# Bridging the Gap: A Survey and Classification of Research-Informed Ethical Hacking Tools
## 6 Evaluation
### Related Work  
Existing reviews of Ethical Hacking tools typically focus on industry practitioner tools, with occasional consideration of research-informed tools. Many popular practitioner tools included in these reviews (e.g., [1, 14, 158, 159]) are recurrent: Nmap, Metasploit Framework, OpenVAS/GVM, Nessus, Burp Suite, OWASP ZAP, SQLMap, BeEF, Nikto, W3 AF, and others.  
[PERSON] et al. [14] survey and classify around 40 practitioner tools and OSs (e.g., Kali Linux and ParrotOS), focusing on challenges and issues associated with EH activities. The paper maps the tools and techniques for vulnerability assessment, network scanning tools, crimeware toolkits, etc., considering different attack types and application domains. [PERSON] et al. [1] include in their review around 25 popular practitioner tools, and their capabilities are evaluated using criteria such as active maintenance, licensing, commercial aspects (paid vs. free), and technical elements like programming language and interaction with other technology.  
Moreover, [PERSON] et al. [158] analyse around 20 mostly practitioner tools, with good coverage of network vulnerability and exploitation in particular. However, they consider existing research proposals for mitigating techniques. Additionally, [PERSON] et al. [159] reviewed penetration testing frameworks, processes, tools, and scoring methods, encompassing around 15 practitioner EH tools.  
In some cases, authors restrict their focus to a specific domain. For example, [PERSON] et al. [5] provide good coverage of practitioner commercial and open-source solutions for EH in IoT, while [PERSON] et al. [7] review and compare industry practitioner tools for web application penetration testing. Similarly, [PERSON] et al. [160] provide a comparative analysis of commercial and open-source tools for Web Application Security with a focus on accuracy and precision. [PERSON] et al. [161] and [PERSON] et al. [162] compare many EH tools, including both industry practitioner tools and a few research-informed tools for web vulnerability assessment and exploitation, e.g., XSS and SQL injection. [PERSON] et al. [163] analysed a variety of reconnaissance and information-gathering tools and techniques including Google Dorking, Shodan, Web Crawler, Recon-ng, Photon, Final Recon, and Sherlock. The tools are compared with criteria such as update frequency, languages used, and supported OSs, with some research-informed tools also included in the review.  
In a few cases, authors systematically classify the tools according to some methodology or taxonomy. [PERSON] et al. [1] compared and classified practitioner tools, mapping them to the Mitre ATT&CK framework. Moreover, [PERSON] et al. [164] provide a review of threat emulators while mapping to the Mitre ATT&CK matrix tactics.  
[PERSON] et al. [8] review and compare several methodologies and frameworks, including PTES, Building Security in Maturity Model (BSIMM), Metasploit Framework (MSF), OWASP Testing Guide (OTG), Information Systems Security Assessment Framework (ISSAF), and the Open Source Security Testing Methodology Manual (OSSTMM). However, no tools are reviewed; therefore, no classification is attempted.  
Our study significantly differs from previously published papers in both the number of tools covered and its exclusive focus on research-informed EH tools. By categorising the tools into process-based and knowledge-based classifications, we organise them according to specific phases, demonstrating where and when they are utilised in EH processes. While other reviews include classifications, the main contribution of our work is a more comprehensive and unique exploration. We surveyed 100 tools and classified them according to four different frameworks: PTES, Mitre ATT&CK, CyBOK, and ACM CCS. Additionally, we identify and analyze trends in developing, maintaining, and disseminating novel research-informed tools.