Initializing Pentest Pilot…
Pentest Pilot orchestrates open-source security scanners inside isolated Docker containers, normalises findings, manages assets, correlates results with AI, and delivers enterprise-grade offensive security workflows.
A unified platform that eliminates tool sprawl and normalises findings across every scanner — from recon to final report.
Every scan job runs inside an ephemeral docker run --rm container dispatched by a Supabase-backed job queue. No dependency conflicts, no host pollution, clean state on every run.
All IOC events from every scanner land in a single normalised view with CVSS 3.1 & 4.0 scoring, severity filtering, evidence attachments, and a Kanban workflow for tracking remediation status.
Cloud models (Groq / OpenRouter) or a local Ollama LLM analyse findings, generate executive summaries, and suggest remediation — all user-supplied data is sanitised before it reaches any prompt.
Each finding maps to ATT&CK techniques and tactics. An interactive attack graph visualises lateral movement paths and technique relationships across the engagement — giving defenders and reviewers a clear kill-chain picture.
Generate branded reports with executive summaries, CVSS breakdowns, MITRE mappings, and rules of engagement. Reports are versioned with diffs, and token-based public share links let you deliver findings without sharing credentials.
Live log streaming from Docker workers via Supabase Realtime. Watch raw scanner output and IOC events appear in the UI as they happen — no polling, no page refresh.
A per-project encrypted vault stores credentials, API keys, and engagement secrets. Row-Level Security enforces access: team leads manage the project and members; pentesters run scans and log findings.
An event-driven pipeline from target selection to actionable findings — backed by Supabase, Docker, and Redis.
Battle-tested open-source tools, containerised and normalised into a single IOC pipeline — each with a typed TypeScript parser adapter.
Port scanning, service version detection, and OS fingerprinting. XML output is parsed into typed IOC events covering open ports, discovered hosts, and service banners.
Template-based vulnerability detection for CVEs, misconfigurations, and exposed secrets. Runs configurable module sets (basic / cves / exposures / technologies / full).
Fast directory and virtual-host enumeration over HTTP/HTTPS with customisable wordlists and extension filtering.
Passive subdomain discovery aggregating certificate transparency logs, DNS datasets, and public APIs — no active probing required.
Checks for outdated server software, default credentials, dangerous HTTP methods, and 6,000+ known vulnerability signatures across web servers.
Enumerates users, shares, groups, password policies, and OS details from Windows / Samba hosts via SMB. Outputs structured JSON via a custom entrypoint bridge.
Detects anonymous login, grabs service banners, lists directories, and matches detected software against a local exploit database. Vendored and patched for JSON output.
Identifies weak ciphers, deprecated key-exchange algorithms, outdated server versions, and SSH policy violations — integration in progress.
Protocol-aware credential testing and post-authentication enumeration over SMB, RDP, WinRM, LDAP, and MSSQL — successor to CrackMapExec.
Future Integrations
Milestones completed during the graduation project and what comes next.
Ephemeral Docker containers dispatched by a Supabase job queue, stdout capture, and a typed IOC event pipeline with seven parser adapters: Nmap, Nuclei, Gobuster, Subfinder, Nikto, Enum4Linux-NG, and FTP-Scan.
CVSS 3.1 & 4.0 scoring, evidence file attachments, Kanban remediation workflow, recon asset inventory, and per-project encrypted vault for credentials and secrets.
Per-finding MITRE technique and tactic tagging, an interactive attack-graph visualisation showing lateral movement paths, and AI-assisted technique mapping.
Cloud models (Groq / OpenRouter, OpenAI-compatible) or a local Ollama LLM for vulnerability analysis, MITRE mapping, and executive-summary generation — configurable in-app under Settings → AI.
Branded reports with executive summaries, severity breakdowns, MITRE mappings, and rules-of-engagement docs. Reports are versioned with diffs, and shareable via token-based public links — no login required for recipients.
Completing the scanner roster: SSH-Audit for cipher and algorithm auditing, NetExec for credential testing over SMB/RDP/WinRM/LDAP — both following the same Dockerfile + parser + module-selector pattern.
A documented adapter interface so contributors can package custom scanners (Dockerfile + TypeScript parser) and register them without modifying the core worker — drop-in scanner extensions.
Pre-built report templates aligned to OWASP Testing Guide, PTES, and NIST SP 800-115, plus automated SLA tracking for finding remediation deadlines.
Pentest Pilot is an open-source, AI-assisted penetration testing management platform built as a Cairo University graduation project. It orchestrates 7+ security scanners inside isolated Docker containers, normalises their output into structured IOC findings, maps them to MITRE ATT&CK, and provides an 18-tab project workspace covering the full pentest lifecycle — from recon through report delivery.
Yes — fully open source and available on GitHub under the Graduation-Project-PentestPilot organisation. The stack is React 18 + TypeScript + Vite on the frontend, Supabase (Postgres + RLS + Auth + Edge Functions + Storage) as the backend, and Node.js scan workers. You can self-host every component, including the Supabase instance.
Every scan job runs as docker run --rm — the container is created when the worker claims the job and destroyed immediately after stdout is captured. Containers communicate only on a dedicated scan Docker network; the host filesystem is never mounted and no secrets are baked into the images. This guarantees clean state between runs and prevents dependency conflicts or lateral movement between scan jobs.
There are two global roles: team lead (privileged) and pentester. Team leads create projects, manage members, and control report publishing. Pentesters run scans and log findings within projects they're members of. Access is enforced at the database level via Supabase Row-Level Security on every table — no client-side-only permission checks.
Yes. The framework is modular: provide a Docker image, a TypeScript parser that converts raw output to IocEvent[], and register the tool in the worker's dispatch table and the frontend's scanner list. The existing Nmap, Nuclei, and Enum4Linux-NG integrations serve as reference implementations at three levels of complexity. A custom tool type also exists for ad-hoc one-off scan jobs.
Any system with Docker installed: Linux, macOS, and Windows (WSL 2 or Docker Desktop). Development mode also includes a host-based local runner (npm run dev:runner) that executes whitelisted tools directly on the host with no Docker or Redis dependency — useful for quick iterations without the full containerised stack.
AI is configured in-app under Settings → AI. You choose between a cloud provider (Groq or OpenRouter — both OpenAI-compatible) or a local Ollama instance at localhost:11434. In cloud mode, finding and evidence text is sent to the selected provider; all user-supplied content is sanitised and length-capped before it leaves the app. In local mode, no data leaves your machine. If no provider is reachable, AI features degrade gracefully — scanning and reporting work normally.
Download the source code and have a full penetration testing platform running in minutes.
Enter your details to receive access to Pentest Pilot and stay updated on new releases.
Thank you for your interest in Pentest Pilot.
Your download will begin in a moment…
Please check your connection and try again.