메뉴
PTES Phase 6 - Reporting for AWS security assessments
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Security audit for AI agent endpoints (Claude Desktop/Code, MCP servers, plugins, extensions)
Active Directory penetration testing skills covering reconnaissance, attacks, lateral movement, persistence, and ADCS exploitation
PTES Phase 5 - Exploitation for AWS security assessments using WorstAssume attack chain detection
PTES Phase 2 - Intelligence gathering for AWS security assessments
Network reconnaissance and port scanning using Naabu, hping3, and complementary tools
Pentest especializado para Palo Alto Networks PAN-OS — cobre CVE-2026-0300 (buffer overflow RCE), User-ID Auth Portal, e superfície de ataque completa
| name | pentest-reporting |
| description | PTES Phase 6 - Reporting for AWS security assessments |
| type | skill |
DETECTION: Se o alvo for pfSense, ative a skill
pentest-pfsensepara metodologia completa.
Server: pfsense, X-Powered-By: pfSense/firewall_rules.php, /system.php, /diag_logs.phphttp.title:"pfSense", http.favicon.hash:-1295592153http.title script returns "pfSense"→ Activate pentest-pfsense skill for:
IMPORTANTE: Se pfSense foi testado durante o engagement, use a skill
pentest-pfsensecomo referência para findings específicos.
- CVE-2022-40624: pfBlockerNG Host Header RCE (CVSS 9.8)
- CVE-2022-31814: pfBlockerNG Path Traversal RCE (CVSS 9.8)
- CVE-2025-12490: Suricata Path Traversal → RCE (CVSS 8.8)
- CVE-2023-42326: Command Injection (GIF/GRE interfaces) (CVSS 8.8)
- CVE-2023-48123: Packet Capture RCE (CVSS 8.8)
- CVE-2023-27253: RRD Restore Command Injection (CVSS 8.8)
- CVE-2023-48795: Terrapin SSH Attack (CVSS 5.9, EPSS 99º)
- CVE-2025-34172: HAProxy XSS + Socket Injection (CVSS 6.1)
- CVE-2025-34175: Suricata Reflected XSS (CVSS 6.1)
- CVE-2025-53392: Arbitrary File Read (CVSS 6.5)
- CVE-2022-29273: Stored XSS via URL Alias (CVSS 6.1)
- CVE-2024-57273: OpenVPN DoS (CVSS 5.3)
- CVE-2025-34174: Status Traffic Totals XSS (CVSS 5.4)
pfSense-Specific Recommendations:
1. UPGRADE IMEDIATO
- pfSense CE: 2.7.x → 2.8.0+
- pfSense Plus: 23.09 → 24.03+
- Packages: pfBlockerNG, Suricata, Snort (latest)
2. MITIGAÇÕES TEMPORÁRIAS
- System Patches package (Netgate recomendado)
- Desabilitar serviços não essenciais
- Restringir acesso à webGUI por IP
- Remover privilégios de diagnóstico
3. MONITORAMENTO
- Alertas de login falho
- Log de alterações de config
- Detecção de comandos suspeitos
pfSense Findings → Frameworks:
| Finding | MITRE ATT&CK | CIS Control | NIST |
|---------|--------------|-------------|------|
| RCE via diag_command.php | T1190 (Exploit Public-Facing App) | 7.1 (Vuln Mgmt) | SI-2 |
| Default credentials | T1078 (Valid Accounts) | 5.2 (Account Mgmt) | IA-2 |
| Config file access | T1003 (Credential Dumping) | 3.5 (Access Control) | AC-3 |
| HA sync abuse | T1563 (Service Session Hijack) | 4.4 (Comm Protection) | SC-23 |
Documentar detalhadamente todos os achados, riscos associados, evidências e recomendações de correção para o cliente.
NOTE: Nettacker supports 5 output formats for different stakeholders and integrations.
