Penetration testing for web applications not only requires knowledge of the latest web application security testing tools but also a deep understanding of how to use them most effectively. To assess web app security, ethical hackers leverage a range of specialist tools. These range from specialist pen testing platforms (such as Cobalt Strike, Metasploit Pro and Kali Linux), to networking tools (such as Wireshark), and custom-developed tools and exploits written using Python, Java and PowerShell.