القائمة
PTES Phase 6 - Reporting for AWS security assessments
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Security audit for AI agent endpoints (Claude Desktop/Code, MCP servers, plugins, extensions)
Active Directory penetration testing skills covering reconnaissance, attacks, lateral movement, persistence, and ADCS exploitation
PTES Phase 5 - Exploitation for AWS security assessments using WorstAssume attack chain detection
PTES Phase 2 - Intelligence gathering for AWS security assessments
Network reconnaissance and port scanning using Naabu, hping3, and complementary tools
Pentest especializado para Palo Alto Networks PAN-OS — cobre CVE-2026-0300 (buffer overflow RCE), User-ID Auth Portal, e superfície de ataque completa
| name | pentest-reporting |
| description | PTES Phase 6 - Reporting for AWS security assessments |
| type | skill |
DETECTION: Se o alvo for pfSense, ative a skill
pentest-pfsensepara metodologia completa.
Server: pfsense, X-Powered-By: pfSense/firewall_rules.php, /system.php, /diag_logs.phphttp.title:"pfSense", http.favicon.hash:-1295592153http.title script returns "pfSense"→ Activate pentest-pfsense skill for:
IMPORTANTE: Se pfSense foi testado durante o engagement, use a skill
pentest-pfsensecomo referência para findings específicos.
- CVE-2022-40624: pfBlockerNG Host Header RCE (CVSS 9.8)
- CVE-2022-31814: pfBlockerNG Path Traversal RCE (CVSS 9.8)
- CVE-2025-12490: Suricata Path Traversal → RCE (CVSS 8.8)
- CVE-2023-42326: Command Injection (GIF/GRE interfaces) (CVSS 8.8)
- CVE-2023-48123: Packet Capture RCE (CVSS 8.8)
- CVE-2023-27253: RRD Restore Command Injection (CVSS 8.8)
- CVE-2023-48795: Terrapin SSH Attack (CVSS 5.9, EPSS 99º)
- CVE-2025-34172: HAProxy XSS + Socket Injection (CVSS 6.1)
- CVE-2025-34175: Suricata Reflected XSS (CVSS 6.1)
- CVE-2025-53392: Arbitrary File Read (CVSS 6.5)
- CVE-2022-29273: Stored XSS via URL Alias (CVSS 6.1)
- CVE-2024-57273: OpenVPN DoS (CVSS 5.3)
- CVE-2025-34174: Status Traffic Totals XSS (CVSS 5.4)
pfSense-Specific Recommendations:
1. UPGRADE IMEDIATO
- pfSense CE: 2.7.x → 2.8.0+
- pfSense Plus: 23.09 → 24.03+
- Packages: pfBlockerNG, Suricata, Snort (latest)
2. MITIGAÇÕES TEMPORÁRIAS
- System Patches package (Netgate recomendado)
- Desabilitar serviços não essenciais
- Restringir acesso à webGUI por IP
- Remover privilégios de diagnóstico
3. MONITORAMENTO
- Alertas de login falho
- Log de alterações de config
- Detecção de comandos suspeitos
pfSense Findings → Frameworks:
| Finding | MITRE ATT&CK | CIS Control | NIST |
|---------|--------------|-------------|------|
| RCE via diag_command.php | T1190 (Exploit Public-Facing App) | 7.1 (Vuln Mgmt) | SI-2 |
| Default credentials | T1078 (Valid Accounts) | 5.2 (Account Mgmt) | IA-2 |
| Config file access | T1003 (Credential Dumping) | 3.5 (Access Control) | AC-3 |
| HA sync abuse | T1563 (Service Session Hijack) | 4.4 (Comm Protection) | SC-23 |
Documentar detalhadamente todos os achados, riscos associados, evidências e recomendações de correção para o cliente.
NOTE: Nettacker supports 5 output formats for different stakeholders and integrations.
# HTML Report (with graphs) - For executives and non-technical stakeholders
docker run --rm -v $(pwd):/tmp owasp/nettacker \
-i TARGET -m port_scan,vuln \
--graph-output /tmp/nettacker_report.html
# JSON - For programmatic processing and SIEM integration
docker run --rm -v $(pwd):/tmp owasp/nettacker \
-i TARGET -m port_scan,vuln \
--json-output /tmp/nettacker_report.json
# CSV - For spreadsheet analysis and filtering
docker run --rm -v $(pwd):/tmp owasp/nettacker \
-i TARGET -m port_scan,vuln \
--csv-output /tmp/nettacker_report.csv
# SARIF - For GitHub Security tab and code scanning tools
docker run --rm -v $(pwd):/tmp owasp/nettacker \
-i TARGET -m port_scan,vuln \
--sarif-output /tmp/nettacker_report.sarif
# DefectDojo (.dd.json) - For DefectDojo vulnerability management platform
docker run --rm -v $(pwd):/tmp owasp/nettacker \
-i TARGET -m port_scan,vuln \
--dd-output /tmp/nettacker_report.dd.json
| Format | Best For | Stakeholder | Integration |
|---|---|---|---|
| HTML | Executive presentations, visual reports | Management, Clients | Standalone |
| JSON | SIEM, automation, custom processing | Security Engineers | Splunk, ELK |
| CSV | Spreadsheet analysis, filtering | Analysts | Excel, Google Sheets |
| SARIF | GitHub Security, DevOps pipelines | Developers | GitHub, Azure DevOps |
| DefectDojo | Vulnerability management | Security Teams | DefectDojo |
# Step 1: Nettacker external scan
docker run --rm -v $(pwd):/tmp owasp/nettacker \
-i TARGET.com -m port_scan,vuln,ssl_*_vuln \
--json-output /tmp/nettacker_external.json \
--graph-output /tmp/nettacker_external.html
# Step 2: WorstAssume AWS enumeration
worst enumerate --profile <profile> --output json > /tmp/worstassume_aws.json
# Step 3: Consolidate findings
jq -s '{
nettacker: .[0],
worstassume: .[1],
generated_at: now
}' /tmp/nettacker_external.json /tmp/worstassume_aws.json \
> /tmp/consolidated_findings.json
# Step 4: Generate executive summary
jq -r '.nettacker.results[] | "Finding: \(.title)\nSeverity: \(.severity)\nTarget: \(.target)"' \
/tmp/nettacker_external.json > /tmp/executive_summary.txt
# Exportar findings em JSON estruturado
worst privesc --from <arn> --output json > attack-paths.json
# Exportar grafo completo para análise
worst graph-export --output graph.json
# Dashboard web para visualização
worst viz --port 3000
# Acessar http://localhost:3000 e usar Export
# Listar todas as cadeias de ataque detectadas
worst privesc --db findings.db --all
# Filtrar por severidade mínima
worst privesc --db findings.db --min-severity HIGH
# Exportar por família de ataque
worst privesc --db findings.db --family "IAM Self-Modification" --output family-iam.json
worst privesc --db findings.db --family "PassRole+Compute" --output family-passrole.json
worst privesc --db findings.db --family "Compute Credential Theft" --output family-compute.json