# HTML Report (with graphs) - For executives and non-technical stakeholders
docker run --rm -v $(pwd):/tmp owasp/nettacker \
-i TARGET -m port_scan,vuln \
--graph-output /tmp/nettacker_report.html
# JSON - For programmatic processing and SIEM integration
docker run --rm -v $(pwd):/tmp owasp/nettacker \
-i TARGET -m port_scan,vuln \
--json-output /tmp/nettacker_report.json
# CSV - For spreadsheet analysis and filtering
docker run --rm -v $(pwd):/tmp owasp/nettacker \
-i TARGET -m port_scan,vuln \
--csv-output /tmp/nettacker_report.csv
# SARIF - For GitHub Security tab and code scanning tools
docker run --rm -v $(pwd):/tmp owasp/nettacker \
-i TARGET -m port_scan,vuln \
--sarif-output /tmp/nettacker_report.sarif
# DefectDojo (.dd.json) - For DefectDojo vulnerability management platform
docker run --rm -v $(pwd):/tmp owasp/nettacker \
-i TARGET -m port_scan,vuln \
--dd-output /tmp/nettacker_report.dd.json
| Format | Best For | Stakeholder | Integration |
|---|---|---|---|
| HTML | Executive presentations, visual reports | Management, Clients | Standalone |
| JSON | SIEM, automation, custom processing | Security Engineers | Splunk, ELK |
| CSV | Spreadsheet analysis, filtering | Analysts | Excel, Google Sheets |
| SARIF | GitHub Security, DevOps pipelines | Developers | GitHub, Azure DevOps |
| DefectDojo | Vulnerability management | Security Teams | DefectDojo |
# Step 1: Nettacker external scan
docker run --rm -v $(pwd):/tmp owasp/nettacker \
-i TARGET.com -m port_scan,vuln,ssl_*_vuln \
--json-output /tmp/nettacker_external.json \
--graph-output /tmp/nettacker_external.html
# Step 2: WorstAssume AWS enumeration
worst enumerate --profile <profile> --output json > /tmp/worstassume_aws.json
# Step 3: Consolidate findings
jq -s '{
nettacker: .[0],
worstassume: .[1],
generated_at: now
}' /tmp/nettacker_external.json /tmp/worstassume_aws.json \
> /tmp/consolidated_findings.json
# Step 4: Generate executive summary
jq -r '.nettacker.results[] | "Finding: \(.title)\nSeverity: \(.severity)\nTarget: \(.target)"' \
/tmp/nettacker_external.json > /tmp/executive_summary.txt
# Exportar findings em JSON estruturado
worst privesc --from <arn> --output json > attack-paths.json
# Exportar grafo completo para análise
worst graph-export --output graph.json
# Dashboard web para visualização
worst viz --port 3000
# Acessar http://localhost:3000 e usar Export
# Listar todas as cadeias de ataque detectadas
worst privesc --db findings.db --all
# Filtrar por severidade mínima
worst privesc --db findings.db --min-severity HIGH
# Exportar por família de ataque
worst privesc --db findings.db --family "IAM Self-Modification" --output family-iam.json
worst privesc --db findings.db --family "PassRole+Compute" --output family-passrole.json
worst privesc --db findings.db --family "Compute Credential Theft" --output family-compute.json
worst privesc --db findings.db --family "Secret Exfiltration" --output family-secret.json
worst privesc --db findings.db --family "Account Takeover" --output family-account.json
worst privesc --db findings.db --family "Group Membership" --output family-group.json
worst privesc --db findings.db --family "Cross-Account Lateral Movement" --output family-crossaccount.json
# Exportar todos os PATH-IDs descobertos
worst privesc --db findings.db --output all-paths.json --include-all
{
"finding_id": "FINDING-001",
"path_id": "PATH-001",
"category": "WEAK_TRUST",
"subcategory": "WildcardTrustNoCondition",
"severity": "CRITICAL",
"original_severity": "CRITICAL",
"downgrade_reason": null,
"principal_arn": "arn:aws:iam::123456789012:role/ExampleRole",
"principal_type": "ROLE",
"account_id": "123456789012",
"region": "us-east-1",
"trust_policy": {
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": "*",
"Action": "sts:AssumeRole"
}]
},
"permissions": ["iam:*", "ec2:*", "s3:*"],
"managed_policies": ["arn:aws:iam::aws:policy/AdministratorAccess"],
"inline_policies": ["FullAccess"],
"groups": ["Admins"],
"risk_factors": {
"has_wildcard_trust": true,
"has_external_account_trust": false,
"has_dangerous_managed_policy": true,
"has_resource_wildcard": true,
"missing_condition_keys": true
},
"attack_chain": {
"family": "IAM Self-Modification",
"chain_id": "CreatePolicy+Attach",
"hops": 2,
"outcome": "Self Admin Escalation"
},
"evidence": {
"command": "aws iam get-role --role-name ExampleRole",
"output": "{...}"
},
"recommendation": "Remove wildcard principal from trust policy. Add condition keys: aws:PrincipalArn, aws:SourceAccount",
"remediation_effort": "LOW",
"cvss_score": 9.8,
"created_at": "2026-04-24T10:30:00Z"
}
# Exportar todos os findings CRITICAL
sqlite3 findings.db "SELECT * FROM SecurityFinding WHERE severity='CRITICAL';"
# Count por categoria
sqlite3 findings.db "SELECT category, COUNT(*) as count FROM SecurityFinding GROUP BY category;"
# Count por severidade
sqlite3 findings.db "SELECT severity, COUNT(*) as count FROM SecurityFinding GROUP BY severity ORDER BY severity;"
# Findings com AdministratorAccess
sqlite3 findings.db "SELECT principal_arn, path_id FROM SecurityFinding WHERE managed_policies LIKE '%AdministratorAccess%';"
# Exportar em formato JSON
sqlite3 findings.db ".mode json" ".output findings.json" "SELECT * FROM SecurityFinding;"
# Iniciar dashboard
worst viz --db findings.db --port 3000
# No browser (http://localhost:3000):
# 1. Filtrar por severidade (dropdown)
# 2. Filtrar por categoria (dropdown)
# 3. Click em "Export JSON" ou "Export CSV"
# 4. Download do arquivo formatado
-- Tabela principal: SecurityFinding
CREATE TABLE SecurityFinding (
id INTEGER PRIMARY KEY AUTOINCREMENT,
finding_id TEXT UNIQUE NOT NULL, -- FINDING-0001
path_id TEXT NOT NULL, -- PATH-001
category TEXT NOT NULL, -- WEAK_TRUST, PERMISSIVE_POLICY, etc.
