Pentesting tool for windows environment

Question

in Linux platform there were separate frameworks and tools for carrying out pen test of web applications,

Myself looking for windows alternative of arachni or the powerful distro kali linux,

Is it there any set of tools or a single tool kit which does the functionality of arachni and kali.

I have already tried the following applications :

Zapproxy of owsap

Burp suite professional

Any other alternative which i can carry out for pentest?any windows program either shareware/opensource tool to perform pentest in windows environment

Answer 1

Well I normally have a set of them which are good in combination.

1. metasploit which has a good GUI but can be used from the cmd too. It is useful to run a certain payload on any machine.
2. WireShark is great for watching incoming and outgoing network traffic and see which ports are used. This may be helpful if you want to check if something is available on certain ports.
3. ZAP maybe useful in your case. It is a security vulnerability scanner specialized for web applications.
4. BurpSuite this is maybe too much, but it also has some great tools for scanning web applications.

Answer 2

There are plenty of tools that exist for pentesting on the Windows environment. Here are but a few honorable mentions that we use at our company.

BloodHound: For Active Directory environments

Empire: Post Exploitation

Powersploit: Powershell Post-Exploitation Framework

Mimikatz: Credential dumping tool

Windows Exploit Suggester: Detecting missing security patches