Spoiler (Click to View)(At this point I am just seeing if anyone wants to help out or run this as a whitelabel)

Just wanted to share this project I was working on basically.

So the idea is to create a nice 'common' reports audit for free for clients. Nothing too technical, will add in screenshots of the website and its subdomains, look for common files, leaked database entries etc etc,
Then it generates a PDF with all the formatting ready to send them.

That way they get a free overview of their site and gives you as the pentester a quick look for identifying obvious issues to discuss and look for exploiting.

Things to add:
Parameter extraction for endpoints.
Port scan for non cloudflare subdomains.
(Again the point is to not go too deep)
It also uses a large number of techniques to obtain vhosts and subdomains and goes through and deduplicates + checks for which ones are live.

Things like the email and logo are easy to change out for whoever is using it.

The input right now is simply run the script and enter the domain OR run with python main.py website.com. That's all you need and the PDF is generated.

In the time I was writing up this thread, I ran it on Hackforums.net to see what it would output so far.

(Oh yeah it also goes through and for any live subdomains it identifies will highlight them throughout the document)

Old images:



Made it look a bit better now with ticks/crosses and file path outputs. Haven't decided on the full end layout yet.



Added in a 403 check


(Still having an issue with http/https output using same file name so just gotta adjust that to make sure the results are recorded as unique for each)


I added in dynamic text depending on the results which calculates and updates the information according to the amount of subdomains identified.



So long story short, I have added in dynamic paragraphs based on the output so each scan is unique to the target and the information identified.
You can view the PDF yourself here if you want.
https://github.com/HFScripts/workinprogress/blob/main/penetration_test_report.pdf

#Most up to date version.
Possibly to add:
- HSTS
- Truncate the parameter URLs to first 10
- Check for certificate validaton - dynamic text per non cloudflare IP
- (Possibly send all data to ChatGPT and have it generate an Executive Summary or most likely compromise scenario)
Today I create a python script using PIL to take the output of a command and turn it into an image that looks like a terminal. This is so I can attach 'images' to the PDF.
This allows me to highlight specific strings in the output to display in the output.



So here is an example of an entirely fake image/terminal created to contain the output to attach to the PDF

(Jul 5, 2023 07:27 AM)Lukasi Wrote:  Tools like this can be sold for a fee. I believe there will be many people willing to purchase，I will be the first buyer and willing to promote it to others

(Jul 5, 2023 07:31 AM)BiNBo Wrote:  A really cool project and idea! Not sure if you're planning to release this as an open source free little tool or something, but I'd definitely be interested!

(Jul 5, 2023 08:11 AM)javierpena Wrote:  Looks neat and clean. Your projects are always an inspiration

(Jul 5, 2023 10:12 AM)source Wrote:  Much better than the one I made 😂 https://hackforums.net/showthread.php?tid=6241332

Well done

(Jul 5, 2023 10:49 AM)KEDELA Wrote:  Really nice, very useful & well laid out.

(Jul 8, 2023 04:21 AM)Agent Smith Wrote:  I don't think it's accurate to classify this as a pentest report. It looks more like a discovery exercise. Cool idea though and something I think can still deliver value regardless.

I've worked at a number of companies where discovery exercises were important for the business to build a picture of and understand the wider attack surface. Sometimes internal processes fail or get bypassed and random projects get spun up without proper visibility and/or oversight, meaning assets end up externally exposed without any change control, documentation, or due diligence on security controls and data processing. Even if the output of a discovery exercise (manual or automated) enables the attack surface to be realised, the next big challenge is building an inventory of all those assets, validating them (that they belong to or are managed for and on behalf of the business), and then establishing a priority order for them to each be security assessed or pentested.

Honestly if I had the time right now I would look at building a subscription-based attack surface management platform. I just don't have the time as I'm already balancing a full-time job and several other projects. I know there's some solutions out there already (like Microsoft EASM), but all the ones I've seen are poorly maintained and the functionality unecessarily convoluted. Happy to share my ideas with you if it's perhaps something you want to consider pursuing yourself though.

Anyway best of luck with your project and good to see you're still contributing things like this to the community.

(Jul 8, 2023 04:21 AM)Agent Smith Wrote:  I don't think it's accurate to classify this as a pentest report. It looks more like a discovery exercise. Cool idea though and something I think can still deliver value regardless.

I've worked at a number of companies where discovery exercises were important for the business to build a picture of and understand the wider attack surface. Sometimes internal processes fail or get bypassed and random projects get spun up without proper visibility and/or oversight, meaning assets end up externally exposed without any change control, documentation, or due diligence on security controls and data processing. Even if the output of a discovery exercise (manual or automated) enables the attack surface to be realised, the next big challenge is building an inventory of all those assets, validating them (that they belong to or are managed for and on behalf of the business), and then establishing a priority order for them to each be security assessed or pentested.

Honestly if I had the time right now I would look at building a subscription-based attack surface management platform. I just don't have the time as I'm already balancing a full-time job and several other projects. I know there's some solutions out there already (like Microsoft EASM), but all the ones I've seen are poorly maintained and the functionality unecessarily convoluted. Happy to share my ideas with you if it's perhaps something you want to consider pursuing yourself though.

Anyway best of luck with your project and good to see you're still contributing things like this to the community.