subcategory TEXT NOT NULL, -- WildcardTrustNoCondition, etc.
severity TEXT NOT NULL, -- CRITICAL, HIGH, MEDIUM, LOW, INFO
original_severity TEXT NOT NULL, -- Severidade antes do downgrade
downgrade_reason TEXT, -- Motivo do downgrade se aplicável
principal_arn TEXT NOT NULL, -- ARN do principal afetado
principal_type TEXT NOT NULL, -- USER, ROLE, GROUP, ROOT
account_id TEXT NOT NULL, -- 123456789012
region TEXT, -- us-east-1, etc.
trust_policy TEXT, -- JSON do trust policy
permissions TEXT, -- JSON array de permissões
managed_policies TEXT, -- JSON array de managed policies
inline_policies TEXT, -- JSON array de inline policies
groups TEXT, -- JSON array de grupos
risk_factors TEXT, -- JSON com fatores de risco
attack_chain TEXT, -- JSON da attack chain
evidence TEXT, -- JSON com evidências
recommendation TEXT, -- Texto da recomendação
remediation_effort TEXT, -- LOW, MEDIUM, HIGH
cvss_score REAL, -- 0.0-10.0
created_at DATETIME DEFAULT CURRENT_TIMESTAMP
);
-- Índices para performance
CREATE INDEX idx_severity ON SecurityFinding(severity);
CREATE INDEX idx_category ON SecurityFinding(category);
CREATE INDEX idx_account ON SecurityFinding(account_id);
CREATE INDEX idx_principal ON SecurityFinding(principal_arn);
# Passo 1: Exportar todos os findings
sqlite3 findings.db ".mode json" ".output all-findings.json" "SELECT * FROM SecurityFinding ORDER BY severity, category;"
# Passo 2: Exportar apenas CRITICAL + HIGH
sqlite3 findings.db ".mode json" ".output critical-high.json" "SELECT * FROM SecurityFinding WHERE severity IN ('CRITICAL', 'HIGH') ORDER BY severity DESC;"
# Passo 3: Gerar resumo estatístico
sqlite3 findings.db <<EOF
.mode column
.headers on
.output summary.txt
SELECT
severity,
COUNT(*) as total,
COUNT(DISTINCT account_id) as accounts_affected,
COUNT(DISTINCT category) as categories
FROM SecurityFinding
GROUP BY severity
ORDER BY
CASE severity
WHEN 'CRITICAL' THEN 1
WHEN 'HIGH' THEN 2
WHEN 'MEDIUM' THEN 3
WHEN 'LOW' THEN 4
WHEN 'INFO' THEN 5
END;
EOF
# Passo 4: Exportar por categoria para análise separada
for category in WEAK_TRUST PERMISSIVE_POLICY RESOURCE_WILDCARD USER_CONFIG GROUP_CONFIG; do
sqlite3 findings.db ".mode json" ".output category-${category}.json" "SELECT * FROM SecurityFinding WHERE category='${category}';"
done
# Passo 5: Gerar CSV para tracking em planilhas
sqlite3 findings.db <<EOF
.mode csv
.headers on
.output findings.csv
SELECT
finding_id,
severity,
category,
subcategory,
principal_arn,
recommendation
FROM SecurityFinding
ORDER BY severity, finding_id;
EOF
# FINDING-XXX: [Título do Finding]
## Metadados
- **Severity:** [CRITICAL/HIGH/MEDIUM/LOW/INFO]
- **Category:** [WEAK_TRUST/PERMISSIVE_POLICY/RESOURCE_WILDCARD/USER_CONFIG/GROUP_CONFIG]
- **Path-ID:** [PATH-XXX]
- **CVSS Score:** [X.X]
- **Affected Principal:** `arn:aws:iam::ACCOUNT:resource/name`
- **Account:** [123456789012]
- **Region:** [us-east-1]
## Descrição
[Descrição técnica detalhada do finding, explicando a vulnerabilidade
e como foi descoberta através do WorstAssume.]
## Evidência
```json
{
"principal_arn": "arn:aws:iam::123456789012:role/ExampleRole",
"trust_policy": {...},
"permissions": ["iam:*", "ec2:*", "s3:*"],
"managed_policies": ["arn:aws:iam::aws:policy/AdministratorAccess"]
}
[Identidade Inicial]
│
│ [Ação 1: iam:CreatePolicy]
▼
[Recurso Intermediário]
│
│ [Ação 2: iam:AttachUserPolicy]
▼
[Objetivo Final - Admin Access]
[Descrição do impacto se explorado, incluindo:
[Passos específicos para remediar, incluindo comandos AWS CLI exatos.]
aws iam [comando específico]
{
"Version": "2012-10-17",
"Statement": [...]
