[Mr. Robot]

Just moved everything to the spoiler for old crap. Here is the new revised version, almost done with it.

Long story short, you simply enter a domain and it does the rest - completely whitelabel so you can choose your own companies logo, email, name etc it does the rest automatically.

All the text is dynamic depending on the output it discovers.. There is at the moment, AT LEAST 25 pages that gets generated. It can be more than that depending on what it finds about the target.






Spoiler (Click to View)(At this point I am just seeing if anyone wants to help out or run this as a whitelabel)

Just wanted to share this project I was working on basically.

So the idea is to create a nice 'common' reports audit for free for clients. Nothing too technical, will add in screenshots of the website and its subdomains, look for common files, leaked database entries etc etc,
Then it generates a PDF with all the formatting ready to send them.

That way they get a free overview of their site and gives you as the pentester a quick look for identifying obvious issues to discuss and look for exploiting.

Things to add:
Parameter extraction for endpoints.
Port scan for non cloudflare subdomains.
(Again the point is to not go too deep)
It also uses a large number of techniques to obtain vhosts and subdomains and goes through and deduplicates + checks for which ones are live.

Things like the email and logo are easy to change out for whoever is using it.

The input right now is simply run the script and enter the domain OR run with python main.py website.com. That's all you need and the PDF is generated.

In the time I was writing up this thread, I ran it on Hackforums.net to see what it would output so far.

(Oh yeah it also goes through and for any live subdomains it identifies will highlight them throughout the document)

Old images:



Made it look a bit better now with ticks/crosses and file path outputs. Haven't decided on the full end layout yet.



Added in a 403 check


(Still having an issue with http/https output using same file name so just gotta adjust that to make sure the results are recorded as unique for each)


I added in dynamic text depending on the results which calculates and updates the information according to the amount of subdomains identified.



So long story short, I have added in dynamic paragraphs based on the output so each scan is unique to the target and the information identified.
You can view the PDF yourself here if you want.
https://github.com/HFScripts/workinprogr...report.pdf

#Most up to date version.
Possibly to add:
- HSTS
- Truncate the parameter URLs to first 10
- Check for certificate validaton - dynamic text per non cloudflare IP
- (Possibly send all data to ChatGPT and have it generate an Executive Summary or most likely compromise scenario)
Today I create a python script using PIL to take the output of a command and turn it into an image that looks like a terminal. This is so I can attach 'images' to the PDF.
This allows me to highlight specific strings in the output to display in the output.



So here is an example of an entirely fake image/terminal created to contain the output to attach to the PDF



Here is also an example of a REAL scan I ran against Hackforums.

[Lukasi]

Tools like this can be sold for a fee. I believe there will be many people willing to purchase，I will be the first buyer and willing to promote it to others

[BiNBo]

A really cool project and idea! Not sure if you're planning to release this as an open source free little tool or something, but I'd definitely be interested!

[Money-]

I'll buy or have a look whenever u release.

[javierpena]

Looks neat and clean. Your projects are always an inspiration

[source]

Much better than the one I made 😂 https://hackforums.net/showthread.php?tid=6241332

Well done

[Evading]

Really nice, very useful & well laid out.

[Mr. Robot]

Tools like this can be sold for a fee. I believe there will be many people willing to purchase，I will be the first buyer and willing to promote it to others

It'll most likely be free but we'll see what happens when I am done. Will probably build it out with all custom modules so that even an idiot can run it.

A really cool project and idea! Not sure if you're planning to release this as an open source free little tool or something, but I'd definitely be interested!

That's what I was thinking - it was more of a test to see how far I can push the PDF generation and layout for clients but I'll see where it ends up.

Looks neat and clean. Your projects are always an inspiration

<3 I try to inspire.

Much better than the one I made 😂 https://hackforums.net/showthread.php?tid=6241332

Well done

I'm using fitz(PyMuPDF) and reportlab mainly with custom classes to define styles and processes. Image is easily changed out for example:

Code

# Download image
    image_url = 'URL to image'
    image_path = 'download-image.png'
    response = requests.get(image_url)
    with open(image_path, 'wb') as file:
        file.write(response.content)

    # Add image to the story
    story.append(Image(image_path, 4*inch, 4*inch))  # Adjust size as needed
    story.append(Spacer(1, 0.2*inch))

    story.append(Spacer(1, 0.2*inch))
    # This should be in the middle of the page
    story.append(Paragraph(f"Prepared By: Robot Security", styles['Title']))

Really nice, very useful & well laid out.

<3 thank you.

[Riggs]

I don't think it's accurate to classify this as a pentest report. It looks more like a discovery exercise. Cool idea though and something I think can still deliver value regardless.

