PenTest Platform

A comprehensive penetration testing management platform built with Django. This platform provides a complete solution for managing penetration testing projects, vulnerabilities, reports, and team collaboration.

Features

🔐 User Authentication & Role Management

• Multi-role system: Admin, Penetration Tester, Client
• Multi-Factor Authentication (MFA) with TOTP support
• JWT-based sessions for secure authentication
• Role-Based Access Control (RBAC) throughout the platform

📊 Project Management

• Complete project lifecycle management
• Team assignment and collaboration
• Project scope definition (target IPs, domains, applications)
• Timeline and phase management
• Task assignment and tracking
• Real-time progress monitoring

🔍 Vulnerability Management

• Automated scanning integration (Nmap, OWASP ZAP, Nikto)
• Manual vulnerability entry
• CVSS scoring and CVE tracking
• Severity categorization (Critical, High, Medium, Low, Informational)
• Proof of Concept documentation
• Remediation tracking
• Evidence file attachments

📈 Advanced Reporting

• Professional PDF report generation
• Customizable report templates
• Executive and technical report formats
• CSV data export
• Automated report scheduling
• Charts and visualizations

💬 Collaboration Tools

• Real-time notifications
• Project comments and discussions
• File sharing with encryption
• Team communication features
• Activity tracking

📊 Analytics & Dashboard

• Interactive dashboards with role-based views
• Vulnerability trend analysis
• Project progress tracking
• Team performance metrics
• Compliance reporting
• Real-time charts and graphs

🔒 Security Features

• Encrypted file storage
• Comprehensive audit logging
• Security event monitoring
• Data retention policies
• Access control and permissions
• Session management

🌐 Client Portal

• Dedicated client interface
• Project status visibility
• Report downloads
• Progress tracking
• Remediation guidance

Technology Stack

• Backend: Django 4.2, Django REST Framework
• Database: SQLite (development), PostgreSQL (production ready)
• Frontend: Bootstrap 5, Chart.js, Font Awesome
• Real-time: Django Channels, WebSockets
• Task Queue: Celery with Redis
• Security: Cryptography, PyOTP for MFA
• Reports: ReportLab for PDF generation
• Scanning: Python-nmap, OWASP ZAP API, Nikto integration

Quick Start

Prerequisites

• Python 3.8+
• Redis (for Celery and Channels)
• Git

Installation

1. Clone the repository

git clone <repository-url>
cd pentest-platform

2. Create virtual environment

python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

3. Install dependencies

pip install -r requirements.txt

4. Environment setup

cp .env.example .env
# Edit .env with your configuration

5. Database setup

python manage.py makemigrations
python manage.py migrate

6. Create sample users

python create_superuser.py

7. Collect static files

python manage.py collectstatic --noinput

8. Run the development server

python manage.py runserver

Default Users

After running the setup script, you'll have these users:

• Admin: admin / admin123
• Pentester: pentester1 / pentester123
• Client: client1 / client123

Configuration

Environment Variables

Key environment variables in .env:

SECRET_KEY=your-secret-key-here
DEBUG=True
DATABASE_URL=sqlite:///db.sqlite3
REDIS_URL=redis://localhost:6379
EMAIL_BACKEND=django.core.mail.backends.console.EmailBackend
ALLOWED_HOSTS=localhost,127.0.0.1

Scanning Tools Setup

For automated vulnerability scanning, install these tools:

# Ubuntu/Debian
sudo apt-get update
sudo apt-get install nmap nikto

# OWASP ZAP
# Download and run ZAP with API enabled on localhost:8080

Production Deployment

For production deployment:

1. Set environment variables:

   • DEBUG=False
   • SECRET_KEY=<strong-secret-key>
   • DATABASE_URL=<postgresql-url>
   • ALLOWED_HOSTS=<your-domain>

2. Use PostgreSQL:

pip install psycopg2-binary

3. Configure web server (Nginx + Gunicorn recommended)

4. Set up SSL/TLS for HTTPS

5. Configure Redis for production

API Documentation

The platform includes a REST API for integration:

• Base URL: /api/
• Authentication: Token-based
• Endpoints:
  • /api/projects/ - Project management
  • /api/vulnerabilities/ - Vulnerability data
  • /api/reports/ - Report generation
  • /api/users/ - User management

Security Considerations

• File Encryption: All uploaded files are encrypted at rest
• Audit Logging: Comprehensive logging of all user actions
• Access Control: Strict role-based permissions
• Session Security: Secure session management
• Input Validation: Protection against common attacks
• MFA Support: Two-factor authentication available

Contributing

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Add tests if applicable
5. Submit a pull request

License

This project is licensed under the MIT License - see the LICENSE file for details.

Support

For support and questions:

• Create an issue in the repository
• Check the documentation
• Review the code comments

Roadmap

• SAML/SSO integration
• Mobile application
• Advanced compliance frameworks
• Machine learning for vulnerability prioritization
• Integration with more scanning tools
• Advanced reporting features
• API rate limiting
• Kubernetes deployment configs

---

Note: This is a professional penetration testing management platform. Ensure proper security measures are in place when deploying to production environments.