}
### 9. Validação de Qualidade do Export
```bash
# Verificar count total de findings
TOTAL=$(sqlite3 findings.db "SELECT COUNT(*) FROM SecurityFinding;")
echo "Total findings: $TOTAL"
# Verificar distribuição por severidade
sqlite3 findings.db "SELECT severity, COUNT(*) FROM SecurityFinding GROUP BY severity;"
# Verificar findings sem recomendação (erro de qualidade)
sqlite3 findings.db "SELECT finding_id FROM SecurityFinding WHERE recommendation IS NULL OR recommendation = '';"
# Verificar findings sem evidence (erro de qualidade)
sqlite3 findings.db "SELECT finding_id FROM SecurityFinding WHERE evidence IS NULL OR evidence = '{}';"
# Validar JSON exports
for f in *.json; do
jq empty "$f" && echo "$f: OK" || echo "$f: INVALID JSON"
done
RESUMO EXECUTIVO
ENGAGEMENT: [Nome do Projeto]
PERÍODO: [Data início] - [Data fim]
CLASSIFICAÇÃO: [Confidencial]
VISÃO GERAL:
[Parágrafo descrevendo o escopo e objetivos do teste]
SUMÁRIO DE RISCOS:
┌─────────────┬───────┬────────────┐
│ Severidade │ Count │ Trend │
├─────────────┼───────┼────────────┤
│ CRITICAL │ X │ [↑↓→] │
│ HIGH │ X │ [↑↓→] │
│ MEDIUM │ X │ [↑↓→] │
│ LOW │ X │ [↑↓→] │
│ INFO │ X │ [↑↓→] │
└─────────────┴───────┴────────────┘
PRINCIPAIS ACHADOS:
1. [Finding crítico #1 - 1 linha]
2. [Finding crítico #2 - 1 linha]
3. [Finding crítico #3 - 1 linha]
RISCO GERAL: [CRITICAL / HIGH / MEDIUM / LOW]
RECOMENDAÇÕES PRIORITÁRIAS:
1. [Recomendação crítica #1]
2. [Recomendação crítica #2]
3. [Recomendação crítica #3]
ESCOPO E METODOLOGIA
CONTAS AWS TESTADAS:
- Account ID: [123456789012] - [Nome/Nome do ambiente]
- Account ID: [234567890123] - [Nome/Nome do ambiente]
- Total: [X] contas
REGIÕES TESTADAS:
- [us-east-1, us-west-2, eu-west-1, ...]
SERVIÇOS TESTADOS:
- IAM (Identity and Access Management)
- EC2 (Elastic Compute Cloud)
- S3 (Simple Storage Service)
- Lambda (Serverless Computing)
- ECS (Elastic Container Service)
- [Outros serviços...]
METODOLOGIA:
Este assessment seguiu o PTES (Penetration Testing Execution Standard)
com as seguintes fases:
1. Pre-Engagement Interactions
2. Intelligence Gathering
3. Threat Modeling
4. Vulnerability Analysis
5. Exploitation
6. Post-Exploitation
7. Reporting
FERRAMENTAS UTILIZADAS:
- WorstAssume v[X.X.X] - AWS IAM enumeration and attack graph analysis
- AWS CLI v[X.X.X] - Manual verification and exploitation
- [Outras ferramentas...]
TIPO DE TESTE:
[ ] Black Box
[ ] Grey Box
[✓] White Box
LIMITAÇÕES:
- [Serviços não testados]
- [Restrições de tempo]
- [Restrições de acesso]
FINDINGS DETALHADOS
═══════════════════════════════════════════════════════════════════════════
FINDING #1: [Título do Finding]
═══════════════════════════════════════════════════════════════════════════
SEVERIDADE: [CRITICAL / HIGH / MEDIUM / LOW / INFO]
CATEGORIA: [WEAK_TRUST / PERMISSIVE_POLICY / RESOURCE_WILDCARD / etc.]
PATH-ID: [PATH-XXX]
CVSS SCORE: [X.X] (opcional)
AFETADOS:
- Tipo: [IAM User / IAM Role / EC2 Instance / etc.]
- ARN: arn:aws:iam::ACCOUNT:resource/name
- Conta: [123456789012]
- Região: [us-east-1]
DESCRIÇÃO:
[Descrição detalhada da vulnerabilidade em 2-3 parágrafos. Explicar o que
foi encontrado, por que é um problema, e como foi descoberto.]
IMPACTO:
[Descrição do impacto potencial se esta vulnerabilidade for explorada.
Incluir cenários de pior caso e dados que podem ser comprometidos.]
PROVA DE CONCEITO:
# Comandos executados durante o teste
aws [comando 1]
aws [comando 2]
# Output observado
{
"evidence": "output aqui"
}
ATTACK PATH:
[A] Identidade Inicial (arn:aws:iam::...)
│
│ iam:CreatePolicyVersion
▼
[B] Policy Version Criada
│
│ iam:AttachUserPolicy
▼
[C] Admin Access Obtido
RECOMENDAÇÃO:
[Passos específicos para remediar esta vulnerabilidade. Ser o mais
específico possível, incluindo comandos ou configurações exatas.]
