tools and extensions

Proxy & Request Interception
Burp Suite Community - The foundation for web security testing. Intercept, modify, and analyze requests.
OWASP ZAP - Free alternative to Burp with good automation features.
Browser Extensions
Burp Suite extension - Integrates with your browser for easier testing.
Wappalyzer - Identifies technologies used on websites (frameworks, libraries, servers).
EditThisCookie - Inspect and modify cookies easily.
FoxyProxy - Quick proxy switching between different configurations.
Reconnaissance & Enumeration
Subfinder - Find subdomains quickly.
Amass - Comprehensive subdomain enumeration.
Nmap - Port scanning and service identification.
Shodan CLI - Search for exposed services and vulnerabilities.
API Testing
Postman - Test and debug APIs efficiently.
Insomnia - REST client for API exploration.
Automation & Scripting
Python - Learn it. Write custom scripts for your specific needs.
Bash/Zsh - Command-line automation on macOS.
Code Analysis
VS Code - For reviewing source code and writing scripts.
Other Useful Tools
Git - Version control for your tools and notes.
Grep/Sed/Awk - Command-line text processing for log analysis.
Start Simple
Don't install everything at once. Begin with Burp Suite Community, Wappalyzer, and a basic text editor. Learn those deeply before adding more tools. Most experienced researchers use a small set of tools they know well rather than a massive toolkit.
Quality over quantity—master a few tools rather than struggle with many.