worst privesc --db findings.db --family "Secret Exfiltration" --output family-secret.json
worst privesc --db findings.db --family "Account Takeover" --output family-account.json
worst privesc --db findings.db --family "Group Membership" --output family-group.json
worst privesc --db findings.db --family "Cross-Account Lateral Movement" --output family-crossaccount.json
# Exportar todos os PATH-IDs descobertos
worst privesc --db findings.db --output all-paths.json --include-all
{
"finding_id": "FINDING-001",
"path_id": "PATH-001",
"category": "WEAK_TRUST",
"subcategory": "WildcardTrustNoCondition",
"severity": "CRITICAL",
"original_severity": "CRITICAL",
"downgrade_reason": null,
"principal_arn": "arn:aws:iam::123456789012:role/ExampleRole",
"principal_type": "ROLE",
"account_id": "123456789012",
"region": "us-east-1",
"trust_policy": {
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": "*",
"Action": "sts:AssumeRole"
}]
},
"permissions": ["iam:*", "ec2:*", "s3:*"],
"managed_policies": ["arn:aws:iam::aws:policy/AdministratorAccess"],
"inline_policies": ["FullAccess"],
"groups": ["Admins"],
"risk_factors": {
"has_wildcard_trust": true,
"has_external_account_trust": false,
"has_dangerous_managed_policy": true,
"has_resource_wildcard": true,
"missing_condition_keys": true
},
"attack_chain": {
"family": "IAM Self-Modification",
"chain_id": "CreatePolicy+Attach",
"hops": 2,
"outcome": "Self Admin Escalation"
},
"evidence": {
"command": "aws iam get-role --role-name ExampleRole",
"output": "{...}"
},
"recommendation": "Remove wildcard principal from trust policy. Add condition keys: aws:PrincipalArn, aws:SourceAccount",
"remediation_effort": "LOW",
"cvss_score": 9.8,
"created_at": "2026-04-24T10:30:00Z"
}
# Exportar todos os findings CRITICAL
sqlite3 findings.db "SELECT * FROM SecurityFinding WHERE severity='CRITICAL';"
# Count por categoria
sqlite3 findings.db "SELECT category, COUNT(*) as count FROM SecurityFinding GROUP BY category;"
# Count por severidade
sqlite3 findings.db "SELECT severity, COUNT(*) as count FROM SecurityFinding GROUP BY severity ORDER BY severity;"
# Findings com AdministratorAccess
sqlite3 findings.db "SELECT principal_arn, path_id FROM SecurityFinding WHERE managed_policies LIKE '%AdministratorAccess%';"
# Exportar em formato JSON
sqlite3 findings.db ".mode json" ".output findings.json" "SELECT * FROM SecurityFinding;"
# Iniciar dashboard
worst viz --db findings.db --port 3000
# No browser (http://localhost:3000):
# 1. Filtrar por severidade (dropdown)
# 2. Filtrar por categoria (dropdown)
# 3. Click em "Export JSON" ou "Export CSV"
# 4. Download do arquivo formatado
-- Tabela principal: SecurityFinding
CREATE TABLE SecurityFinding (
id INTEGER PRIMARY KEY AUTOINCREMENT,
finding_id TEXT UNIQUE NOT NULL, -- FINDING-0001
path_id TEXT NOT NULL, -- PATH-001
category TEXT NOT NULL, -- WEAK_TRUST, PERMISSIVE_POLICY, etc.
subcategory TEXT NOT NULL, -- WildcardTrustNoCondition, etc.
severity TEXT NOT NULL, -- CRITICAL, HIGH, MEDIUM, LOW, INFO
original_severity TEXT NOT NULL, -- Severidade antes do downgrade
downgrade_reason TEXT, -- Motivo do downgrade se aplicável
principal_arn TEXT NOT NULL, -- ARN do principal afetado
principal_type TEXT NOT NULL, -- USER, ROLE, GROUP, ROOT
account_id TEXT NOT NULL, -- 123456789012
region TEXT, -- us-east-1, etc.
trust_policy TEXT, -- JSON do trust policy
permissions TEXT, -- JSON array de permissões
managed_policies TEXT, -- JSON array de managed policies
inline_policies TEXT, -- JSON array de inline policies
groups TEXT, -- JSON array de grupos
risk_factors TEXT, -- JSON com fatores de risco
attack_chain TEXT, -- JSON da attack chain
evidence TEXT, -- JSON com evidências
recommendation TEXT, -- Texto da recomendação
remediation_effort TEXT, -- LOW, MEDIUM, HIGH
cvss_score REAL, -- 0.0-10.0
created_at DATETIME DEFAULT CURRENT_TIMESTAMP
);
-- Índices para performance
CREATE INDEX idx_severity ON SecurityFinding(severity);
CREATE INDEX idx_category ON SecurityFinding(category);
CREATE INDEX idx_account ON SecurityFinding(account_id);
CREATE INDEX idx_principal ON SecurityFinding(principal_arn);
# Passo 1: Exportar todos os findings
sqlite3 findings.db ".mode json" ".output all-findings.json" "SELECT * FROM SecurityFinding ORDER BY severity, category;"
# Passo 2: Exportar apenas CRITICAL + HIGH
sqlite3 findings.db ".mode json" ".output critical-high.json" "SELECT * FROM SecurityFinding WHERE severity IN ('CRITICAL', 'HIGH') ORDER BY severity DESC;"
# Passo 3: Gerar resumo estatístico
sqlite3 findings.db <<EOF
.mode column
.headers on
.output summary.txt
SELECT
severity,
COUNT(*) as total,
COUNT(DISTINCT account_id) as accounts_affected,
COUNT(DISTINCT category) as categories
FROM SecurityFinding
GROUP BY severity
ORDER BY
CASE severity
WHEN 'CRITICAL' THEN 1
WHEN 'HIGH' THEN 2
WHEN 'MEDIUM' THEN 3
WHEN 'LOW' THEN 4
WHEN 'INFO' THEN 5
END;
EOF
# Passo 4: Exportar por categoria para análise separada
for category in WEAK_TRUST PERMISSIVE_POLICY RESOURCE_WILDCARD USER_CONFIG GROUP_CONFIG; do
sqlite3 findings.db ".mode json" ".output category-${category}.json" "SELECT * FROM SecurityFinding WHERE category='${category}';"
done
# Passo 5: Gerar CSV para tracking em planilhas
sqlite3 findings.db <<EOF
.mode csv
.headers on
.output findings.csv
SELECT
finding_id,
severity,
category,
subcategory,
principal_arn,
recommendation
FROM SecurityFinding
ORDER BY severity, finding_id;
EOF
# FINDING-XXX: [Título do Finding]
## Metadados
- **Severity:** [CRITICAL/HIGH/MEDIUM/LOW/INFO]
- **Category:** [WEAK_TRUST/PERMISSIVE_POLICY/RESOURCE_WILDCARD/USER_CONFIG/GROUP_CONFIG]
- **Path-ID:** [PATH-XXX]
- **CVSS Score:** [X.X]
- **Affected Principal:** `arn:aws:iam::ACCOUNT:resource/name`
- **Account:** [123456789012]
- **Region:** [us-east-1]
## Descrição
[Descrição técnica detalhada do finding, explicando a vulnerabilidade
e como foi descoberta através do WorstAssume.]