REMEDIATION EXAMPLE:
# Exemplo de comando para corrigir
aws iam [comando de correção]
# Exemplo de policy corrigida
{
"Version": "2012-10-17",
"Statement": [...]
}
PRIORIDADE: [IMEDIATA / ALTA / MÉDIA / BAIXA]
ESFORÇO ESTIMADO: [X horas/dias]
DIFFICULDADE: [Fácil / Média / Difícil]
REFERÊNCIAS:
- AWS IAM Best Practices: https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html
- AWS Security Best Practices: https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-best-practices.html
- [Outras referências relevantes]
ATTACK PATHS DESCOBERTOS
PATH #1: [Nome do Attack Path]
─────────────────────────────────
SEVERIDADE: CRITICAL
HOPS: [X]
DE → PARA: [Identidade inicial] → [Objetivo final]
SEQUÊNCIA DE AÇÕES:
┌────┬─────────────────────────────────┬──────────────────────────────────┐
│ # │ Ação │ Explicação │
├────┼─────────────────────────────────┼──────────────────────────────────┤
│ 1 │ iam:CreatePolicyVersion │ Criar versão admin da policy │
│ 2 │ iam:AttachUserPolicy │ Attach policy ao próprio user │
│ 3 │ sts:GetCallerIdentity │ Verificar permissões elevadas │
└────┴─────────────────────────────────┴──────────────────────────────────┘
TEMPO ESTIMADO DE EXPLORAÇÃO: [X minutos/horas]
DETECÇÃO: [Baixa / Média / Alta]
MITIGAÇÃO: [Resumo da mitigação]
[Incluir diagrama visual se possível]
MATRIZ DE RISCOS
IMPACTO
Baixo Médio Alto Crítico
PROB. Alta [M] [H] [C] [C]
Média [L] [M] [H] [C]
Baixa [L] [L] [M] [H]
FINDINGS NA MATRIZ:
┌─────────────────────────────────────┬────────────┬───────────┬───────────┐
│ Finding │ Probabilidade │ Impacto │ Risco │
├─────────────────────────────────────┼────────────┼───────────┼───────────┤
│ Wildcard Trust Policy │ Alta │ Crítico │ CRITICAL │
│ IAM Admin via Policy Version │ Média │ Crítico │ CRITICAL │
│ Cross-Account Lateral Movement │ Média │ Alto │ HIGH │
│ IMDSv1 Credential Theft │ Alta │ Médio │ HIGH │
│ Stale Access Keys │ Baixa │ Médio │ MEDIUM │
└─────────────────────────────────────┴────────────┴───────────┴───────────┘
APÊNDICES
APÊNDICE A: COMANDOS EXECUTADOS
[Lista completa de todos os comandos AWS CLI executados]
APÊNDICE B: EVIDÊNCIAS
[Screenshots, outputs, logs de todas as explorações]
APÊNDICE C: GLOSSÁRIO
[Definições de termos técnicos usados no relatório]
APÊNDICE D: REFERÊNCIAS
[Lista completa de referências e documentação AWS]
APÊNDICE E: HISTÓRICO DE MUDANÇAS
┌────────────┬───────────────┬────────────────────────────────────────────┐
│ Versão │ Data │ Mudanças │
├────────────┼───────────────┼────────────────────────────────────────────┤
│ 1.0 │ YYYY-MM-DD │ Versão inicial do relatório │
│ 1.1 │ YYYY-MM-DD │ Adicionado finding #X, atualizado finding #Y│
└────────────┴───────────────┴────────────────────────────────────────────┘
# Generate HTML report with graphs
docker run --rm -v $(pwd):/reports owasp/nettacker \
-i TARGET.com -m port_scan,vuln,ssl_*_vuln \
--graph-output /reports/executive_report.html
# Open in browser for presentation
firefox /reports/executive_report.html
HTML Report Sections:
# Generate JSON for Splunk/ELK
docker run --rm -v $(pwd):/reports owasp/nettacker \
-i TARGET.com -m port_scan,vuln \
--json-output /reports/siem_export.json
# Parse for specific findings
jq '.results[] | select(.severity == "CRITICAL")' /reports/siem_export.json
# Convert to ECS format for Elasticsearch
jq '.results[] | {
"@timestamp": .date,
"host": {"ip": .target},
"vulnerability": {
"cve": .cve_id,
"severity": .severity,
"description": .description
}
}' /reports/siem_export.json > /reports/ecs_format.json
# Generate CSV for Excel/Google Sheets
docker run --rm -v $(pwd):/reports owasp/nettacker \
-i TARGET.com -m port_scan,vuln \
--csv-output /reports/findings.csv
# Filter in Excel/Sheets:
# - Sort by severity
# - Filter by target
# - Pivot by vulnerability type
CSV Columns:
Target,Port,Vulnerability,Severity,CVSS,Description,Remediation,Date
# Generate SARIF for GitHub Security tab
docker run --rm -v $(pwd):/reports owasp/nettacker \
-i TARGET.com -m vuln \
--sarif-output /reports/github_security.sarif
# Upload to GitHub
gh api \
--method POST \
/repos/OWNER/REPO/code-scanning/sarifs \
