A few tool groups
- Recon & mapping: map the test surface, keep a manual inventory, and record assumptions.
- Web: an in-lab proxy, browser devtools, and request replay with synthetic data.
- Identity: model permissions, groups, and trust in a directory test environment.
- Automation: small scripts with logging, dry-run mode, and cleanup.
- Notes: Markdown, timelines, annotated screenshots, and reproducibility checklists.
Tools do not replace judgment. Before each run, check the scope, input data, and recovery path.