## Evidência
```json
{
"principal_arn": "arn:aws:iam::123456789012:role/ExampleRole",
"trust_policy": {...},
"permissions": ["iam:*", "ec2:*", "s3:*"],
"managed_policies": ["arn:aws:iam::aws:policy/AdministratorAccess"]
}
[Identidade Inicial]
│
│ [Ação 1: iam:CreatePolicy]
▼
[Recurso Intermediário]
│
│ [Ação 2: iam:AttachUserPolicy]
▼
[Objetivo Final - Admin Access]
[Descrição do impacto se explorado, incluindo:
[Passos específicos para remediar, incluindo comandos AWS CLI exatos.]
aws iam [comando específico]
{
"Version": "2012-10-17",
"Statement": [...]
}
### 9. Validação de Qualidade do Export
```bash
# Verificar count total de findings
TOTAL=$(sqlite3 findings.db "SELECT COUNT(*) FROM SecurityFinding;")
echo "Total findings: $TOTAL"
# Verificar distribuição por severidade
sqlite3 findings.db "SELECT severity, COUNT(*) FROM SecurityFinding GROUP BY severity;"
# Verificar findings sem recomendação (erro de qualidade)
sqlite3 findings.db "SELECT finding_id FROM SecurityFinding WHERE recommendation IS NULL OR recommendation = '';"
# Verificar findings sem evidence (erro de qualidade)
sqlite3 findings.db "SELECT finding_id FROM SecurityFinding WHERE evidence IS NULL OR evidence = '{}';"
# Validar JSON exports
for f in *.json; do
jq empty "$f" && echo "$f: OK" || echo "$f: INVALID JSON"
done
RESUMO EXECUTIVO
ENGAGEMENT: [Nome do Projeto]
PERÍODO: [Data início] - [Data fim]
CLASSIFICAÇÃO: [Confidencial]
VISÃO GERAL:
[Parágrafo descrevendo o escopo e objetivos do teste]
SUMÁRIO DE RISCOS:
┌─────────────┬───────┬────────────┐
│ Severidade │ Count │ Trend │
├─────────────┼───────┼────────────┤
│ CRITICAL │ X │ [↑↓→] │
│ HIGH │ X │ [↑↓→] │
│ MEDIUM │ X │ [↑↓→] │
│ LOW │ X │ [↑↓→] │
│ INFO │ X │ [↑↓→] │
└─────────────┴───────┴────────────┘
PRINCIPAIS ACHADOS:
1. [Finding crítico #1 - 1 linha]
2. [Finding crítico #2 - 1 linha]
3. [Finding crítico #3 - 1 linha]
RISCO GERAL: [CRITICAL / HIGH / MEDIUM / LOW]
RECOMENDAÇÕES PRIORITÁRIAS:
1. [Recomendação crítica #1]
2. [Recomendação crítica #2]
3. [Recomendação crítica #3]
ESCOPO E METODOLOGIA
CONTAS AWS TESTADAS:
- Account ID: [123456789012] - [Nome/Nome do ambiente]
- Account ID: [234567890123] - [Nome/Nome do ambiente]
- Total: [X] contas
REGIÕES TESTADAS:
- [us-east-1, us-west-2, eu-west-1, ...]
SERVIÇOS TESTADOS:
- IAM (Identity and Access Management)
- EC2 (Elastic Compute Cloud)
- S3 (Simple Storage Service)
- Lambda (Serverless Computing)
- ECS (Elastic Container Service)
- [Outros serviços...]
METODOLOGIA:
Este assessment seguiu o PTES (Penetration Testing Execution Standard)
com as seguintes fases:
1. Pre-Engagement Interactions
2. Intelligence Gathering
3. Threat Modeling
4. Vulnerability Analysis
5. Exploitation
6. Post-Exploitation
7. Reporting
FERRAMENTAS UTILIZADAS:
- WorstAssume v[X.X.X] - AWS IAM enumeration and attack graph analysis
- AWS CLI v[X.X.X] - Manual verification and exploitation
- [Outras ferramentas...]
TIPO DE TESTE:
[ ] Black Box
[ ] Grey Box
[✓] White Box
LIMITAÇÕES:
- [Serviços não testados]
- [Restrições de tempo]
- [Restrições de acesso]
FINDINGS DETALHADOS
═══════════════════════════════════════════════════════════════════════════
FINDING #1: [Título do Finding]
═══════════════════════════════════════════════════════════════════════════
SEVERIDADE: [CRITICAL / HIGH / MEDIUM / LOW / INFO]
CATEGORIA: [WEAK_TRUST / PERMISSIVE_POLICY / RESOURCE_WILDCARD / etc.]
PATH-ID: [PATH-XXX]
CVSS SCORE: [X.X] (opcional)
AFETADOS:
- Tipo: [IAM User / IAM Role / EC2 Instance / etc.]
- ARN: arn:aws:iam::ACCOUNT:resource/name
- Conta: [123456789012]
- Região: [us-east-1]
DESCRIÇÃO:
[Descrição detalhada da vulnerabilidade em 2-3 parágrafos. Explicar o que
foi encontrado, por que é um problema, e como foi descoberto.]
IMPACTO:
[Descrição do impacto potencial se esta vulnerabilidade for explorada.
Incluir cenários de pior caso e dados que podem ser comprometidos.]
PROVA DE CONCEITO:
# Comandos executados durante o teste
aws [comando 1]
aws [comando 2]
# Output observado
{
"evidence": "output aqui"
}
ATTACK PATH:
[A] Identidade Inicial (arn:aws:iam::...)
│
│ iam:CreatePolicyVersion
▼
[B] Policy Version Criada
│
│ iam:AttachUserPolicy
▼
[C] Admin Access Obtido
RECOMENDAÇÃO:
[Passos específicos para remediar esta vulnerabilidade. Ser o mais
específico possível, incluindo comandos ou configurações exatas.]
REMEDIATION EXAMPLE:
# Exemplo de comando para corrigir
aws iam [comando de correção]
# Exemplo de policy corrigida
{
"Version": "2012-10-17",
"Statement": [...]
