How kuray12/pentest works
Pentest Automation Orchestrator is a Bash-driven recon and vulnerability-scanning workflow. An authorized operator supplies a target; the script runs available discovery and scanning stages, stores artifacts under results/<target>/, then consolidates selected scanner outputs into deduplicated Markdown and JSON findings. The README documents the major stages and optional integrations; only the consolidator source was sampled, so detailed stage-to-stage data flow is omitted where it cannot be verified.
Main entry points: pentest_automation.sh Workflow runner · consolidate_findings.py Finding consolidator
Components 24
Orchestration
- Target input
pentest_automation.sh - Workflow runner
pentest_automation.sh
Reconnaissance
- Subdomain enumeration
pentest_automation.sh - DNS resolution
pentest_automation.sh - Host probing
pentest_automation.sh - Screenshots
pentest_automation.sh - Fingerprinting
pentest_automation.sh - Takeover checks
pentest_automation.sh - Favicon hashing
pentest_automation.sh - URL harvesting
pentest_automation.sh - Parameter discovery
pentest_automation.sh - JavaScript recon
pentest_automation.sh
Scanning
- Port scanning
pentest_automation.sh - Directory discovery
pentest_automation.sh - Pattern matching
pentest_automation.sh - Secret scanning
pentest_automation.sh - Vulnerability scanners
pentest_automation.sh - Cloud enumeration
pentest_automation.sh - Login testing
pentest_automation.sh
Reporting
- Scan artifacts
- Finding consolidator
consolidate_findings.py - Deduplicated findings
- Stage summary
Other components
- Authorized operator
Connections 40
- Authorized operator → Target input: supplies target
- Target input → Workflow runner: starts run
- Workflow runner → Subdomain enumeration: runs stage
- Workflow runner → DNS resolution: runs stage
- Workflow runner → Host probing: runs stage
- Workflow runner → Screenshots: runs stage
- Workflow runner → Fingerprinting: runs stage
- Workflow runner → Takeover checks: runs stage
- Workflow runner → Favicon hashing: runs stage
- Workflow runner → Port scanning: runs stage
- Workflow runner → Directory discovery: runs stage
- Workflow runner → URL harvesting: runs stage
- Workflow runner → Parameter discovery: runs stage
- Workflow runner → Pattern matching: runs stage
- Workflow runner → JavaScript recon: runs stage
- Workflow runner → Secret scanning: runs stage
- Workflow runner → Vulnerability scanners: runs stage
- Workflow runner → Cloud enumeration: runs stage
- Workflow runner → Login testing: optional stage
- Subdomain enumeration → Scan artifacts: writes artifacts
- DNS resolution → Scan artifacts: writes artifacts
- Host probing → Scan artifacts: writes artifacts
- Screenshots → Scan artifacts: writes artifacts
- Fingerprinting → Scan artifacts: writes artifacts
- Takeover checks → Scan artifacts: writes artifacts
- Favicon hashing → Scan artifacts: writes artifacts
- Port scanning → Scan artifacts: writes artifacts
- Directory discovery → Scan artifacts: writes artifacts
- URL harvesting → Scan artifacts: writes artifacts
- Parameter discovery → Scan artifacts: writes artifacts
- Pattern matching → Scan artifacts: writes artifacts
- JavaScript recon → Scan artifacts: writes artifacts
- Secret scanning → Scan artifacts: writes artifacts
- Vulnerability scanners → Scan artifacts: writes artifacts
- Cloud enumeration → Scan artifacts: writes artifacts
- Login testing → Scan artifacts: writes artifacts
- Workflow runner → Finding consolidator: invokes
- Scan artifacts → Finding consolidator: reads scanner files
- Finding consolidator → Deduplicated findings: writes reports
- Workflow runner → Stage summary: produces