-f commit_sha=$(git rev-parse HEAD) \
-f ref=refs/heads/main \
-f sarif=$(base64 -i /reports/github_security.sarif)
# Generate DefectDojo format
docker run --rm -v $(pwd):/reports owasp/nettacker \
-i TARGET.com -m port_scan,vuln \
--dd-output /reports/defectdojo.json
# Upload to DefectDojo via API
curl -X POST "https://defectdojo.local/api/v2/import-scan/" \
-H "Authorization: Token $DD_API_KEY" \
-F "file=@/reports/defectdojo.json" \
-F "engagement=$ENGAGEMENT_ID" \
-F "scan_type=Nettacker Scan"
{
"reportMetadata": {
"engagementName": "AWS Security Assessment",
"client": "Client Name",
"dateRange": {
"start": "YYYY-MM-DD",
"end": "YYYY-MM-DD"
},
"reportVersion": "1.0",
"classification": "Confidential"
},
"executiveSummary": {
"totalFindings": 15,
"bySeverity": {
"CRITICAL": 3,
"HIGH": 5,
"MEDIUM": 4,
"LOW": 2,
"INFO": 1
},
"overallRisk": "HIGH"
},
"findings": [...],
"attackPaths": [...],
"scope": {...},
"methodology": {...}
}
FindingID,Severity,Category,Title,AffectedResource,Recommendation,Status
FINDING-001,CRITICAL,WEAK_TRUST,Wildcard Trust Policy,arn:aws:iam::123:role/X,Remove wildcard principal,Open
FINDING-002,HIGH,PERMISSIVE_POLICY,Admin Access,arn:aws:iam::123:user/Y,Remove admin policy,Open
SLIDE 1: Title Slide
- Project name, date, presenter
SLIDE 2: Executive Summary
- Overall risk rating
- Key findings (top 3-5)
SLIDE 3: Scope & Methodology
- What was tested
- How it was tested
SLIDE 4-8: Critical Findings
- One slide per critical finding
- Visual representation of attack path
SLIDE 9: Risk Matrix
- Visual risk matrix with findings plotted
SLIDE 10: Recommendations
- Prioritized remediation roadmap
SLIDE 11: Timeline
- Remediation timeline with milestones
SLIDE 12: Q&A
IMPACTO
Baixo Médio Alto Crítico
PROB. Alta [M] [H] [C] [C]
Média [L] [M] [H] [C]
Baixa [L] [L] [M] [H]
Finding Placement Example:
┌─────────────────────────────────────┬────────────┬───────────┬───────────┐
│ Finding │ Probabilidade │ Impacto │ Risco │
├─────────────────────────────────────┼────────────┼───────────┼───────────┤
│ Wildcard Trust Policy │ Alta │ Crítico │ CRITICAL │
│ SQL Injection │ Média │ Crítico │ CRITICAL │
│ Cross-Account Lateral Movement │ Média │ Alto │ HIGH │
│ Stored XSS │ Alta │ Médio │ HIGH │
│ Missing Security Headers │ Baixa │ Baixo │ LOW │
└─────────────────────────────────────┴────────────┴───────────┴───────────┘
Industry-Specific Considerations:
Healthcare (HIPAA):
- PHI exposure = Automatic HIGH/CRITICAL
- Patient safety impact = CRITICAL
Financial (PCI-DSS, SOX):
- Cardholder data = CRITICAL
- Financial fraud potential = CRITICAL
E-commerce:
- Customer PII = HIGH/CRITICAL
- Payment processing = CRITICAL
SaaS/Cloud:
- Multi-tenant data exposure = CRITICAL
- Authentication bypass = CRITICAL
# Via dashboard web (worst viz)
# Click em "Export" → Select format (HTML/JSON/CSV)
# JSON export via CLI
worst privesc --from <arn> --output json > paths.json
# Graph export
worst graph-export --output graph.json
# Capturar evidências em formato estruturado
aws sts get-caller-identity --output json > evidence-identity.json
aws iam get-role --role-name <role> --output json > evidence-role.json
# Capturar output de scans para evidência
hping3 -S -p 80 -c 10 target.com 2>&1 | tee evidence-syn-scan.txt
# Documentar firewall mapping
hping3 -A -p 80 target.com 2>&1 | tee evidence-ack-scan.txt
# Salvar resultados de port scanning
hping3 -S -p 1-1000 --scan target.com 2>&1 | tee evidence-port-scan.txt
# Gerar relatório de IDS evasion testing
{
echo "=== XMAS Scan Test ==="
hping3 -F -P -U -p 80 -c 10 target.com
echo ""
echo "=== NULL Scan Test ==="
hping3 -O -p 80 -c 10 target.com
echo ""
echo "=== Fragmented Packet Test ==="
hping3 -S -p 80 -f -c 10 target.com
} | tee evidence-ids-evasion.txt
# FINDING-NET-XXX: [Título do Finding de Rede]
## Metadados
- **Severity:** [CRITICAL/HIGH/MEDIUM/LOW/INFO]
- **Category:** NETWORK_VULNERABILITY
- **Tool:** hping3
- **CVSS Score:** [X.X]
- **Affected Host:** `target.com (IP)`
- **Portas/Services:** [lista]
## Descrição
[Descrição técnica da vulnerabilidade de rede identificada
através de scans com hping3.]
