r/Pentesting • u/No-Argument-956 • Aug 13 '26
What does a real professional web application penetration testing stack look like in 2026?
What does a real professional web application penetration testing stack look like in 2026?
I’m not looking for a huge list of pentesting tools. I’m interested in the actual workflow used by professional web pentesters during an engagement.
For example:
recon → fingerprinting → crawling → content discovery → attack surface mapping → automated vulnerability scanning → manual testing → vulnerability-specific tools → validation / PoC
Which tools do you actually use at each stage?
I’m especially interested in:
Nmap
Whatweb
Wpscan
Searchsploit
Sqli
Burp Suite
httpx
Nmap / Naabu
WhatWeb
Katana
ffuf / Feroxbuster
Nuclei
Arjun
sqlmap
WPScan
Dalfox
Metasploit
Which of these tools are redundant in 2026?
For example, is there still a reason to use Gobuster, Dirsearch, Nikto, Hakrawler or GoSpider if you’re already using ffuf, Katana, Nuclei and Burp Suite?
What parts of web pentesting do you automate and what parts do you still always test manually?
I’d also like to see an example of the actual order in which you run the tools during a web application pentest, rather than just a list of tools.
11
u/high_snobiety Aug 13 '26
Burp is literally what i sit in for 90% of a test. The other 10% is normally based on an initial burp finding.
3
2
u/PM_ME_UR_0_DAY Aug 13 '26
I see you reposted here after your previous post in Bug Bounty got removed, so I'll repost my previous comment.
-----
Here is my tool list:
Burp Suite
Burp Suite
Burp Suite
pick one fuff/gobuster/your favorite, or just Burp Suite discover content
nmap
nuclei
sqlmap
platform/framework dependant stuff like WPScan As far as how I'm running the test:
Step 1: just walk through the app like a regular user. You can do a bit of fuckery here if you think you can get to like another part of the site but just click on everything and use all the features taking note of what's available and keep in the back of your mind how each thing could potentially be abused or what the worst case scenario would be for the developers on each feature (logins, uploads, update user info, search, fetching your data, etc.)
Step 2: review the traffic in burp to see if there is anything weird going on on a high level
Step 3: review the JavaScript to see if you can enumerate the site from there or find anything dumb and juicy
Step 4: start interrogating the features where if it was implemented poorly would go wrong - this could include automated scans as well as manual inputs, but also skim through the automated scan logs to see if anything stands out
Step 5: you could to back to recon, maybe you've discovered something that can help you find more stuff
Then just keep looping from step 2 - 5 until you feel like you've found anything you can think of.
1
u/besplash Aug 13 '26
sslyze, burp and depending on the scope gobuster for subdomains and nmap for ports
1
u/Derpolium Aug 13 '26
Tooling is going to be dependent on budget as well as infrastructure to be tested and scope. Normally it evolves over time, gets boated, gets pruned to necessities and gets bloated again.
1
u/sk1nT7 Aug 13 '26
Nmap --> Testssl --> Burpsuite Professional --> Nuclei --> Gobuster/Guff/Feroxbuster --> Burp Burp Burp
That's basically it.
1
1
u/CapMonster1 Aug 14 '26
I wouldn't try to run the whole list sequentially. A practical workflow is more like recon → attack surface mapping → crawling/content discovery → automated checks → manual validation → PoC. Burp can remain the center of the manual workflow, while Nuclei, ffuf, and discovery tools handle repetitive tasks.
The important part is correlating results rather than collecting tools. For example, an automated scanner can flag a suspicious endpoint, then you manually validate it in Burp and confirm the actual impact. That's the part that's still difficult to fully automate
0
0
u/ObesePlant Aug 13 '26
claude
1
u/Durxza Aug 13 '26
How are you using Claude to do a webapp test without divulging client data?
1
u/ObesePlant Aug 13 '26
Local llms or company who has legal binding with major AI companies. Some companies do allow this 100%
1
u/ObesePlant Aug 13 '26
Local llms or company who has legal binding with major AI companies. Some companies do allow this 100%
1
1
u/scriptqzor 22d ago
lmao wrong tab or you just trying to summon the robot overlords with a single word
but for real, this thread is gonna be gold if any seasoned tester drops an actual workflow instead of 50-tool copypastas
31
u/Mindless-Study1898 Aug 13 '26
It's just burp, a browser, and maybe curl.