I've worked at a number of companies where discovery exercises were important for the business to build a picture of and understand the wider attack surface. Sometimes internal processes fail or get bypassed and random projects get spun up without proper visibility and/or oversight, meaning assets end up externally exposed without any change control, documentation, or due diligence on security controls and data processing. Even if the output of a discovery exercise (manual or automated) enables the attack surface to be realised, the next big challenge is building an inventory of all those assets, validating them (that they belong to or are managed for and on behalf of the business), and then establishing a priority order for them to each be security assessed or pentested.

Honestly if I had the time right now I would look at building a subscription-based attack surface management platform. I just don't have the time as I'm already balancing a full-time job and several other projects. I know there's some solutions out there already (like Microsoft EASM), but all the ones I've seen are poorly maintained and the functionality unecessarily convoluted. Happy to share my ideas with you if it's perhaps something you want to consider pursuing yourself though.

Anyway best of luck with your project and good to see you're still contributing things like this to the community.

[Mr. Robot]

I don't think it's accurate to classify this as a pentest report. It looks more like a discovery exercise. Cool idea though and something I think can still deliver value regardless.

I've worked at a number of companies where discovery exercises were important for the business to build a picture of and understand the wider attack surface. Sometimes internal processes fail or get bypassed and random projects get spun up without proper visibility and/or oversight, meaning assets end up externally exposed without any change control, documentation, or due diligence on security controls and data processing. Even if the output of a discovery exercise (manual or automated) enables the attack surface to be realised, the next big challenge is building an inventory of all those assets, validating them (that they belong to or are managed for and on behalf of the business), and then establishing a priority order for them to each be security assessed or pentested.

Honestly if I had the time right now I would look at building a subscription-based attack surface management platform. I just don't have the time as I'm already balancing a full-time job and several other projects. I know there's some solutions out there already (like Microsoft EASM), but all the ones I've seen are poorly maintained and the functionality unecessarily convoluted. Happy to share my ideas with you if it's perhaps something you want to consider pursuing yourself though.

Anyway best of luck with your project and good to see you're still contributing things like this to the community.

I do agree with the overall sentiment of your post, it's mainly an overview and free 'quote' for clients.
:)

[diamondcf]

thats a very nice idea

[Mr. Robot]

Added some updates/changed the gif to a current version. The image didn't download successfully for the report so placeholder was put there.
Since I have added a retry function for the logo so will change that gif out shortly when I update it next.

[Stanley]

I'm Stanley HF's helper bot. The OP (original poster) of this thread wants everyone to see this page and has elected to bump it to the top of the showthread listing. Since HF doesn't want a ton of LQP (Low Quality Posts) this is the best method of bumping your content. There is a small βyte fee for each bump. Any OP can bump any of their threads on HF from the linked icon on the top of their first post.

If you haven't already read the first post of this thread we encourage you to do so.

Thanks,
Stanley

[Mr. Robot]

I don't think it's accurate to classify this as a pentest report. It looks more like a discovery exercise. Cool idea though and something I think can still deliver value regardless.

I've worked at a number of companies where discovery exercises were important for the business to build a picture of and understand the wider attack surface. Sometimes internal processes fail or get bypassed and random projects get spun up without proper visibility and/or oversight, meaning assets end up externally exposed without any change control, documentation, or due diligence on security controls and data processing. Even if the output of a discovery exercise (manual or automated) enables the attack surface to be realised, the next big challenge is building an inventory of all those assets, validating them (that they belong to or are managed for and on behalf of the business), and then establishing a priority order for them to each be security assessed or pentested.

Honestly if I had the time right now I would look at building a subscription-based attack surface management platform. I just don't have the time as I'm already balancing a full-time job and several other projects. I know there's some solutions out there already (like Microsoft EASM), but all the ones I've seen are poorly maintained and the functionality unecessarily convoluted. Happy to share my ideas with you if it's perhaps something you want to consider pursuing yourself though.

Anyway best of luck with your project and good to see you're still contributing things like this to the community.

Made some nice changes to it, I did take what you said to heart - this is never meant to replace a manual scan. This is something cheap that websites can purchase quickly to get an overview they can then pass onto the people required to do the job.
I use to go around with a board and printouts teaching security to small businesses and their employees - this is essentially taking that and turning it into a nice printable document that a company can use to assess some of the main issues they face before looking at a full hire or position to help with their security.

Ideally it works like this:
Pay for the base PDF. This gives you a starting point as a penetration tester and some points to go over with the client. From there they can decide to pay for a full checkup if they so see fit or they can pass it onto their security team to take a look into.

[Tor]

This looks awesome! Continue with the good work man!