}
PRIORIDADE: [IMEDIATA / ALTA / MÉDIA / BAIXA]
ESFORÇO ESTIMADO: [X horas/dias]
DIFFICULDADE: [Fácil / Média / Difícil]
REFERÊNCIAS:
- AWS IAM Best Practices: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html
- AWS Security Best Practices: https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-best-practices.html
- [Outras referências relevantes]
ATTACK PATHS DESCOBERTOS
PATH #1: [Nome do Attack Path]
─────────────────────────────────
SEVERIDADE: CRITICAL
HOPS: [X]
DE → PARA: [Identidade inicial] → [Objetivo final]
SEQUÊNCIA DE AÇÕES:
┌────┬─────────────────────────────────┬──────────────────────────────────┐
│ # │ Ação │ Explicação │
├────┼─────────────────────────────────┼──────────────────────────────────┤
│ 1 │ iam:CreatePolicyVersion │ Criar versão admin da policy │
│ 2 │ iam:AttachUserPolicy │ Attach policy ao próprio user │
│ 3 │ sts:GetCallerIdentity │ Verificar permissões elevadas │
└────┴─────────────────────────────────┴──────────────────────────────────┘
TEMPO ESTIMADO DE EXPLORAÇÃO: [X minutos/horas]
DETECÇÃO: [Baixa / Média / Alta]
MITIGAÇÃO: [Resumo da mitigação]
[Incluir diagrama visual se possível]
MATRIZ DE RISCOS
IMPACTO
Baixo Médio Alto Crítico
PROB. Alta [M] [H] [C] [C]
Média [L] [M] [H] [C]
Baixa [L] [L] [M] [H]
FINDINGS NA MATRIZ:
┌─────────────────────────────────────┬────────────┬───────────┬───────────┐
│ Finding │ Probabilidade │ Impacto │ Risco │
├─────────────────────────────────────┼────────────┼───────────┼───────────┤
│ Wildcard Trust Policy │ Alta │ Crítico │ CRITICAL │
│ IAM Admin via Policy Version │ Média │ Crítico │ CRITICAL │
│ Cross-Account Lateral Movement │ Média │ Alto │ HIGH │
│ IMDSv1 Credential Theft │ Alta │ Médio │ HIGH │
│ Stale Access Keys │ Baixa │ Médio │ MEDIUM │
└─────────────────────────────────────┴────────────┴───────────┴───────────┘
APÊNDICES
APÊNDICE A: COMANDOS EXECUTADOS
[Lista completa de todos os comandos AWS CLI executados]
APÊNDICE B: EVIDÊNCIAS
[Screenshots, outputs, logs de todas as explorações]
APÊNDICE C: GLOSSÁRIO
[Definições de termos técnicos usados no relatório]
APÊNDICE D: REFERÊNCIAS
[Lista completa de referências e documentação AWS]
APÊNDICE E: HISTÓRICO DE MUDANÇAS
┌────────────┬───────────────┬────────────────────────────────────────────┐
│ Versão │ Data │ Mudanças │
├────────────┼───────────────┼────────────────────────────────────────────┤
│ 1.0 │ YYYY-MM-DD │ Versão inicial do relatório │
│ 1.1 │ YYYY-MM-DD │ Adicionado finding #X, atualizado finding #Y│
└────────────┴───────────────┴────────────────────────────────────────────┘
# Generate HTML report with graphs
docker run --rm -v $(pwd):/reports owasp/nettacker \
-i TARGET.com -m port_scan,vuln,ssl_*_vuln \
--graph-output /reports/executive_report.html
# Open in browser for presentation
firefox /reports/executive_report.html
HTML Report Sections:
# Generate JSON for Splunk/ELK
docker run --rm -v $(pwd):/reports owasp/nettacker \
-i TARGET.com -m port_scan,vuln \
--json-output /reports/siem_export.json
# Parse for specific findings
jq '.results[] | select(.severity == "CRITICAL")' /reports/siem_export.json
# Convert to ECS format for Elasticsearch
jq '.results[] | {
"@timestamp": .date,
"host": {"ip": .target},
"vulnerability": {
"cve": .cve_id,
"severity": .severity,
"description": .description
}
}' /reports/siem_export.json > /reports/ecs_format.json
# Generate CSV for Excel/Google Sheets
docker run --rm -v $(pwd):/reports owasp/nettacker \
-i TARGET.com -m port_scan,vuln \
--csv-output /reports/findings.csv
# Filter in Excel/Sheets:
# - Sort by severity
# - Filter by target
# - Pivot by vulnerability type
CSV Columns:
Target,Port,Vulnerability,Severity,CVSS,Description,Remediation,Date
# Generate SARIF for GitHub Security tab
docker run --rm -v $(pwd):/reports owasp/nettacker \
-i TARGET.com -m vuln \
--sarif-output /reports/github_security.sarif
# Upload to GitHub
gh api \
--method POST \
/repos/OWNER/REPO/code-scanning/sarifs \
-f commit_sha=$(git rev-parse HEAD) \
-f ref=refs/heads/main \
-f sarif=$(base64 -i /reports/github_security.sarif)
# Generate DefectDojo format
docker run --rm -v $(pwd):/reports owasp/nettacker \
-i TARGET.com -m port_scan,vuln \
--dd-output /reports/defectdojo.json
# Upload to DefectDojo via API
curl -X POST "https://defectdojo.local/api/v2/import-scan/" \
-H "Authorization: Token $DD_API_KEY" \
-F "file=@/reports/defectdojo.json" \
-F "engagement=$ENGAGEMENT_ID" \
-F "scan_type=Nettacker Scan"
{
"reportMetadata": {
"engagementName": "AWS Security Assessment",
"client": "Client Name",
"dateRange": {
"start": "YYYY-MM-DD",
"end": "YYYY-MM-DD"
},
"reportVersion": "1.0",
"classification": "Confidential"
},
"executiveSummary": {
"totalFindings": 15,
"bySeverity": {
"CRITICAL": 3,
"HIGH": 5,
"MEDIUM": 4,
"LOW": 2,
"INFO": 1
},
"overallRisk": "HIGH"
},
"findings": [...],
"attackPaths": [...],
"scope": {...},
"methodology": {...}
}
FindingID,Severity,Category,Title,AffectedResource,Recommendation,Status
FINDING-001,CRITICAL,WEAK_TRUST,Wildcard Trust Policy,arn:aws:iam::123:role/X,Remove wildcard principal,Open
FINDING-002,HIGH,PERMISSIVE_POLICY,Admin Access,arn:aws:iam::123:user/Y,Remove admin policy,Open
SLIDE 1: Title Slide
- Project name, date, presenter
SLIDE 2: Executive Summary
- Overall risk rating
- Key findings (top 3-5)
SLIDE 3: Scope & Methodology
- What was tested
- How it was tested
SLIDE 4-8: Critical Findings
- One slide per critical finding
- Visual representation of attack path
SLIDE 9: Risk Matrix
- Visual risk matrix with findings plotted
SLIDE 10: Recommendations
- Prioritized remediation roadmap
SLIDE 11: Timeline
- Remediation timeline with milestones
SLIDE 12: Q&A
IMPACTO
Baixo Médio Alto Crítico
PROB. Alta [M] [H] [C] [C]
Média [L] [M] [H] [C]
Baixa [L] [L] [M] [H]
Finding Placement Example:
┌─────────────────────────────────────┬────────────┬───────────┬───────────┐
│ Finding │ Probabilidade │ Impacto │ Risco │
├─────────────────────────────────────┼────────────┼───────────┼───────────┤
│ Wildcard Trust Policy │ Alta │ Crítico │ CRITICAL │
│ SQL Injection │ Média │ Crítico │ CRITICAL │
│ Cross-Account Lateral Movement │ Média │ Alto │ HIGH │
│ Stored XSS │ Alta │ Médio │ HIGH │
│ Missing Security Headers │ Baixa │ Baixo │ LOW │
