive Web Testing Framework):
  
  An automated-testing driver; not interactive.
  OWASP OWTF
  owtf / owtf
  
  
  

Threadfix.
Minion.

• Kali Linux:
  
  A distro loaded with lots of already-installed pentesting tools. Not intended to be used as your normal daily-driver desktop distro.
  
  Kali by Offensive Security
  
  Takhion's "Install & Lock Down Kali Linux for Safe Desktop Use"
  Distortion's "Top 10 Things to Do After Installing Kali Linux"
  Kali Linux Tools Listing
  Aleks Cudars' "Kali Linux Tools" (PDF)
  Ceos3c's "Install Kali Linux on VirtualBox with Guest Additions 2018!"
  Ceos3c's "Kali:the following signatures were invalid FIX"
  Ceos3c's "Top Things to do after Installing Kali Linux in 2019!"
  kali-anonsurf
  Gr3yC1oud's "Metasploit Tutorial : Set up ~ 1"
  reddit's /r/Kalilinux
  
  
  
  
  
• Katoolin:
  
  Installs all the Kali tools on your distro.
  LionSec / katoolin
  
  Aaron Kili's "How to Auto Install All Kali Linux Tools Using 'Katoolin' on Debian/Ubuntu"
  SK's "Install Kali Linux Tools Using Katoolin In Ubuntu 18.04 LTS"
  FOSSBytes' "How To Install All Kali Linux Tools On Ubuntu Using 'Katoolin' Script?"
  
  Or you could just install the exact tools you want, from the appropriate repositories or project homes.
  
  
  
• Penetration Testers Framework (PTF):
  
  Another tool-installer.
  trustedsec / ptf
  
  
  
• BlackArch:
  
  TokyoNeon's "Exploring Kali Linux Alternatives: Set Up the Ultimate Beginner Arch Linux Hacking Distro with Manjaro & BlackArch"
  
  
  
• Parrot Security OS:
  
  Parrot OS
  Barrow's "Exploring Kali Linux Alternatives: How to Get Started with Parrot Security OS, a Modern Pentesting Distro"
  Ceos3c's "How to install ParrotSec on VirtualBox"
  anonsurf
  Unlike Kali, Parrot has both "security" and "home" (daily desktop) versions.
  
  
  
• Pentoo:
  
  Pentoo
  
  
  
• BlackBuntu:
  
  BlackBuntu
  
  
  
• BackBox:
  
  BackBox.org
  
  
  
• Samurai Web Testing Framework:
  
  A VM image, supported on VirtualBox and VMWare, that has been pre-configured to function as a web pen-testing environment.
  Samurai Web Testing Framework
  
  
  
• FLARE (FireEye Labs Advanced Reverse Engineering) VM:
  
  A Windows-based VM image, with lots of tools.
  fireeye / flare-vm
  
  
  
• Mobexler:
  
  A VM image, based on Elementary OS, for pentesting of Android and iOS apps.
  enciphers / Mobexler
  Mobexler Usage Guide
  
  
  

0ut3r Space's "Linux distributions for hackers"


My opinion at the moment:
From /u/subnetq1:

• Set up two profiles for your browser:
  • Your normal browsing configuration, with lots of add-ons and no proxy.
  • Your test-browsing configuration, with some testing add-ons and one or more proxies.
  
  
  
• Firefox: Probably similar for Iceweasel.
  
  How-To Geek's "How to Set Up and Use Multiple Profiles (User Accounts) in Firefox"
  RadekK's "How to use Burp Suite with multiple profiles in Firefox"
  
  
  • Good idea to make a backup of your default profile now. "cd ~/.mozilla/firefox" and make a copy of whatever directory has a name ending in ".default". To copy it to your home directory, do "cp -r *.default ~"
    
    
  • There are two ways to set up and choose profiles:
    • Type "about:profiles" in the address bar to manage profiles or choose a profile.
    • Launch Firefox with command-line argument "-profilemanager".
    
    
    
  • In the test-browsing profile:
    • It will start up with NO add-ons and bookmarks, everything back to initial state.
    • Maybe turn off telemetry back to Mozilla, any other settings you want.
    • Have to re-install Burp proxy certificate, if you installed that in default profile.
    • Install FoxyProxy add-on, and use it to define proxies.
    • Install other Browser Add-ons.
    
    
    
  • Normally, Firefox only uses one profile at a time, using it for all instances of Firefox. To run two instances of Firefox using two different profiles, launch second one with command-line arguments "-P PROFILENAME -no-remote".
    