## Evidência (hping3 output)
HPING target.com (IP): S set, 40 headers + 0 data bytes <-- [output do hping3 capturado] -->
## Técnica Utilizada
- **Scan Type:** [SYN/ACK/XMAS/NULL/ICMP]
- **Flags:** [-S/-A/-FPU/-O/etc.]
- **Portas:** [range ou lista]
- **Evasion:** [fragmentation/spoofing/timing]
## Impacto
[Descrição do impacto se explorado, incluindo:
- Serviços expostos
- Possibilidade de lateral movement
- Risco de comprometimento de rede]
## Recomendação
[Passos específicos para remediar, incluindo:
- Configuração de firewall
- Regras de filtragem
- IDS/IPS tuning]
## Referências
- PTES 2.5.4 - Active Footprinting
- PTES 3.1.1 - Vulnerability Testing
- PTES 4.1.1 - Countermeasure Bypass
EXECUTIVE SUMMARY Structure:
1. Engagement Overview (1 paragraph)
2. Overall Risk Rating (CRITICAL/HIGH/MEDIUM/LOW)
3. Key Findings Summary (3-5 bullet points)
4. Strategic Recommendations (prioritized)
TECHNICAL REPORT Structure:
1. Scope and Methodology
2. Detailed Findings (per vulnerability)
3. Attack Paths Discovered
4. Risk Matrix
5. Remediation Roadmap
6. Appendices (evidence, commands, references)
Risk Assessment Framework:
Attack Vector (AV):
- Network (N): Vulnerability exploitable remotely
- Adjacent (A): Local network access required
- Local (L): Local access required
- Physical (P): Physical access required
Attack Complexity (AC):
- Low (L): No special conditions
- High (H): Specialized conditions required
Privileges Required (PR):
- None (N): No authentication needed
- Low (L): Basic user privileges
- High (H): Administrative privileges
User Interaction (UI):
- None (N): No user interaction
- Required (R): User action needed
Impact Metrics (C/I/A):
- None (N): No impact
- Low (L): Limited impact
- High (H): Complete loss
CVSS Score Calculation:
- 9.0-10.0: CRITICAL
- 7.0-8.9: HIGH
- 4.0-6.9: MEDIUM
- 0.1-3.9: LOW
CRITICAL Finding Template:
┌─────────────────────────────────────────────────────────────────┐
│ FINDING: [Title] │
│ SEVERITY: CRITICAL (CVSS: 9.X) │
│ │
│ DESCRIPTION: │
│ [Clear explanation of the vulnerability] │
│ │
│ BUSINESS IMPACT: │
│ - Complete system compromise │
│ - Full data breach potential │
│ - Regulatory implications (GDPR, HIPAA, PCI-DSS) │
│ │
│ IMMEDIATE ACTION REQUIRED: │
│ 1. [Specific remediation step] │
│ 2. [Specific remediation step] │
│ 3. [Specific remediation step] │
│ │
│ TIMELINE: Remediate within 24-48 hours │
└─────────────────────────────────────────────────────────────────┘
HIGH Finding Template:
┌─────────────────────────────────────────────────────────────────┐
│ FINDING: [Title] │
│ SEVERITY: HIGH (CVSS: 7.X-8.X) │
│ │
│ DESCRIPTION: │
│ [Clear explanation of the vulnerability] │
│ │
│ BUSINESS IMPACT: │
│ - Significant data exposure │
│ - Privilege escalation possible │
│ │
│ RECOMMENDED ACTION: │
│ 1. [Specific remediation step] │
│ 2. [Specific remediation step] │
│ │
│ TIMELINE: Remediate within 7 days │
└─────────────────────────────────────────────────────────────────┘
Day 0: Submit report to program
Day 1-3: Initial triage (expect confirmation)
Day 7-14: Validation by security team
Day 30-90: Fix development and testing
Day 90+: Public disclosure (if agreed)
DO:
✅ Be patient - security teams are often busy
✅ Be responsive - answer questions quickly
✅ Be collaborative - help validate fixes
✅ Be professional - maintain good relationships
✅ Follow program policies and scope
DON'T:
❌ Send constant status requests
❌ Share vulnerability publicly before fix
❌ Be rude or demanding
❌ Threaten to disclose
❌ Submit duplicate reports
Before Submitting:
□ Tested thoroughly
□ Clear reproduction steps
□ Proper security terminology
□ Remediation suggestions included
□ Professional tone
□ All relevant evidence attached
□ Checked for duplicates
□ Within scope
Report Structure:
□ Title: Clear and concise
□ Severity: Appropriate (CVSS if possible)
□ Description: What, where, how
□ Steps to Reproduce: Numbered, detailed
□ Impact: Business risk explained
□ Proof of Concept: Working payload
□ Remediation: Specific fix suggestions
TITLE: [Vulnerability Type] in [Component] Allows [Impact]
SEVERITY: [Critical/High/Medium/Low]
CVSS: [Score if applicable]
SUMMARY:
[2-3 sentence overview of the vulnerability]
DESCRIPTION:
[Detailed explanation of the vulnerability]
STEPS TO REPRODUCE:
1. Go to [URL/endpoint]
2. [Action]
3. [Action]
4. Observe: [Result]
PROOF OF CONCEPT:
[Payload, screenshot, or video]
IMPACT:
[Explain business risk - data breach, account takeover, etc.]