└─────────────────────────────────────┴────────────┴───────────┴───────────┘
Industry-Specific Considerations:
Healthcare (HIPAA):
- PHI exposure = Automatic HIGH/CRITICAL
- Patient safety impact = CRITICAL
Financial (PCI-DSS, SOX):
- Cardholder data = CRITICAL
- Financial fraud potential = CRITICAL
E-commerce:
- Customer PII = HIGH/CRITICAL
- Payment processing = CRITICAL
SaaS/Cloud:
- Multi-tenant data exposure = CRITICAL
- Authentication bypass = CRITICAL
# Via dashboard web (worst viz)
# Click em "Export" → Select format (HTML/JSON/CSV)
# JSON export via CLI
worst privesc --from <arn> --output json > paths.json
# Graph export
worst graph-export --output graph.json
# Capturar evidências em formato estruturado
aws sts get-caller-identity --output json > evidence-identity.json
aws iam get-role --role-name <role> --output json > evidence-role.json
# Capturar output de scans para evidência
hping3 -S -p 80 -c 10 target.com 2>&1 | tee evidence-syn-scan.txt
# Documentar firewall mapping
hping3 -A -p 80 target.com 2>&1 | tee evidence-ack-scan.txt
# Salvar resultados de port scanning
hping3 -S -p 1-1000 --scan target.com 2>&1 | tee evidence-port-scan.txt
# Gerar relatório de IDS evasion testing
{
echo "=== XMAS Scan Test ==="
hping3 -F -P -U -p 80 -c 10 target.com
echo ""
echo "=== NULL Scan Test ==="
hping3 -O -p 80 -c 10 target.com
echo ""
echo "=== Fragmented Packet Test ==="
hping3 -S -p 80 -f -c 10 target.com
} | tee evidence-ids-evasion.txt
# FINDING-NET-XXX: [Título do Finding de Rede]
## Metadados
- **Severity:** [CRITICAL/HIGH/MEDIUM/LOW/INFO]
- **Category:** NETWORK_VULNERABILITY
- **Tool:** hping3
- **CVSS Score:** [X.X]
- **Affected Host:** `target.com (IP)`
- **Portas/Services:** [lista]
## Descrição
[Descrição técnica da vulnerabilidade de rede identificada
através de scans com hping3.]
## Evidência (hping3 output)
HPING target.com (IP): S set, 40 headers + 0 data bytes <-- [output do hping3 capturado] -->
## Técnica Utilizada
- **Scan Type:** [SYN/ACK/XMAS/NULL/ICMP]
- **Flags:** [-S/-A/-FPU/-O/etc.]
- **Portas:** [range ou lista]
- **Evasion:** [fragmentation/spoofing/timing]
## Impacto
[Descrição do impacto se explorado, incluindo:
- Serviços expostos
- Possibilidade de lateral movement
- Risco de comprometimento de rede]
## Recomendação
[Passos específicos para remediar, incluindo:
- Configuração de firewall
- Regras de filtragem
- IDS/IPS tuning]
## Referências
- PTES 2.5.4 - Active Footprinting
- PTES 3.1.1 - Vulnerability Testing
- PTES 4.1.1 - Countermeasure Bypass
EXECUTIVE SUMMARY Structure:
1. Engagement Overview (1 paragraph)
2. Overall Risk Rating (CRITICAL/HIGH/MEDIUM/LOW)
3. Key Findings Summary (3-5 bullet points)
4. Strategic Recommendations (prioritized)
TECHNICAL REPORT Structure:
1. Scope and Methodology
2. Detailed Findings (per vulnerability)
3. Attack Paths Discovered
4. Risk Matrix
5. Remediation Roadmap
6. Appendices (evidence, commands, references)
Risk Assessment Framework:
Attack Vector (AV):
- Network (N): Vulnerability exploitable remotely
- Adjacent (A): Local network access required
- Local (L): Local access required
- Physical (P): Physical access required
Attack Complexity (AC):
- Low (L): No special conditions
- High (H): Specialized conditions required
Privileges Required (PR):
- None (N): No authentication needed
- Low (L): Basic user privileges
- High (H): Administrative privileges
User Interaction (UI):
- None (N): No user interaction
- Required (R): User action needed
Impact Metrics (C/I/A):
- None (N): No impact
- Low (L): Limited impact
- High (H): Complete loss
CVSS Score Calculation:
- 9.0-10.0: CRITICAL
- 7.0-8.9: HIGH
- 4.0-6.9: MEDIUM
- 0.1-3.9: LOW
CRITICAL Finding Template:
┌─────────────────────────────────────────────────────────────────┐
│ FINDING: [Title] │
│ SEVERITY: CRITICAL (CVSS: 9.X) │
│ │
│ DESCRIPTION: │
│ [Clear explanation of the vulnerability] │
│ │
│ BUSINESS IMPACT: │
│ - Complete system compromise │
│ - Full data breach potential │
│ - Regulatory implications (GDPR, HIPAA, PCI-DSS) │
│ │
│ IMMEDIATE ACTION REQUIRED: │
│ 1. [Specific remediation step] │
│ 2. [Specific remediation step] │
│ 3. [Specific remediation step] │
│ │
│ TIMELINE: Remediate within 24-48 hours │
└─────────────────────────────────────────────────────────────────┘
HIGH Finding Template:
┌─────────────────────────────────────────────────────────────────┐
│ FINDING: [Title] │
│ SEVERITY: HIGH (CVSS: 7.X-8.X) │
│ │
│ DESCRIPTION: │
│ [Clear explanation of the vulnerability] │
│ │
│ BUSINESS IMPACT: │
│ - Significant data exposure │
│ - Privilege escalation possible │
│ │
│ RECOMMENDED ACTION: │
│ 1. [Specific remediation step] │
│ 2. [Specific remediation step] │
│ │
│ TIMELINE: Remediate within 7 days │
└─────────────────────────────────────────────────────────────────┘
Day 0: Submit report to program
Day 1-3: Initial triage (expect confirmation)
Day 7-14: Validation by security team
Day 30-90: Fix development and testing
Day 90+: Public disclosure (if agreed)
DO:
✅ Be patient - security teams are often busy
✅ Be responsive - answer questions quickly
✅ Be collaborative - help validate fixes
✅ Be professional - maintain good relationships
✅ Follow program policies and scope
DON'T:
❌ Send constant status requests
❌ Share vulnerability publicly before fix
❌ Be rude or demanding
❌ Threaten to disclose
❌ Submit duplicate reports
Before Submitting:
□ Tested thoroughly
□ Clear reproduction steps
□ Proper security terminology
□ Remediation suggestions included
□ Professional tone
□ All relevant evidence attached
□ Checked for duplicates
□ Within scope
Report Structure:
□ Title: Clear and concise
□ Severity: Appropriate (CVSS if possible)
□ Description: What, where, how
□ Steps to Reproduce: Numbered, detailed
□ Impact: Business risk explained
□ Proof of Concept: Working payload
□ Remediation: Specific fix suggestions
TITLE: [Vulnerability Type] in [Component] Allows [Impact]
SEVERITY: [Critical/High/Medium/Low]
CVSS: [Score if applicable]
SUMMARY:
[2-3 sentence overview of the vulnerability]
DESCRIPTION:
[Detailed explanation of the vulnerability]
STEPS TO REPRODUCE:
1. Go to [URL/endpoint]
2. [Action]
3. [Action]
4. Observe: [Result]
PROOF OF CONCEPT:
[Payload, screenshot, or video]
IMPACT:
[Explain business risk - data breach, account takeover, etc.]