    
  Press Shift-F5 in normal Firefox to open Developer Tools pane.
  Ubuntu tutorials' "Firefox for web developers"
  Mozilla's "Firefox Quantum: Developer Edition"
  
  
  
• OWASP Mantra:
  
  Derived from Firefox.
  Kali Linux's "OWASP Mantra -- Browser for Penetration Testers"
  
  
  
• Chrome:
  
  Tapas Adhikary's "DevTools - My Favorite Tips and Tricks"
  
  
  

Note: if "View Page Source" doesn't show you much about a page, open browser's DevTools and look in Inspector.

•   FoxyProxy: easily switch among proxy settings.
  
  To stop Mozilla/Firefox/Google traffic from showing up in Burp (or similar for ZAP):
  liamosaur / foxyproxy.json and set FoxyProxy to "Use Enabled Proxies By Patterns and Priority".
  
  
  
• Reload Skip Cache Button (by Button Guy): reload current page without using the browser cache.
  
  Green circular-arrow icon in toolbar to open it.
  
  


• d3coder: encode and decode selected text.
  
  Chrome only.
  
  
• Cryptext (by cscarpa): encode and decode selected text.
  
  Green "C" icon in toolbar to open it. To copy/paste text, you have to right-click and use context menu, you can't ctrl-C/ctrl-V, as soon as you hit ctrl the window closes. And as soon as you go to browser's address bar, the Cryptext window closes and you've lost anything in there.
  
  Better to use Code Beautify web site.
  
  


•   BuiltWith: see what technologies a web site uses.
  
  Green "bw" icon in toolbar to open it. Getting 1 "details" listing per day is free; getting 5 requires a free account; more than that costs $144/year. But the simpler free "tech" listing seems sufficient. But it doesn't list frameworks such as AngularJS or Angular.
  
  
•   Wappalyzer: see what technologies a web site uses.
  
  Purple (usually) icon in address bar to open it, or you can have the icon change with each web site's technology. Also has a telemetry preference you should turn off, probably.
  
  
• What CMS Is This: see what CMS a web site uses.
  
  Blue "W" icon in toolbar to open it. Failed to find CMS on any site I tried, while BuiltWith reported several CDNs. It does detect references to GitHub.
  
  


• HackBar (v2, by Khoiasd): performs encryption, encoding, decryption, POST data manipulation, inject code generation, more, on HTTP requests.
  
  But doesn't show HTTP responses. Shows up as an icon in the browser's debugger (Firefox shift-F5).
  
  
• HackBar Quantum (by DLS): same as HackBar by Khoiasd, plus some payloads and auto-pwns.
  
  UI less convenient. Green globe icon in toolbar or F9 to open it.
  
  
• Tamper Data (for FF Quantum, by Pamblam): manipulate GET and POST requests.
  
  Blue cloud icon in toolbar to open it. Can't figure out how to use it: my HTTP requests hang, never go out or get a response or something.
  
  
• Tamper Dev (for chromium): manipulate GET and POST requests.
  
  Tamper Dev
  
  
  
• HTTP request maker (by stefano): manipulate requests.
  
  Ctrl+Shift+Y to open, but in Firefox that combination means "open Download history window".
  
  
• HTTP Header Live (by Martin Antrag): manipulate requests.
  
  Blue hexagon icon in toolbar to open it. Awkward: it shows activity by all tabs in one stream.
  
  


• WebSecurify: capable of finding XSS, XSRF, CSRF, SQL Injection, File upload, URL redirection, more.
  
  
• XSS Me:
  
  
• XSS chef: connects to the XSS Chef framework, installed separately.
  
  
• XSS Rays:
  
  beefproject / beef / Xss Rays
  
  
  
• SQL Inject Me:
  
  
• HPP Finder:
  
  
• SPAudit
  
  Chrome-only.
  Vladimir's "Single-page applications need better auditing"
  
  
  

Pavitra Shankdhar's "18 Extensions For Turning Firefox Into a Penetration Testing Tool"
Pavitra Shankdhar's "19 Extensions to Turn Google Chrome into Penetration Testing tool"
Firefox-only to find hidden links on pages: SixOrNot, LinkGopher, IPvFoo.
mazen160 / Firefox-Security-Toolkit (install lots of useful extensions)

For some challenges, mainly XSS, you need an external site the victim will access, and a way for you to pick up the params they sent to that site.

