🛡️ PentestKit

PentestKit is a professional penetration testing toolkit available in both Python and Bash versions. Designed for security professionals and bug bounty hunters, it automates comprehensive security assessments with detailed reporting.

📸 Toolkit Interfaces

🐍 Python Version Python UI

💻 Bash Version Bash interactive UI

📦 Available Versions

🐍 Python Version (pentestkit.py)

Advanced toolkit with extensive features and PDF report generation.

💻 Bash Version (pentestkit.sh)

Lightweight, native Linux toolkit with beautiful terminal UI and interactive menus.

---

✨ Features Comparison

Feature	Python Version	Bash Version
Reconnaissance	✅	✅
Subdomain Enumeration	✅	✅
Port Scanning	✅	✅
SSL/TLS Analysis	✅	✅
Web Vulnerability Scanning	✅	✅
SQL Injection Testing	✅	❌
XSS Detection	✅	❌
HTML Report	✅	✅
PDF Report	✅	❌
JSON Report	✅	✅
Interactive Menu	❌	✅
Scan Profiles	❌	✅ (Quick/Normal/Deep)
Progress Bars	❌	✅
Colored Output	✅	✅
Configuration File	❌	✅
Parallel Processing	❌	✅

---

📥 Installation

Prerequisites

# Update system
sudo apt update

# Install core tools
sudo apt install -y \
    python3 python3-pip \
    nmap masscan nikto sqlmap gobuster \
    whois dnsutils curl git jq bc \
    sslscan wafw00f whatweb traceroute

# Install subfinder
GO111MODULE=on go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

# Python only: PDF generation
sudo apt install wkhtmltopdf

# Python dependencies
pip3 install requests jq

Clone Repository

git clone https://github.com/therealilyas/pentest-toolkit.git
cd pentestkit
chmod +x pentestkit.py pentestkit.sh

---

🚀 Usage

Python Version

# Basic scan
python3 pentestkit.py https://example.com

# Custom output directory
python3 pentestkit.py https://example.com -o /path/to/output

# Verbose mode
python3 pentestkit.py https://example.com -v

# Help
python3 pentestkit.py --help

Bash Version

# Run toolkit (interactive menu)
sudo ./pentestkit.sh

# Menu Navigation:
# 1. Set Target
# 2. Select Scan Profile (Quick/Normal/Deep)
# 3. Run Full Scan
# 4. Run Custom Scan (individual modules)
# 5. View Results
# 6. Generate Report
# 7. Check Tools
# 8. Configuration
# 9. About
# 0. Exit

---

📖 Command-Line Options

Python Version

usage: pentestkit.py [-h] [-o OUTPUT] [-v] [--version] target

positional arguments:
  target                Target URL (http:// or https://)

optional arguments:
  -h, --help           Show help message
  -o OUTPUT            Custom output directory
  -v, --verbose        Enable verbose output
  --version            Show version number

Bash Version

# Interactive mode (recommended)
./pentestkit.sh

# Configuration file: ~/.pentest_toolkit.conf

---

📁 Output Structure

Python Version

pentestkit_example.com_20250103_120000/
├── reconnaissance/
│   ├── subdomains.txt
│   ├── dns_info.txt
│   └── whois_info.txt
├── port_scanning/
│   ├── nmap_detailed.txt
│   └── nmap_quick.txt
├── enumeration/
│   ├── directories.txt
│   └── api_endpoints.txt
├── vulnerabilities/
│   ├── nikto_scan.txt
│   ├── sqlmap.txt
│   └── ssl_scan.txt
└── reports/
    ├── security_report.html
    ├── security_report.pdf
    ├── scan_report.json
    └── executive_summary.txt

Bash Version

pentest_example.com_20250103_120000/
├── whois.txt
├── dns_*.txt
├── subdomains_*.txt
├── nmap_scan.txt
├── open_ports.txt
├── ssl_analysis.txt
├── nikto_scan.txt
├── http_headers.txt
├── geolocation.json
├── report.html
├── results.txt
└── scan.log

---

🎯 Scan Profiles (Bash Version)

Profile	Duration	Description
Quick	~5 min	Fast reconnaissance, top 100 ports
Normal	~15 min	Standard assessment, top 1000 ports
Deep	~45 min	Comprehensive analysis, all ports

---

📊 Report Features

Python Version

• HTML report with modern design
• PDF report (print-ready)
• JSON data (machine-readable)
• Executive summary (text)
• CVSS scoring
• Detailed remediation steps

Bash Version

• Interactive HTML report with Tailwind CSS
• Risk scoring system (0-100)
• Color-coded severity levels
• Text summary report
• Real-time progress indicators
• Comprehensive logging