REMEDIATION:
[Specific fix suggestions]
REFERENCES:
- [Relevant CVEs]
- [OWASP links]
- [Vendor documentation]
HackerOne:
- Use H1 report template
- Include CVSS calculation
- Follow program-specific guidelines
Bugcrowd:
- Use Bugcrowd Vulnerability Rating Taxonomy
- Include priority score justification
- Follow VRT severity levels
Intigriti/YesWeHack:
- European programs - GDPR considerations
- Clear business impact explanation
Após completar esta fase, o penetration test está completo.
/pentest-network-scanning - Section 14: OWASP Nettacker Integration (Network Scanning)/pentest-vulnerability-analysis - Section 7: OWASP Nettacker Vulnerability Scanning (CVE Detection)/pentest-intelligence-gathering - Section 9: OWASP Nettacker for Intelligence Gathering (Recon)/pentest-pfsense - Section 4.28: OWASP Nettacker for pfSense (Specialized Scanning)NOTE: AIRecon can automate report generation, consolidate findings from multiple tools, and export in multiple formats.
# Generate consolidated pentest report from all findings
airecon "generate pentest report from nettacker and worstassume findings"
# Export findings in specific format
airecon "export vulnerability findings to JSON for SIEM integration"
# Create executive summary from technical findings
airecon "create executive summary from pentest findings for management"
# Generate DefectDojo compatible report
airecon "export findings to DefectDojo format for vulnerability management"
# Export API keys found during assessment for report
/ai airecon "/api-keys --export json > report-api-keys.json"
# Export webshell detection results for post-exploitation section
/ai airecon "/webshell-detect --export json > report-webshells.json"
# Generate wordlist usage statistics for methodology section
/ai airecon "/wordlist --stats --export markdown > report-wordlist-stats.md"
# Use hexstrike-local to create formatted vulnerability report
airecon "create vulnerability report using hexstrike-local create_vulnerability_report"
# Generate scan summary with visual formatting
airecon "create scan summary for target example.com with tools nmap,nuclei,nettacker"
# Export findings in SARIF format for GitHub Security
airecon "convert findings to SARIF format for GitHub Security integration"
# Step 1: Generate Nettacker report in JSON
docker run --rm -v $(pwd):/reports owasp/nettacker \
-i TARGET.com -m port_scan,vuln \
--json-output /reports/nettacker.json
# Step 2: Export WorstAssume findings
worst privesc --profile <profile> --output json > /reports/worstassume.json
# Step 3: Use AIRecon to consolidate and generate report
airecon "consolidate findings from /reports/nettacker.json and /reports/worstassume.json \
and generate executive report with technical appendix"
# AIRecon will:
# - Parse both JSON files
# - Deduplicate findings
# - Calculate CVSS scores
# - Generate risk matrix
# - Create attack path diagrams
# - Output: consolidated_report.html, consolidated_report.json, executive_summary.md
# Generate Executive Summary (PTES 6.1)
airecon "generate executive summary from findings for non-technical stakeholders"
# Generate Technical Report (PTES 6.2)
airecon "generate technical report with PoC, evidence, and remediation commands"
# Quantify Risk (PTES 6.3)
airecon "calculate risk matrix from findings using CVSS and business impact"
# Create Deliverable (PTES 6.4)
airecon "create final deliverable package with PDF, JSON, CSV, and SARIF exports"
| Keywords | Skills Loaded | MCP Tools |
|---|---|---|
report, relatório, executive summary | pentest-reporting.md | hexstrike-local, pentestswarm-remote |
export, JSON, CSV, SARIF, DefectDojo | pentest-reporting.md | hexstrike-local (create_file, format_tool_output_visual) |
CVSS, risk matrix, quantify | pentest-reporting.md, pentest-threat-modeling.md | cve-mcp (calculate_risk_score, compare_cves) |
nettacker, worstassume, consolidate | pentest-reporting.md | hexstrike-local, pentestswarm-remote |
presentation, stakeholders, slides | pentest-reporting.md | hexstrike-local (create_file for slide deck) |
# Validate report completeness
airecon "check if report has all required PTES Section 6 sections"
# Verify finding evidence is complete
airecon "validate all findings have evidence, PoC, and remediation steps"
# Check CVSS scoring consistency
airecon "verify CVSS scores are consistent across all findings"
# Generate compliance mapping
airecon "map findings to MITRE ATT&CK, CIS Controls, and NIST frameworks"
# If report generation fails, AIRecon will:
# 1. Log error with specific missing data
# 2. Retry with subset of findings
# 3. Generate partial report with warnings
# 4. Suggest manual data collection for missing items
# Example retry workflow
airecon "generate report --partial-ok --warn-missing-evidence"
Watchtower é um framework de penetration testing baseado em LangGraph com arquitetura multi-agente (Planner, Worker, Analyst) que inclui geração automática de relatórios PDF com findings consolidados.