One way to do that is to use RequestBin. Go there in your browser, click on "Create a RequestBin" button, and get an URL with a random token on the end, such as "http://requestbin.fullcontact.com/yvc8t6yv". Have the victim do a GET or POST to that URL, equivalent to:

curl -X POST -d "fizz=buzz" http://requestbin.fullcontact.com/yvc8t6yv
# or
curl -X GET http://requestbin.fullcontact.com/yvc8t6yv\?param1\=5555

Then in browser, go to "http://requestbin.fullcontact.com/yvc8t6yv?inspect" to see the data that came across.

Similar: Webhook.site

See the Recording Desktop Activity and Recording CLI Activity sections of my Linux page.

Browser add-on "Nimbus", called "Nimbus Screenshot & Screen Video Recorder" on Chrome and "Nimbus Screen Capture: Screenshot, Edit, Annotate" on Firefox.

For Windows: Greenshot.

I want something that will:
There seem to be a lot of tools for managing N people testing one business.
I want a tool for 1 person testing N businesses/apps.

Refined my thinking a bit, and asked this:
I don't want to replicate any of the port-mapping or page-tracking or report-generating features of big suites such as Burp or ZAP. I want a dashboard where I can see which areas have been covered and which haven't, and click to launch into the appropriate tool to do testing or to see the existing vuln/exploit/report or to see the relevant app pages and documentation pages.
"test matrix application"
"Test management tool"
"requirements traceability matrix"
But I don't need multi-user, I don't need graphs and reports and data analysis, don't need links to version control, don't need build control, trouble tickets.

Mockup1
Actual so far

• SwiftnessX:
  
  Heitor Gouvea's "How to better organize your notes while hunting for bugs"
  ehrishirajsharma / SwiftnessX
  
  
  
• sh00t:
  
  Task manager, to-do checklists, reporting.
  
  pavanw3b / sh00t
  
  Installed sh00t on my Mint 19.1 system:

  
  
  # I already had Python3 and pip installed.
  
  cd ~
  git clone https://github.com/pavanw3b/sh00t
  
  cd sh00t
  pip install -r requirements.txt
  # failed with "No matching distribution found for Django==2.0.8"
  pip install Django
  # but it installed "Django-1.11.20 pytz-2018.9"
  pip install -r requirements.txt
  # failed with "No matching distribution found for Django==2.0.8"
  pip3 install -r requirements.txt
  # worked !
  
  python3 manage.py migrate
  python3 manage.py createsuperuser
  # create user account; asks for username, email address, password
  # password must be 8+ chars and not "simple"
  
  # to pre-load with content:
  python3 reset.py
  # alarming message about resetting everything in database
  # I said yes
  

  
  To run sh00t:

  
  
  cd ~/sh00t
  python3 manage.py runserver
  
  # go to browser
  # go to http://127.0.0.1:8000/
  # log in
  
  # when finished, kill the sh00t server:
  ctrl-C
  

  The app is organized as a hierarchy of Project - Assessment - Flag - Sh0t (although confusingly the order is shown as P - A - S - F). You can define Project and Assessment as you wish, but a Flag is a test case to be tested, and a Sh0t is a confirmed bug.
  Maybe reasonable definitions would be:
  • Project: company you're testing + month.
  • Assessment: app + methodology
  • Flag: test case.
  • Sh0t: confirmed bug.
  So you might have:
  "Project / Assessment / Flag / Sh0t".
  "Amazon + Jan 2019 / retail app + OWASP / SQL injection / bug1".
  "Amazon + Jan 2019 / associates app + OWASP / SQL injection / bug1".
  
  The "Configuration" is organized as a hierarchy of Methodology Master - Module Master - Case Master - Template.
  The definitions seem to be:
  • Methodology: OWASP or WAHH.
  • Module: class of activity (such as "testing error handling")
  • Case: strategy (such as "OSINT") and directions on how to do it.
  • Template: ???
  But the README says nothing about any of the things in "Configuration".
  
  Start by adding a Project, then adding an Assessment in that Project. You will get to enable a Methodology or various Flags, and now interesting things will appear under Flags / All. But there are no Templates.
  
  Much of the content seems to be vintage 2014 or so, including references to tool names and such.
  
  Submitted three Issues on GitHub, dev responded within a day.
  
  
• Jira:
  
  Atlassian's Jira
  wikipedia's "Jira (software)"
  Costs $10/month.
  Way too complex for my needs.
  
  
  
• Vulnreport:
  
  salesforce / vulnreport
  Malicious.Link's "VulnReport Install"
  
  Has an "organization and users" structure that a solo hunter doesn't need.
  
