Articles about Pentesting tools from the ConsultorIA blog: cloud, applied AI and security in production.
Most questions during an incident or an audit are inventory questions, and most organisations answer them with a spreadsheet. A SQL interface over live endpoint state answers them in seconds, and the scheduling is where it goes wrong.
A scanner says a host is probably vulnerable. Controlled exploitation in an authorised engagement turns "probably" into "here is what an attacker gets", which is the difference between a finding people fix and one they file.
Every Kubernetes benchmark scan produces hundreds of findings and the same handful matter. Here is which ones, why the control plane checks mostly do not apply on managed clusters, and how to stop the report being ignored.
Image scanning finds known vulnerabilities before deployment. Runtime detection catches the shell that spawned inside a running pod at three in the morning. The default rules are noisy and tuning them is the entire project.
Sigma is a vendor-neutral format for detection logic that compiles to your platform's query language. The format is the easy part. Version control, testing and a lifecycle for rules are what make detection work.
A rule that has never fired is either excellent or broken, and you cannot tell from the outside. Adversary emulation runs the technique deliberately, in a controlled way, so that the answer stops being a guess.
A posture review is only as good as its coverage. These are the scanners, IAM analysers and infrastructure-as-code checkers we run on AWS, Google Cloud and Azure, what each one is good at, and where it misleads.
An open-source SIEM is a real option when the alternative is paying per gigabyte, but only if you accept the operational cost. What Wazuh gives you out of the box, what you have to build, and when to stop and buy.
Identity is where the escalation happens, and graphs are how you see it. What BloodHound reveals about Active Directory and Entra ID, how to read the paths, and which edges are worth cutting first.
Dependency scanning is mature; what changed is that customers and regulators now ask for the inventory itself. How to generate SBOMs that are useful rather than ceremonial, and how to answer "are we affected?" in an hour.
Finding a credential in git history is the easy part. The hard parts are verifying it is live, rotating it without an outage, and stopping the next one — in that order, and usually within the hour.
Every image scan returns hundreds of CVEs and almost none of them are reachable. How we cut the list down to what is exploitable, where each tool is stronger, and why the base image is the whole game.
Most static analysis dies from noise. The way to keep SAST alive is to start with a tiny high-precision rule set, write rules for your own codebase's mistakes, and scan the diff rather than the repository.
Dynamic scanning in a pipeline fails for predictable reasons: no authentication, no seeded data, a scan that takes forty minutes and a threshold that fails builds on informational alerts. How to configure ZAP so the result is trusted.
Nuclei is fast enough to run against your whole external surface every night. The value is in the template selection, the target list and the diff between runs, not in the raw number of findings.
The scanner is the least interesting part of Burp. This is how we set up scope, authentication and session handling for a web application assessment, which extensions earn their place, and how to tell a finding from a false positive.
Nmap still finds the things that matter on a cloud perimeter, but only if you scan the right address space with the right flags. How we build the target list, which scan types earn their time, and how to read the output without wasting a week.