2. My understanding is large companies are spending huge amounts of money on securing their networks - so I am not sure if the conventional pen test tools and techniques taught in books and class would still work in today's world.
It depends on what books you read, and what classes you attend. Some (actually a lot of) ancient knowledge, can still be used today (even flaws in IPv6, and Arp Spoofing on many networks. Think of them as often insider attacks, as these can occur). However, SQL Injection and XSS for example, these are application layer attacks. Both are around 10 years old, and still taught. Buffer overflows, are also very old, these also works still. Even though blackhats target the client applications more and more often, such as the browsers and plugins (like java, flash, adobe reader, etc.) as there's a larger attack surface, and thereby more ways to compromise a client, which may be connected to a network.
But in essence, it is not about the tools, because if you're a good hacker, then you can write these tools yourself if you need to, but writing your own port scanner from scratch (no using netcat, telnet, or whatever), takes time and often there's already a good solution to that such as NMAP, randscan, or whatever you use. NMAP is.. Over 10 years old and it's still being used by pretty much all pentesters? It has it quirks yes, and it's detectable, but if you use it with care, and know how the tool works, you can also avoid detection when you use this program.
There is of course, even protocol attacks you can barely patch against.
Very interesting perspectives. Thanks for sharing them. When you say orgs are weak from inside - do you mean network layer or application layer?
Any layer. Even the physical layer. Often they're vulnerable to various network attacks, but there are also outdated clients and servers on some networks, which goes all the way up to application level vulnerabilities.
Network Pen Testing : AIX Vulnerability Assessments