  
• Dradis:
  
  Dradis
  Dradis on GitHub
  Dradis - Installing Dradis on Ubuntu
  
  Haxf4rall's "Dradis Framework - Collaboration and reporting for IT Security teams"
  
  Community edition is free. Plug-ins to import from Qualys, Nexpose, Acunetix, Burp, Nessus, nmap, more.
  
  [Bad] Installed Dradis CE on my Mint 19.1 system 1/2018, mostly using
  Dradis - Installing Dradis on Ubuntu:

  
  
  gpg --keyserver hkp://pool.sks-keyservers.net --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3 7D2BAF1CF37B13E2069D6956105BD0E739499BDB
  
  bash -s stable < <(curl -s https://raw.githubusercontent.com/wayneeseguin/rvm/master/binscripts/rvm-installer)
  
  source /home/user1/.rvm/scripts/rvm
  
  rvm -v   # got 1.29.7
  
  for package in zlib openssl libxslt libxml2; do rvm pkg install $package; done
  # got several errors about configuration or make failures
  # script said do "rvm reinstall all --force", but that gave error
  
  rvm install 1.29.7  # not found
  rvm install 1.9.3  # not supported any more
  rvm install 2.6.0  # worked
  
  ruby -v  # got "ruby 2.6.0p0 (2018-12-25 revision 66547) [x86_64-linux]"
  
  echo "gem: --no-rdoc --no-ri" > ~/.gemrc
  
  gem install bundler
  bundle -v
  
  mkdir dradis-git
  cd dradis-git/
  git clone https://github.com/dradis/dradisframework.git server
  for file in verify reset start; do curl -O https://raw.githubusercontent.com/dradis/meta/master/$file.sh; done
  chmod +x *.sh
  
  cd server/
  [Missing command in the web page; stopped and reported it.]
  [But Support is useless, keeps not answering my questions, says they're working
  on new guides.  Referred me to
  https://discuss.dradisframework.org/t/how-to-install-dradis-ce-3-on-ubuntu-server-16-04/342
  which seems totally different from the steps I'm halfway through.]
  
  [Went back and forth with Support, and finally they said the instructions
  I used are a 5-year-old deprecated page that they thought no one had access to !
  Use a different page:
  https://discuss.dradisframework.org/t/how-to-install-dradis-ce-3-on-ubuntu-server-16-04/342 ]
  

  
  [Bad] Installed Dradis CE on my Mint 19.1 system 1/2018, using
  agreenbhm's "How-To: Install Dradis-CE 3 on Ubuntu Server 16.04":

  
  
  sudo apt update
  
  sudo apt install -y git redis-server ruby ruby-dev gcc make zlib1g-dev libsqlite3-dev libmysqlclient-dev g++
  
  cd /opt
  sudo git clone https://github.com/dradis/dradis-ce
  
  cd /opt/dradis-ce
  sudo ruby bin/setup
  # got a couple of "can't find gem bundler" errors, failed
  # Support said do
  bundle install --path /opt/dradis-ce
  # it failed, Gemfile not found, but that dir does contain a Gemfile
  # and Support sends me to the community forum
  # (Dradis framework Community forums),
  # I guess they can't help me
  
  # but they kept helping
  sudo gem install bundler
  
  bundle install --path /opt/dradis-ce
  
  cd /opt/dradis-ce
  sudo gem uninstall bundler
  # but got "bundler not installed" error
  
  cd /opt/dradis-ce
  sudo gem install bundler -v 1.16.4
  
  ruby bin/setup
  # failed with perms on ~/.bundle
  sudo chmod 777 ~/.bundle
  
  cd /opt/dradis-ce
  ruby bin/setup
  # did lots of fetching and installing, then another perm error, more chmod'ing
  
  ruby bin/setup
  # some more fetching and installing, then some kind of database access error
  

  
  
  
  
  
  
• Faraday:
  
  Gathers info from many different tools, to show visuals and reports and analysis.
  
  Community edition is free, but doesn't include reporting and analysis.
  
  Faraday
  infobyte / faraday
  
  Seems to emphasize collaboration, multi-user, manager, CISO.
  
  
  
• AttackForge:
  
  AttackForge
  [Have to register to see any info about it.]
  
  Cyber Security Hub
  
  
  
• Serpico:
  
  Mostly a report-template tool ?
  
