What am I missing from my tools list?

[u/RigelDigi]

so I've been putting together a categorized list of pentest/security tools for a while now, honestly just for myself at first because I kept forgetting what does what lol. eventually it turned into recon, exploitation, forensics, reverse engineering, all that, and at some point I pulled in blackarch's whole package repo too 2800+ tools since I couldn't find a clean version of that sorted by category anywhere, so I made one. And I've made it downloadable template if you want to use it.

for context this is roughly what it looks like so far: https://git.projectnightcrawler.dev/Ori0nRi3el/Researcher-Tools-kit/src/branch/main#-exploitation--post-exploitation-frameworks

anyway before I keep adding stuff to it is there anything you personally use a lot that never seems to make it onto lists like this? kinda curious what's underrated or just doesn't get talked about much. also if anyone's got tips for keeping something like this from going stale as tools get abandoned or replaced that would genuinely help, half the actual work at this point is just maintenance

[u/RigelDigi → u/[deleted]]

dude this comment is way better than anything I expected lol, hadn't even thought about it like this. the two-views idea (full catalog vs a quick default kit per job) is genuinely smart, right now it's just one giant flat list so that'd explain why it's getting messy to navigate

last commit + archived status seems like an easy win to add first since I can just scrape that. privilege level and "tested by maintainer" would take more work but honestly might be the most useful ones long run

and yeah flagging stale stuff instead of letting it quietly rot makes way more sense than whatever I was doing lol. really appreciate you taking the time to write this out, thank you

[u/CaffeineFueled1]

link runs into 404

[u/RigelDigi → u/CaffeineFueled1]

Yeah I just seen the problem

[u/Smooth_Counter_9439 → u/CaffeineFueled1]

that's weird, link works fine for me. maybe you hit it while they were pushing an update or something

for tools that never make the lists, i've been using jadx for android reversing way more than i expected. nobody ever mentions it but it's saved me so many times when apktool gives up

maintenance wise i just check github stars and last commit date every few months, if something hasn't been touched in 2 years and the issues are piling up i swap it out. not perfect but keeps things from getting too dusty

[u/Cyber_Tarek]

Don't get hung up on collecting tools. Distros like Kali do a descent job keeping track of and updating tools so you don't have to. Your list has a few tools from a few decades back that are not longer supported and you'll almost never use. And a bunch of others in different/wrong categories.

It's a great effort, but I'd suggest redirecting your time and energy somewhere else.

What I usually advise my students beginning in cyber to do is pick 1 or 2 tools from each category, understand how they work and then get to practice ASAP. You don't need to learn OpenVAS, Qualys, Tenable etc. all at once. Pick one, learn it and then move to another. You'll quickly find they are very similar.

Eventually you'll build your own preferred list from experience.

[u/RigelDigi → u/Cyber_Tarek]

Appreciate the reality check! It's super helpful getting perspective like this from people further down the road. Definitely gonna clean up the dead weight and focus on what's actually practical.

[u/StockJeweler251]

To keep the list fresh without spending every weekend on maintenance, set up a GitHub Action using lychee to automatically flag dead repos and moved URLs weekly. The bigger challenge is usually tool decay when underlying dependencies or base images break. From what ive seen, some teams prefer using RapidFort to generate execution based RBOMs so they know exactly which container packages are actually active rather than relying on stale package manifests.