nmap and sublist3r for recon burp suite / ffuf / gobuster for web testing impacket / Metasploit / Wireshark Network LinPEAS, WinPEAS and GTFOBins for PrivEsc pwntools for scripting
like if you use discord a lot, try looking into how discord works and see if you can try to find something interesting, and see if you can find a way to target it
though i wouldn't recommend doing discord, most of the easy stuff has been caught and patched by now, it's often recommended that you try looking at much smaller services