What does a real professional web application penetration testing stack look like in 2026?
What does a real professional web application penetration testing stack look like in 2026?
I’m not looking for a huge list of pentesting tools. I’m interested in the actual workflow used by professional web pentesters during an engagement.
For example:
recon → fingerprinting → crawling → content discovery → attack surface mapping → automated vulnerability scanning → manual testing → vulnerability-specific tools → validation / PoC
Which tools do you actually use at each stage?
I’m especially interested in:
Nmap
Whatweb
Wpscan
Searchsploit
Sqli
Burp Suite
httpx
Nmap / Naabu
WhatWeb
Katana
ffuf / Feroxbuster
Nuclei
Arjun
sqlmap
WPScan
Dalfox
Metasploit
Which of these tools are redundant in 2026?
For example, is there still a reason to use Gobuster, Dirsearch, Nikto, Hakrawler or GoSpider if you’re already using ffuf, Katana, Nuclei and Burp Suite?
What parts of web pentesting do you automate and what parts do you still always test manually?
I’d also like to see an example of the actual order in which you run the tools during a web application pentest, rather than just a list of tools.