# Gerar relatório PDF automático após scanning
python -m watchtower.main --report "pentest_report.pdf"
# Watchtower gera automaticamente:
# - Executive Summary
# - Vulnerability Summary by Severity
# - Risk Matrix
# - CVE Details (CVSS, EPSS, KEV, PoC)
# - Technical Findings with Evidence
# - Remediation Recommendations
# - Tool Output Appendices
# - References (NVD, OWASP, vendor advisories)
# Relatório a partir de findings existentes
python -m watchtower.main \
--input findings.json \
--report "consolidated_report.pdf"
# Generate full PDF report
/watchtower-report --output "pentest_report.pdf"
# Generate executive summary only
/watchtower-report --type executive --output "executive_summary.pdf"
# Generate technical report only
/watchtower-report --type technical --output "technical_report.pdf"
# Generate risk matrix
/watchtower-report --type risk-matrix --output "risk_matrix.pdf"
# Generate CVE-specific report
/watchtower-report --cve CVE-2021-44228 --output "cve_report.pdf"
┌─────────────────────────────────────────────────────────────┐
│ Watchtower PDF Report Structure │
├─────────────────────────────────────────────────────────────┤
│ 1. COVER PAGE │
│ - Engagement name, date, classification │
│ - Client name, assessor name │
│ │
│ 2. EXECUTIVE SUMMARY (PTES 6.1) │
│ - Engagement overview │
│ - Key findings summary │
│ - Risk overview (chart) │
│ - Strategic recommendations │
│ │
│ 3. VULNERABILITY SUMMARY (PTES 6.2) │
│ - Findings by severity (Critical, High, Medium, Low) │
│ - Risk matrix visualization │
│ - CVE cross-reference table │
│ │
│ 4. TECHNICAL FINDINGS (PTES 6.2) │
│ - Detailed finding descriptions │
│ - Evidence (screenshots, logs, PoC) │
│ - CVSS scoring breakdown │
│ - EPSS score and KEV status │
│ - Remediation steps │
│ │
│ 5. ATTACK PATHS (PTES 6.3) │
│ - Kill chain diagrams │
│ - Privilege escalation paths │
│ - Business impact analysis │
│ │
│ 6. REMEDIATION ROADMAP (PTES 6.4) │
│ - Prioritized recommendations │
│ - Effort vs. Impact matrix │
│ - Quick wins vs. long-term fixes │
│ │
│ 7. APPENDICES │
│ - Tool output logs │
│ - Full CVE details │
│ - References (NVD, OWASP, vendor) │
│ - Compliance mapping (MITRE ATT&CK, CIS, NIST) │
└─────────────────────────────────────────────────────────────┘
# PDF Report (primary format)
python -m watchtower.main --report "pentest_report.pdf"
# JSON Export (for SIEM integration)
python -m watchtower.main \
--output json \
-o findings.json
# CSV Export (for spreadsheet analysis)
python -m watchtower.main \
--output csv \
-o findings.csv
# SARIF Export (for DefectDojo/SIEM)
python -m watchtower.main \
--output sarif \
-o findings.sarif
# HTML Report (alternative to PDF)
python -m watchtower.main \
--output html \
-o report.html
# 1. AIRecon consolida findings de múltiplas ferramentas
airecon "consolidate findings from nettacker, worstassume, watchtower"
# 2. Watchtower gera relatório PDF
python -m watchtower.main --report "consolidated_report.pdf"
# 3. AIRecon gera formatos adicionais
airecon "export findings to JSON, CSV, SARIF"
# 4. AIRecon gera apresentação para stakeholders
airecon "generate stakeholder presentation slides"
# 1. Nettacker gera relatório HTML
docker run --rm -v $(pwd):/output owasp/nettacker \
-i target.com -m port_scan,*_vuln \
-o /output/nettacker.html --graph d3_tree_v2_graph
# 2. Watchtower consolida com outros findings
python -m watchtower.main \
--input nettacker.json \
--report "combined_report.pdf"
# 3. Watchtower Analyst adiciona:
# - CVE intelligence (EPSS, KEV, PoC)
# - Risk scoring
# - Remediation recommendations
# - Compliance mapping
# 1. WorstAssume exporta findings AWS
worst assess --min-severity HIGH --output json > worst_findings.json
# 2. Watchtower consolida findings
python -m watchtower.main \
--input worst_findings.json \
--report "aws_assessment_report.pdf"
# 3. Watchtower adiciona:
# - IAM attack chain diagrams
# - Privilege escalation paths
# - Cross-account risk analysis
# - AWS-specific remediation
# Watchtower gera risk matrix automaticamente
python -m watchtower.main --report "pentest_report.pdf"
# Risk Matrix inclui:
# - CVSS Base Score (0-10)
# - EPSS Score (exploit probability)
# - KEV Status (CISA Known Exploited)
# - PoC Availability (exploit maturity)
# - Business Impact (target context)
# Exemplo output:
┌─────────────────────────────────────────────────────────────┐
│ RISK MATRIX │
├──────────────┬──────────┬──────────┬──────────┬─────────────┤
│ Vulnerability│ CVSS │ EPSS │ KEV │ Risk Score │
├──────────────┼──────────┼──────────┼──────────┼─────────────┤
│ CVE-2026-4194│ 9.8 │ 0.95 │ YES │ 98/100 │
│ CVE-2021-4422│ 10.0 │ 0.98 │ YES │ 95/100 │
│ CVE-2023-4232│ 8.7 │ 0.45 │ NO │ 87/100 │
└──────────────┴──────────┴──────────┴──────────┴─────────────┘
# Watchtower usa cve-mcp para enriquecer relatórios:
# 1. CVE Summary
mcp__cve-mcp__get_cve_summary(cve_id="CVE-2021-44228")
# 2. EPSS Score
mcp__cve-mcp__get_epss_score(cve_ids="CVE-2021-44228")
# 3. KEV Check
mcp__cve-mcp__check_kev(cve_id="CVE-2021-44228")
# 4. Exploit Availability
mcp__cve-mcp__check_exploit_availability(cve_id="CVE-2021-44228")
# 5. Risk Score (composite)
mcp__cve-mcp__calculate_risk_score(cve_id="CVE-2021-44228")
# 6. Vendor Advisory
mcp__cve-mcp__get_vendor_advisory(cve_id="CVE-2021-44228")
# Watchtower mapeia findings automaticamente para:
# MITRE ATT&CK
mcp__cve-mcp__get_attack_mapping(cve_id="CVE-2021-44228")
# Returns: Techniques, TTPs, threat groups
# CIS Controls
# Auto-mapped based on vulnerability type:
# - Vuln Mgmt (7.1)
# - Access Control (3.5)
# - Account Mgmt (5.2)
# NIST SP 800-53
# Auto-mapped based on impact category:
# - SI-2 (Flaw Remediation)
# - IA-2 (Identification/Authentication)
# - AC-3 (Access Enforcement)
# Executive Summary Template (PTES 6.1)
python -m watchtower.main \
--template executive \
--report "executive_summary.pdf"
# Technical Report Template (PTES 6.2)
python -m watchtower.main \
--template technical \
