Autonomous Pentest Platform & AI Security Tool Auditor
PentAudit is a specialized python security tool designed to audit the security posture of autonomous pentest platforms and AI security tools deployed on an internal network.
Autonomous pentest platforms (like PenTera, NodeZero) and AI-driven behavior analytics/UEBA platforms (like Exabeam, Darktrace) are extremely powerful. However, because they must harvest credentials, run active scans, and have high-level network permissions, they become a prime target for insiders. PentAudit helps security teams verify that their security tools aren't creating new, critical blind spots or acting as launchpads for internal attackers.
- Network Discovery: Scans internal subnets via fast, multithreaded socket scanners and
nmapintegration to find dashboards of major pentest and AI tools. - HTTP Fingerprinting: Connects to discovered dashboards and analyzes titles, headers, and body signatures to identify the platforms with calculated confidence levels.
- DNS Enumeration: Automatically checks for obvious DNS names (e.g.,
pentera.corp.local,nodezero.*) that insiders could easily guess. - Exposed Report Scanner: Scans file shares for exported pentest reports (PDF, CSV, XLSX) left open to standard users.
- 8 Automated Security Checks: Evaluates the identified systems against common exposure vectors.
- Professional HTML Reports: Generates dark-themed, glassmorphic, interactive HTML dashboards containing executive statistics, technical evidence, mitigation guidelines, and mapping to MITRE ATT&CK and NIST SP 800-53.
- Educational Demo Mode: Runs with simulated data to easily demonstrate the tool's capabilities for interviews or showcases.
PentAudit automates 8 core checks to identify critical configuration gaps:
| Check ID | Security Check | Threat Vector | MITRE Technique | NIST Control |
|---|---|---|---|---|
| CHK-001 | Dashboard Auth | Web console accessible without login | T1078 (Valid Accounts) | AC-3 (Access Enforcement) |
| CHK-002 | Default Credentials | Factory-set passwords still active | T1078.001 (Default Accounts) | IA-5 (Authenticator Mgmt) |
| CHK-003 | MFA Enforcement | Multi-factor authentication missing | T1078 (Valid Accounts) | IA-2(1) (MFA) |
| CHK-004 | API Key Exposure | REST APIs accessible without tokens | T1106 (Native API) | SC-8 (Transmission Conf) |
| CHK-005 | Share Permissions | Exported reports open to domain users | T1039 (Network Shared Drive) | AC-6 (Least Privilege) |
| CHK-006 | UEBA Whitelist Gap | Platform IP permanently excluded from AI SIEM | T1562.001 (Impair Defenses) | SI-4 (System Monitoring) |
| CHK-007 | Session Management | Insecure cookie flags and missing timeout | T1539 (Steal Web Session) | AC-12 (Session Termination) |
| CHK-008 | Credential Storage | Harvested NTLM/hashes stored unrotated | T1552 (Unsecured Credentials) | SC-28 (Protection at Rest) |
PentAudit generates high-fidelity, interactive reports designed to impress both executives and engineers. Below is an overview of the report structure:
- Executive Risk Summary: Shows overall system risk score (Critical, High, Medium, Low) and statistics cards.
- Platform Inventory: Lists identified hosts, ports, confidence levels, and active links.
- MITRE ATT&CK & NIST SP 800-53 Mappings: Every finding is linked directly to industry-standard offensive and defensive security frameworks.
- Remediation Plans: Provides actionable, step-by-step mitigation instructions for network administrators.
(You can find a complete generated report in examples/sample_report.html)
-
Clone the repository:
git clone https://github.com/yourusername/pentaudit.git cd pentaudit -
Install the dependencies:
pip install -r requirements.txt
-
(Optional) Install Nmap on your system to enable advanced active port scanning and service fingerprint detection. If Nmap is not installed, PentAudit automatically falls back to a clean, multithreaded socket scanner.
Excellent for demonstrating the tool's performance and output format for recruiters or interviews:
python pentaudit.py --demo --output demo_report.htmlScan an internal subnet and identify exposed platforms:
python pentaudit.py --target 192.168.1.0/24 --output live_report.htmlResolve potential dashboard addresses using common naming patterns:
python pentaudit.py --target 192.168.1.0/24 --domain corp.internal --discover-onlyLoad previous results from JSON and export a new styled HTML dashboard:
python pentaudit.py --from-results report.json --output new_report.htmlpentaudit/
├── README.md # Project description, setup, usage
├── requirements.txt # Python dependencies
├── pentaudit.py # Root-level entry point wrapper
├── pentaudit/
│ ├── __init__.py # Package details
│ ├── main.py # CLI parser and core flow orchestrator
│ ├── discovery.py # Multithreaded socket/nmap network scanner
│ ├── auditor.py # The 8 automated security checks
│ ├── reporter.py # Jinja2 and raw-string report engine
│ ├── config.py # Constants, signatures, and default credentials database
│ └── utils.py # Safe console writing wrapper with ASCII fallbacks
├── templates/
│ └── report_template.html # High-fidelity glassmorphic HTML template
├── tests/
│ ├── test_discovery.py # Unit tests for discovery scanning
│ ├── test_auditor.py # Unit tests for active security checks
│ └── test_reporter.py # Unit tests for stats and file builders
├── docs/
│ └── architecture.md # Detailed technical design document
└── examples/
└── sample_report.html # Pre-generated audit report sample
Ensure all functionalities are working properly using the standard python test runner:
python -m unittest discover -s testsThis project is built based on original research analyzing the security blind spots of autonomous pentest platforms in internal enterprise networks. The detailed analysis, threat modeling, and defensive methodologies can be found in our technical blog: Hacking the Hackers: Auditing Autonomous Pentest Platforms.
This project is licensed under the MIT License - see the LICENSE file for details.