02. What each go-to tool is for 🧰¶
"Metasploit, nmap, Burp Suite, ZAP" — you hear the names a lot, but what do they target, and what do they do? Each has a different area of coverage. Once you've got this straight, you can pick the right tool for the situation.
The four tools at a glance¶
flowchart TB
NMAP["nmap<br>network layer"] --> MSF["Metasploit<br>server / service layer"]
NMAP --> WEB["Burp Suite / ZAP<br>web application layer"]
style NMAP fill:#2d333b,stroke:#3fb950,stroke-width:2px,color:#e6edf3
style MSF fill:#2d333b,stroke:#f85149,stroke-width:2px,color:#e6edf3
style WEB fill:#2d333b,stroke:#58a6ff,stroke-width:2px,color:#e6edf3| Tool | Target | What it does | Official site |
|---|---|---|---|
| nmap | Network / ports | Recon on which ports are open and what's running | nmap.org |
| Metasploit | Servers / services | Exploit known vulnerabilities to break in and operate post-exploitation | metasploit.com |
| Burp Suite | Web applications | Intercept traffic through a proxy to inspect it (mostly manual) | portswigger.net |
| OWASP ZAP | Web applications | Automatically scan for web vulnerabilities | zaproxy.org |
💡 First use nmap to map the entry points → if the hole is in a server, reach for Metasploit; if it's in a web app, use Burp / ZAP. Whether you're facing "an old piece of server software" or "a custom web app" changes which tool you use.
The main thread of this guide (nmap → Metasploit → meterpreter) is the "breaking into a server" flow.
The difference between Burp Suite and OWASP ZAP¶
Both are tools that "sit between the browser and the server to inspect traffic (a proxy)," but they have different personalities.
| Aspect | Burp Suite | OWASP ZAP |
|---|---|---|
| License | Commercial (the free version is feature-limited) | Completely free and open source |
| Primary use | Precise manual work (the pros' go-to) | Automated scanning |
| CI/CD automation | The free version isn't suited to it | Easy to integrate ⭐ |
- Burp's strength: a rich ecosystem of extensions (BApps). The Autorize extension lets you semi-automatically test for vulnerabilities where a lower-privileged user can access data they shouldn't be able to (BAC / IDOR). BAC / IDOR are serious holes ranked near the top of the OWASP Top 10, hard for scanners to find, where manual verification pays off.
- ZAP's strength: being completely free and open source, you can build it into CI/CD without worrying about licensing. That's an advantage for "running an automatic web vulnerability scan on every commit."