diff --git a/website/data/category_intros/penetration-testing.md b/website/data/category_intros/penetration-testing.md
index 26903099..cf79f2cd 100644
--- a/website/data/category_intros/penetration-testing.md
+++ b/website/data/category_intros/penetration-testing.md
@@ -1,18 +1,21 @@
-Only run sqlmap and SET against targets you're authorized to test. Like mitmproxy and Sherlock, they're Python penetration testing tools with one job each.
+With permission to test a web app, intercept its traffic in mitmproxy and test its inputs for SQL injection with sqlmap: two Python penetration testing tools.
 
 How to choose:
 
-- Testing a web app for SQL injection: sqlmap
-- Testing user awareness in social-engineering assessments: Social-Engineer Toolkit (SET)
-- Inspecting, changing, or scripting HTTP and HTTPS traffic: mitmproxy
-- Finding which social networks a username is registered on: Sherlock
+- Intercepting, inspecting, and scripting HTTP(S) traffic: mitmproxy
+- Detecting and exploiting SQL injection in a web app: sqlmap
+- Windows network protocols like SMB, MSRPC, and Kerberos: Impacket
+- Writing exploits and solving CTF challenges: pwntools
+- Finding a username's accounts across social networks: Sherlock
 
-sqlmap [automates detecting and exploiting SQL injection flaws](https://github.com/sqlmapproject/sqlmap) and taking over database servers. Its docs prefer [cloning the Git repository](https://github.com/sqlmapproject/sqlmap/wiki/Download-and-update) to installing from PyPI: `git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git sqlmap-dev`. Run it from that checkout, where `python sqlmap.py -h` lists the basic options, and read the [user's manual](https://github.com/sqlmapproject/sqlmap/wiki/Usage) for the rest.
+mitmproxy is [an interactive, SSL/TLS-capable intercepting proxy](https://docs.mitmproxy.org/stable/) with 3 front ends to the same core: mitmproxy in the console, mitmweb in the browser, and mitmdump on the command line. It [starts as a regular HTTP proxy on localhost:8080](https://docs.mitmproxy.org/stable/overview/getting-started/), so point your browser or device at it, then visit mitm.it to install the mitmproxy CA certificate, which lets it decrypt HTTPS. To script the traffic, write an [addon](https://docs.mitmproxy.org/stable/addons/overview/): a module with a `request(flow)` function is enough. Load it with `-s`.
 
-The Social-Engineer Toolkit (SET) is [a penetration testing framework for authorized social-engineering assessments](https://github.com/trustedsec/social-engineer-toolkit). It gives security teams guided attack vectors to test user awareness and run consent-based red-team exercises. On Kali Linux or WSL, install it with `sudo apt install set`. Elsewhere, install a source checkout into a virtual environment. Then `sudo setoolkit` launches its interactive console.
+sqlmap [automates detecting and exploiting SQL injection flaws and taking over database servers](https://github.com/sqlmapproject/sqlmap). Pass it a URL with a parameter, and it [finds the vulnerable parameter, the injection techniques that work, and the back-end database](https://github.com/sqlmapproject/sqlmap/wiki/Introduction).
 
-mitmproxy is [an interactive, TLS-capable intercepting proxy](https://docs.mitmproxy.org/stable/). It comes as three front ends to one core: the mitmproxy console, the mitmweb browser GUI, and mitmdump on the command line. The first two keep every flow in memory, so they're for small samples, while mitmdump records traffic and transforms it programmatically. On macOS, [install it](https://docs.mitmproxy.org/stable/overview/installation/) with `brew install --cask mitmproxy`. On Linux and Windows, download it from mitmproxy.org. It [starts as a regular HTTP proxy on localhost:8080](https://docs.mitmproxy.org/stable/overview/getting-started/): point your browser or device at it, then browse to mitm.it and install mitmproxy's certificate authority to see HTTPS traffic too. To change traffic in code, write a Python [addon](https://docs.mitmproxy.org/stable/addons/overview/#anatomy-of-an-addon) and load it with `-s`.
+Impacket is [a collection of Python classes for working with network protocols](https://github.com/fortra/impacket), with low-level access to packets and, for protocols like SMB and MSRPC, the protocol implementation itself. The scripts it ships are [tools written as examples of what the library can do](https://github.com/fortra/impacket/tree/master/examples).
 
-Sherlock [hunts down social media accounts by username](https://sherlockproject.xyz/) across social networks. Its docs [suggest pipx over pip](https://sherlockproject.xyz/installation): `pipx install sherlock-project`. Then `sherlock user123` [searches for one username](https://sherlockproject.xyz/usage), and `sherlock user1 user2 user3` for several. It saves the accounts it finds to a text file named after each username.
+pwntools is [a CTF framework and exploit development library](https://github.com/Gallopsled/pwntools), split into [2 modules](https://docs.pwntools.com/en/stable/about.html): `pwn` for CTFs and `pwnlib` as a clean Python library. `from pwn import *` gives you everything you need to write an exploit, but it also puts your terminal in raw mode and parses `sys.argv`, so import `pwnlib` when pwntools is part of another project. Either way, [tubes](https://docs.pwntools.com/en/stable/intro.html#making-connections) give you one interface to talk to processes, sockets, and SSH sessions.
 
-sqlmap and SET both put permission first. sqlmap calls [attacking targets without prior mutual consent illegal](https://github.com/sqlmapproject/sqlmap/wiki/License), and its FAQ says to practice [only against a target you own or have explicit permission to test](https://github.com/sqlmapproject/sqlmap/wiki/FAQ#where-can-i-practise-using-sqlmap). SET is [only for authorized testing](https://github.com/trustedsec/social-engineer-toolkit#responsible-use) where explicit permission and scope have been established, never against systems, accounts, networks, or people without consent.
+Sherlock [hunts down social media accounts by username](https://github.com/sherlock-project/sherlock). Run `sherlock user123`, or pass several usernames at once, and it [saves the accounts it finds to a text file per username](https://github.com/sherlock-project/sherlock#general-usage), like `user123.txt`.
+
+Run any of these tools only against systems you own or have explicit permission to test. That's [sqlmap's answer to where to practice](https://github.com/sqlmapproject/sqlmap/wiki/FAQ#where-can-i-practise-using-sqlmap), and every sqlmap run prints a disclaimer that attacking targets without prior mutual consent is illegal.