---

🎨 Terminal UI (Bash Version)

╔═══════════════════════════════════════════════════════════════════╗
║                                                                   ║
║     ███████╗███╗   ██╗██╗  ██╗ █████╗ ███╗   ██╗ ██████╗███████╗ ║
║     ██╔════╝████╗  ██║██║  ██║██╔══██╗████╗  ██║██╔════╝██╔════╝ ║
║     █████╗  ██╔██╗ ██║███████║███████║██╔██╗ ██║██║     █████╗   ║
║     ██╔══╝  ██║╚██╗██║██╔══██║██╔══██║██║╚██╗██║██║     ██╔══╝   ║
║     ███████╗██║ ╚████║██║  ██║██║  ██║██║ ╚████║╚██████╗███████╗ ║
║     ╚══════╝╚═╝  ╚═══╝╚═╝  ╚═╝╚═╝  ╚═╝╚═╝  ╚═══╝ ╚═════╝╚══════╝ ║
║                                                                   ║
║        Enhanced Bash Penetration Testing Toolkit v3.0             ║
║              Professional Security Assessment Suite               ║
║                                                                   ║
║  Author:   Ilyas Sultanov                                         ║
║  GitHub:   github.com/therealilyas                                ║
║  Email:    ilyas.sultanov@accesa.uz                               ║
║  LinkedIn: linkedin.com/in/ilyas-sultanov                         ║
║                                                                   ║
╚═══════════════════════════════════════════════════════════════════╝

---

🛠️ Advanced Usage

Automated Scanning (Python)

#!/bin/bash
targets=(
    "https://example1.com"
    "https://example2.com"
)

for target in "${targets[@]}"; do
    python3 pentestkit.py "$target"
done

Custom Module Scan (Bash)

# Run only specific modules
./pentestkit.sh
# Then select: 4. Run Custom Scan
# Choose individual modules: 1-6

Configuration (Bash)

Edit ~/.pentest_toolkit.conf:

MAX_PARALLEL_JOBS=5
QUICK_SCAN_TIMEOUT=300
NORMAL_SCAN_TIMEOUT=600
DEEP_SCAN_TIMEOUT=1800

---

🎯 Vulnerability Severity

Level	CVSS	Color	Action
Critical	9.0-10.0	🔴	Immediate
High	7.0-8.9	🟠	High Priority
Medium	4.0-6.9	🟡	Medium Priority
Low	0.1-3.9	🟢	Low Priority
Info	0.0	🔵	Informational

---

⚠️ Legal Disclaimer

This tool is for authorized security testing only.

✅ Allowed:

• Testing systems you own
• Testing with written permission
• Authorized penetration testing
• Educational purposes

❌ Prohibited:

• Unauthorized access
• Malicious activities
• Illegal testing
• Violation of laws

By using this tool, you agree to:

1. Only conduct authorized testing
2. Obtain proper permissions
3. Follow responsible disclosure
4. Comply with all laws

The author assumes no liability for misuse.

---

🤝 Contributing

Contributions welcome!

1. Fork the repository
2. Create feature branch: git checkout -b feature/NewFeature
3. Commit changes: git commit -m 'Add NewFeature'
4. Push branch: git push origin feature/NewFeature
5. Open Pull Request

---

🐛 Bug Reports

Open an issue with:

• Description
• Steps to reproduce
• Expected vs actual behavior
• System information

---

📝 Roadmap

• WordPress scanning
• Authenticated scans
• Docker support
• API endpoint
• Multi-threading (Python)
• Real-time notifications
• Metasploit integration
• Custom payloads

---

📚 Resources

Tools Used:

• Nmap - Network scanning
• Masscan - Fast port scanner
• Subfinder - Subdomain discovery
• Gobuster - Directory brute-forcing
• Nikto - Web server scanner
• SQLMap - SQL injection
• SSLScan - SSL/TLS scanner

Learning:

• OWASP Testing Guide
• Bug Bounty Methodology
• PortSwigger Academy

---

📄 License

MIT License - See LICENSE file

Copyright (c) 2025 Ilyas Sultanov

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND.

---

👥 Author

Ilyas Sultanov

• GitHub: @therealilyas
• Email: ilyas.sultanov@accesa.uz
• LinkedIn: ilyas-sultanov

---

📞 Support

• Issues: GitHub Issues
• Discussions: GitHub Discussions
• Email: ilyas.sultanov@accesa.uz

⭐ Star History

If you find this tool useful, please consider giving it a star! ⭐

Made by Ilyas Sultanov (Security Research Team)
Back to top