10.15 Choose tools that match your task and constraints Tool Selection Matrix
← Cheatsheet index | getSH coverage map | Strategy map
Choose the smallest tool that answers the current question. Automated output is a candidate list unless the tool directly verifies the required effect.
| Question | Baseline | Alternative | Decisive output / failure cue |
|---|---|---|---|
| Which TCP ports respond? | Nmap | RustScan/Masscan then Nmap validation | Reproducible open state; fast-tool-only hit remains unconfirmed |
| What application is present? | Nmap -sV, native client | Netcat/curl/OpenSSL | Protocol behavior/banner; port label alone is weak |
| What web paths/vhosts exist? | Browser/Burp + ffuf | Gobuster/Feroxbuster/wfuzz | Response differs from random baseline |
| Common web-server candidates? | Manual mapping | Nikto | Manually reproduced finding |
| Public exploit candidate? | SearchSploit/source review | Exploit-DB/vendor advisory/repository | Exact component/prerequisites plus independently verified effect |
| WordPress components/users? | Manual source/path checks | WPScan | Active component/version/user candidate manually confirmed |
| SMB shares/rights? | smbclient, RPC | NetExec | Exact share/object read/write result |
| LDAP objects? | ldapsearch | PowerView/AD module | Returned object/attribute in stated auth context |
| Domain path candidates? | Native/PowerView | BloodHound/SharpHound | Chosen edge manually validated |
| Kerberos roastable material? | Impacket/Rubeus | PowerView ticket request | Hash output whose type is identified |
| Password recovery? | Hashcat | John | Recovered candidate revalidated against correct context |
| Local privesc candidates? | Manual OS checks | LinPEAS/WinPEAS/LSE/PowerUp | Controlled object + privileged consumer + trigger |
| Remote Windows execution? | WinRM/WMI/SMB based on prerequisites | RDP/DCOM | Verified remote host/identity/effect |
| AD CS paths? | Certipy enumeration | Manual directory/template review | Specific enabled template/CA and effective rights |
| One internal TCP service? | SSH -L/-R | Socat, Plink or Netsh | Bound listener plus protocol client reaches exact endpoint |
| Several internal TCP services? | SSH SOCKS | Chisel reverse SOCKS | Focused TCP client reaches intended endpoint through named proxy |
| Routed pivot? | Ligolo-ng | sshuttle or explicit forwards | Route exists and native client reaches endpoint |
| DNS-only egress? | Prove resolver/authority path | dnscat2 | Authenticated session; query arrival alone is insufficient |
| Payload generation? | Handwritten/native command | msfvenom | Format/architecture/staged state match and execution/callback separately verified |
| Payload/document does not execute? | State ladder + native format/policy/log checks | Packet capture and exact matching handler | First failed delivery/trigger/parser/execution/connection/handler boundary |
| Staged/framework callback? | Exact multi/handler | Compatible stageless command shell + raw listener | Session opens with expected payload; TCP alone is insufficient |
| Which attack path next? | Coverage + hypothesis queues | Graph/board view of the same state | One prerequisite-testing action whose outcomes change the decision |
| Final report package? | Official Word/LibreOffice template + 7z | Rehearsed Markdown/Pandoc workflow | Reviewed PDF, archive test passes and local/upload MD5 match |
10.15.1 Exam-rule flags
- Impact alone does not make a manual command prohibited. LSASS/SAM/NTDS collection, web/OS command execution, privilege escalation, ticket operations and lateral movement remain referenceable when used only on assigned systems with the required rights and objective. The chosen tool feature still must not perform a prohibited function.
- SQLmap and similar automatic exploitation tools: prohibited by the current OSCP+ guide; use manual SQLi procedures.
- Responder poisoning/spoofing: spoofing is prohibited by the current guide; lab concept only unless rules explicitly change.
- Metasploit/Meterpreter: restricted to one selected target;
msfvenomandmulti/handlerhave specific exceptions in the current guide. - Metasploit pivoting: explicitly prohibited by the current guide.
- Commercial tools/services and mass vulnerability scanners are prohibited. Use free/manual task-specific tools and verify their exact feature behavior.
- AI chatbots and direct-prompt LLM use are prohibited during the exam and reporting phase. Use this repository offline without Codex or another chatbot.
- Nmap/NSE, Nikto and Burp Free are explicitly listed as permitted in the current guide, but tool features performing prohibited functions remain prohibited.
Always recheck the current official guide before a mock or exam.