--report "technical_report.pdf"
# Risk Assessment Template (PTES 6.3)
python -m watchtower.main \
--template risk-assessment \
--report "risk_assessment.pdf"
# Custom Template
python -m watchtower.main \
--template custom_template.json \
--report "custom_report.pdf"
# Se pfSense testado, Watchtower inclui automaticamente:
# 1. pfSense-specific findings
# - CVE-2023-42326 (Command Injection)
# - CVE-2025-53392 (File Read)
# - CVE-2022-40624 (pfBlockerNG RCE)
# 2. Version-specific CVEs
# - whatweb detecta versão
# - cve-mcp mapeia CVEs para versão
# 3. Remediation específica
# - Upgrade path (2.7.x → 2.8.0+)
# - Package updates
# - Configuration hardening
# 4. Compliance mapping
# - Firewall-specific controls
# - Network segmentation requirements
# Se cPanel testado, Watchtower inclui automaticamente:
# 1. CVE-2026-41940 findings
# - Authentication Bypass (CVSS 9.8)
# - Exploitation evidence
# - Patch verification status
# 2. Version-specific analysis
# - cPanel version detection
# - Patch level verification
# - Vulnerability confirmation
# 3. Remediation específica
# - Upgrade instructions
# - Patch application steps
# - Verification commands
1. AUTOMATIC EVIDENCE CAPTURE
- Screenshots de explorações bem-sucedidas
- Command output logs
- Session information
- Credential dumps (sanitized)
2. CVE INTELLIGENCE ENRICHMENT
- CVSS scores (v2, v3, v4)
- EPSS scores (exploit probability)
- KEV status (CISA Known Exploited)
- PoC availability (Exploit-DB, GitHub)
- Vendor advisories
3. RISK PRIORITIZATION
- Composite risk scoring
- Business impact analysis
- Exploitability assessment
- Remediation effort estimation
4. COMPLIANCE MAPPING
- MITRE ATT&CK techniques
- CIS Controls mapping
- NIST SP 800-53 controls
- ISO 27001 controls
- PCI DSS requirements
5. VISUAL ELEMENTS
- Risk matrix charts
- Attack path diagrams
- Severity distribution graphs
- Timeline visualizations
┌─────────────────────────────────────────────────────────────┐
│ Watchtower Report Generation Workflow │
└─────────────────────────────────────────────────────────────┘
│
┌─────────────────────┼─────────────────────┐
│ │ │
▼ ▼ ▼
┌───────────────┐ ┌─────────────────┐ ┌───────────────┐
│ Data Input │ │ Report Gen │ │ Output │
│ │ │ │ │ │
│ - findings │ │ - PDF generation│ │ - PDF report │
│ - tool output │ │ - Charts/graphs │ │ - JSON export │
│ - evidence │ │ - Compliance map│ │ - CSV export │
└───────────────┘ └─────────────────┘ └───────────────┘
# Custom report sections
python -m watchtower.main \
--sections executive,technical,risk-matrix \
--report "custom_report.pdf"
# Add/remove sections
python -m watchtower.main \
--exclude-sections tool-output \
--report "concise_report.pdf"
# Custom branding
python -m watchtower.main \
--branding company_logo.png \
--report "branded_report.pdf"
# Multi-language support
python -m watchtower.main \
--language pt-BR \
--report "relatorio_pt.pdf"
# Watchtower valida relatório antes de gerar:
# 1. Check findings completeness
if not findings:
raise ValueError("No findings to report")
# 2. Check evidence availability
for finding in findings:
if not finding.evidence:
warn("Missing evidence for finding")
# 3. Check CVSS consistency
validate_cvss_scores(findings)
# 4. Generate report only if validation passes
generate_pdf_report(findings, evidence, metadata)
# 1. PentestSwarm campaign findings
airecon "get campaign findings campaign_abc123"
# 2. Watchtower consolida findings
python -m watchtower.main \
--input campaign_findings.json \
--report "pentestswarm_report.pdf"
# 3. Watchtower adiciona:
# - Campaign summary
# - Tool execution timeline
# - Success/failure analysis
# - Recommendations
# Relatórios salvos automaticamente em:
~/.watchtower/reports/
# Estrutura de diretórios:
~/.watchtower/reports/
├── 2026-05-03_target_com/
│ ├── pentest_report.pdf
│ ├── findings.json
│ ├── findings.csv
│ └── evidence/
│ ├── screenshots/
│ ├── logs/
│ └── poc_scripts/
| Fase PTES | Técnica hping3 | Finding Category | Severidade Típica |
|---|---|---|---|
| 2.5.4 Intelligence Gathering | Host Discovery, Port Scan | RECONNAISSANCE | INFO |
| 2.5.4 Intelligence Gathering | Firewall Mapping | NETWORK_RECON | INFO |
| 3.1.1 Vulnerability Analysis | Stateless Firewall Detection | NETWORK_VULNERABILITY | MEDIUM/HIGH |
| 3.1.2 Vulnerability Analysis | IDS/IPS Detection Testing | DETECTION_TESTING | LOW |
| 4.1.1 Exploitation | ACK Scan Bypass | NETWORK_EXPLOITATION | HIGH |
| 4.1.1 Exploitation | Fragmentation Bypass | NETWORK_EXPLOITATION | HIGH |
| 4.1.1 Exploitation | XMAS/NULL Scan Evasion | NETWORK_EXPLOITATION | MEDIUM |
| 5.1.4 Post-Exploitation | Internal Pivoting | LATERAL_MOVEMENT | HIGH |
| 5.1.4 Post-Exploitation | Covert Channel (ICMP) | DATA_EXFILTRATION | HIGH |
CRITICAL Findings:
- Firewall stateless detection: hping3 -A -p <port> target
- Internal database exposure: hping3 -S -p 3306,5432,1433 --scan internal-ip
HIGH Findings:
- Port scanning results: hping3 -S -p 1-1000 --scan target
- Fragmentation bypass: hping3 -S -p <port> -f target
- ICMP tunneling: hping3 -1 -d 1024 target
MEDIUM Findings:
- IDS evasion testing: hping3 -F -P -U -p <port> target
- TTL-based filtering gaps: hping3 -S -p <port> -t <ttl> target
LOW/INFO Findings:
- Host discovery: hping3 -S -p 80 --scan subnet
- OS fingerprinting: hping3 -S -p 80 -t 64,128 target
NETWORK SECURITY ASSESSMENT - HPING3 STATISTICS
Total Hosts Scanned: [X]
Total Ports Tested: [Y]
Findings by Category:
┌─────────────────────────────┬───────┬─────────────┐
│ Category │ Count │ Severity │
├─────────────────────────────┼───────┼─────────────┤
│ Firewall Misconfiguration │ X │ HIGH │
│ Stateless Firewall │ X │ HIGH │
│ IDS Evasion Successful │ X │ MEDIUM │
│ Open Ports (Internal) │ X │ MEDIUM │
│ ICMP Information Leak │ X │ LOW │
└─────────────────────────────┴───────┴─────────────┘
Techniques Tested:
[✓] SYN Scan
[✓] ACK Scan
[✓] XMAS Scan
[✓] NULL Scan
[✓] Fragmentation
[✓] Source Spoofing
[✓] ICMP Tunneling
[✓] TTL Analysis