Place the tools section above the references section

Author: julio-cfa

current-version/2-Process/2-4-Operation/2-4-3-Pentest.md

@@ -22,14 +22,6 @@ Regardless of the approach, penetration testers will generally follow publicly-a
 - [OWASP Top 10 API](https://owasp.org/API-Security/editions/2023/en/0x11-t10/) - Most common security risks and vulnerabilities for APIs.
 - [OWASP Mobile Top 10](https://owasp.org/www-project-mobile-top-10/) - A list containing the most common and impactful mobile application security vulnerabilities.
 
-### Tools
-
-There are several tools that can help while performing penetration test against applications. The most common are:
-- [BurpSuite](https://portswigger.net/burp) - A comprehensive software tool used for web application security testing. Key features include a proxy for intercepting and modifying web traffic, a scanner for automated vulnerability detection and tools for performing manual testing, such as repeater, intruder and so forth.
-- [OWASP Zed Attack Proxy (ZAP)](https://www.zaproxy.org) - An open-source web proxy similar that has features similar to BurpSuite's.
-- [Postman](https://www.postman.com/) - API testing tool that allows sending various HTTP requests, manipulating headers and automating tests. It helps identify vulnerabilities like authentication issues and data exposure, integrating with other security tools for comprehensive analysis.
-- [MobSF](https://github.com/MobSF/Mobile-Security-Framework-MobSF) - Automated, open-source tool for security testing and analyzing mobile applications, supporting both Android and iOS platforms.
-
 ### Process Overview
 
 #### Assembling the team
@@ -84,6 +76,14 @@ Upon completing all tests, the penetration testing team will begin compiling a c
 
 Lastly, after delivering the report and initiating the vulnerability management process, the penetration testing team will retest all vulnerabilities that developers consider fixed. This retesting ensures that each vulnerability has been successfully addressed and that no bypasses to the newly implemented security controls exist.
 
+### Tools
+
+There are several tools that can help while performing penetration test against applications. The most common are:
+- [BurpSuite](https://portswigger.net/burp) - A comprehensive software tool used for web application security testing. Key features include a proxy for intercepting and modifying web traffic, a scanner for automated vulnerability detection and tools for performing manual testing, such as repeater, intruder and so forth.
+- [OWASP Zed Attack Proxy (ZAP)](https://www.zaproxy.org) - An open-source web proxy similar that has features similar to BurpSuite's.
+- [Postman](https://www.postman.com/) - API testing tool that allows sending various HTTP requests, manipulating headers and automating tests. It helps identify vulnerabilities like authentication issues and data exposure, integrating with other security tools for comprehensive analysis.
+- [MobSF](https://github.com/MobSF/Mobile-Security-Framework-MobSF) - Automated, open-source tool for security testing and analyzing mobile applications, supporting both Android and iOS platforms.
+
 ### References
 
 - [Awesome Penetration Testing](https://github.com/enaqx/awesome-pentest)