  SerpicoProject / Serpico
  Shellntel's "The Number One Pentesting Tool You're Not Using"
  
  
  
• TestLink:
  
  Test plans, test specifications, links back to requirements.
  
  franciscom / TestLink
  
  
  
• OWASP ZAP:
  
  Bug Tracker extension connects to Bugzilla and GitHub.
  
  
  

ghostwriter by spectreOPS. PlexTrac.

Ceos3c's "The different Phases of a Penetration Test"
Luke Rixson's "Hacking how-to's: Developing your process"
Barrow's "How to Organize Your Tools by Pentest Stages"
Occupy4eles's "Use Magic Tree to Organize Your Projects"
OccupyTheWeb's "The Hacker Methodology"

You may create new vulnerabilities in the target. You may create a tunnel that violates all of their security policies. You may see trade secret or proprietary or PII data. Your report is confidential, unless and until the client approves release of it. How are you going to protect those things from someone else coming in and trying to exploit/grab them ?

Assume someone smarter than you is trying to get into the same target that you are, and may be targeting YOU, trying to piggyback on you. Is some new plug-in or script or exploit that you grab from somewhere really safe, does what it says it does, can you trust it ? Are your tools updating themselves over unencrypted connections ?

Have you changed default passwords on Kali, the big tools, etc ? Are you using 2FA on your important online accounts ? Are you storing data in encrypted containers, that are open only when you're using them ?

Catalin Cimpanu's "Years-long campaign targets hackers through trojanized hacking tools"
DEF CON 23 - Wesley McGrew - I Hunt Penetration Testers: More Weaknesses in Tools and Procedures (video)
"Be careful what you OSINT with"
My "Computer Security and Privacy" page

Probably a bigger risk is that some ISP or big corp might blacklist you:
Mike Felch article (ignore the title)

Monty Python's "How Not To Be Seen" (video)

• Firefox
• OWASP ZAP
• Metasploit
• Something for project management
• Nikto ?

[Reconnaissance]

1. Start on a target.
   
   
2. Learn the application: log in as user, do normal things, understand the application.
   
   
3. Domain/server Discovery: OSINT and DNS work to get lists of domains and servers.
   
   
4. Port scanning those domains/servers: scanning to verify domains and servers and ports exist.
   
   
5. Verifying domains/servers/services: scanning to get banner pages etc to show what services are running.
   
   

[Analysis]

6. Site/server Analysis: get software versions and patch levels etc.
   
   
7. Content Discovery: find files on servers.
   
   

[Attack]

8. Probe pages/scripts with bad parameters: attack bad input-handling.
   
   
9. Attack application code and logic: more complicated attacks (XSS, SQLi, etc).
   
   

[Cleanup and Reporting]

10. Remove anything you've installed or modified.
    
    
11. Report what was done and results.
    
    
12. Post-Reporting.
    
    
13. Trying Again Later.
    
    

Some tools or techniques are forbidden in some bounty-hunting programs, maybe because they generate so much network traffic or tie up the servers or affect real users.

Use a VPN (unless you're doing custom traffic inside a LAN). Some clients may have automatic software that bans IP addresses that produce suspicious traffic, even if you're authorized to do testing. And it may add your IP to a blacklist that many companies use, not just the target. [This begs the question: are you going to get your VPN company blacklisted ?]

Don't just push the "scan" button on some huge framework and hope the right thing happens. Set the scope and configuration for the scanning, know what it's going to be doing.

From "Penetration Testing" by Georgia Weidman:
"Be forewarned: Not all public exploit code does what it claims to do. Some exploit code may destroy the target system or even attack your system instead of the target. You should always be vigilant when running anything you find online and read through the code carefully before trusting it."

"Scanning for vulns" is not the same as "penetration testing". Scanners make mistakes or give false positives. Follow up each hit with manual testing, and make sure you know what is happening, and try to broaden the scope of the problem. Don't just report scanner results and expect a bounty. Clients often have contracted with expensive pentesting companies that produce huge lists of scanner-hits, but then the client finds only 3 of them are worth fixing.

• How is my home ISP going to react if they see me doing intensive scans of some web site on the public internet ?
  TokyoNeon's "The White Hat's Guide to Choosing a Virtual Private Server"
  
  
• May have to do port-forwarding in my home router to allow incoming connections.
  
  
• Would be best to have 3 machines:
  • Daily desktop machine (stable, no incoming services, no open ports).
  • Hacking machine (running Kali, or loaded up with tools).
  • Target machine (running web server, web app, other targets).
  Or if you have a LOT of RAM in your machine, run Hacking and Target as VMs ?