pentest-dast

What problem does it solve?

DAST, infrastructure, authentication, and container testing workflows for live targets, enabling security teams to assess and prove the security posture of owned or authorized systems.

Core Features & Use Cases

• Target Discovery with nmap for service and version fingerprinting, plus Docker-Compose inventory parsing to map internal services.
• Web Probing with nuclei and ffuf for CVE pattern matching, exposure detection, and path discovery; SQLi testing with sqlmap.
• Auth Attacks including JWT manipulation, session fixation, and privilege escalation vectors within approved scopes.
• Bounded Resource Exhaustion probes to identify single-node denial conditions without running distributed attacks.
• IaC Scanning guidance using common tooling to detect misconfigurations in Terraform, CloudFormation, and Kubernetes manifests.
• Container Scanning and Escape Probes to assess run-time hardening and potential container escape risks.
• PoC Capture & Safety: each verified finding includes a reproducible PoC script stored under .pentest/exploits with safe output capture.
• Rate Limiting & Safety: respect configured rate limits, abort on 5xx floods, and maintain scope discipline during testing.
• Output artifacts: documented evidence and findings under .pentest/evidence paths.

Quick Start

Initiate a live-target security assessment within scope and begin with a reconnaissance pass using nmap to identify services and inventory.