Below some tools you can use for exploitation while performing a penetration test:

acccheck: SMB brute forcer (login/password)

Aircrack: a suite of tools for 802.11a/b/g WEP and WPA cracking

Armitage: GUI front-end for the Metasploit Framework

backdoor-factory: patch win32/64 binaries with shellcode

BBQSQL: SQL injection tools highly customizable

BeEF: Browser Exploitation Framework, penetration testing tool that focuses on the web browser

Burp Suite: an integrated platform for performing security testing of web applications

cookie-cadger: catch web session on the network and reuse them to steal the session on a new browser

copy/merge-router-config: copy/merge config files from cisco router running snmp

...

Articles

Hostile subdomain takeover by Detectify
Hijacking of abandoned subdomains by Detectify

Tools

dnsexpire by me
3rdparty-services by me

...

Description

Path-relative style sheet import by PortSwigger

Articles

Detecting and exploiting PRSSI vulnerabilites by PortSwigger
Relative path overwrite by The Spanner

...

Description

CORS OriginHeaderScrutiny by OWASP

Cross-origin resource sharing by Wikipedia

Cross-origin resource sharing by PortSwigger
Cross-origin resource sharing: arbitrary origin trusted by PortSwigger
Cross-origin resource sharing: unencrypted origin trusted by PortSwigger
Cross-origin resource sharing: all subdomains trusted by PortSwigger

Articles

Exploiting CORS Misconfigurations for Bitcoins and Bounties by PortSwigger
Exploiting Misconfigured CORS by Geekboy
Critical Issue Opened Private Chats of Facebook Messenger Users by Cynet

Tools

testcors by me

...

Description

Clickjacking by Wikipedia

Frameable response (potential Clickjacking) by PortSwigger

...