REMEDIATION:
[Specific fix suggestions]
REFERENCES:
- [Relevant CVEs]
- [OWASP links]
- [Vendor documentation]
HackerOne:
- Use H1 report template
- Include CVSS calculation
- Follow program-specific guidelines
Bugcrowd:
- Use Bugcrowd Vulnerability Rating Taxonomy
- Include priority score justification
- Follow VRT severity levels
Intigriti/YesWeHack:
- European programs - GDPR considerations
- Clear business impact explanation
Após completar esta fase, o penetration test está completo.
/pentest-network-scanning - Section 14: OWASP Nettacker Integration (Network Scanning)/pentest-vulnerability-analysis - Section 7: OWASP Nettacker Vulnerability Scanning (CVE Detection)/pentest-intelligence-gathering - Section 9: OWASP Nettacker for Intelligence Gathering (Recon)/pentest-pfsense - Section 4.28: OWASP Nettacker for pfSense (Specialized Scanning)NOTE: AIRecon can automate report generation, consolidate findings from multiple tools, and export in multiple formats.
# Generate consolidated pentest report from all findings
airecon "generate pentest report from nettacker and worstassume findings"
# Export findings in specific format
airecon "export vulnerability findings to JSON for SIEM integration"
# Create executive summary from technical findings
airecon "create executive summary from pentest findings for management"
# Generate DefectDojo compatible report
airecon "export findings to DefectDojo format for vulnerability management"
# Export API keys found during assessment for report
/ai airecon "/api-keys --export json > report-api-keys.json"
# Export webshell detection results for post-exploitation section
/ai airecon "/webshell-detect --export json > report-webshells.json"
# Generate wordlist usage statistics for methodology section
/ai airecon "/wordlist --stats --export markdown > report-wordlist-stats.md"
# Use hexstrike-local to create formatted vulnerability report
airecon "create vulnerability report using hexstrike-local create_vulnerability_report"
# Generate scan summary with visual formatting
airecon "create scan summary for target example.com with tools nmap,nuclei,nettacker"
# Export findings in SARIF format for GitHub Security
airecon "convert findings to SARIF format for GitHub Security integration"
# Step 1: Generate Nettacker report in JSON
docker run --rm -v $(pwd):/reports owasp/nettacker \
-i TARGET.com -m port_scan,vuln \
--json-output /reports/nettacker.json
# Step 2: Export WorstAssume findings
worst privesc --profile <profile> --output json > /reports/worstassume.json
# Step 3: Use AIRecon to consolidate and generate report
airecon "consolidate findings from /reports/nettacker.json and /reports/worstassume.json \
and generate executive report with technical appendix"
# AIRecon will:
# - Parse both JSON files
# - Deduplicate findings
# - Calculate CVSS scores
# - Generate risk matrix
# - Create attack path diagrams
# - Output: consolidated_report.html, consolidated_report.json, executive_summary.md
# Generate Executive Summary (PTES 6.1)
airecon "generate executive summary from findings for non-technical stakeholders"
# Generate Technical Report (PTES 6.2)
airecon "generate technical report with PoC, evidence, and remediation commands"
# Quantify Risk (PTES 6.3)
airecon "calculate risk matrix from findings using CVSS and business impact"
# Create Deliverable (PTES 6.4)
airecon "create final deliverable package with PDF, JSON, CSV, and SARIF exports"
| Keywords | Skills Loaded | MCP Tools |
|---|---|---|
report, relatório, executive summary | pentest-reporting.md | hexstrike-local, pentestswarm-remote |
export, JSON, CSV, SARIF, DefectDojo | pentest-reporting.md | hexstrike-local (create_file, format_tool_output_visual) |
CVSS, risk matrix, quantify | pentest-reporting.md, pentest-threat-modeling.md | cve-mcp (calculate_risk_score, compare_cves) |
nettacker, worstassume, consolidate | pentest-reporting.md | hexstrike-local, pentestswarm-remote |
presentation, stakeholders, slides | pentest-reporting.md | hexstrike-local (create_file for slide deck) |
# Validate report completeness
airecon "check if report has all required PTES Section 6 sections"
# Verify finding evidence is complete
airecon "validate all findings have evidence, PoC, and remediation steps"
# Check CVSS scoring consistency
airecon "verify CVSS scores are consistent across all findings"
# Generate compliance mapping
airecon "map findings to MITRE ATT&CK, CIS Controls, and NIST frameworks"
# If report generation fails, AIRecon will:
# 1. Log error with specific missing data
# 2. Retry with subset of findings
# 3. Generate partial report with warnings
# 4. Suggest manual data collection for missing items
# Example retry workflow
airecon "generate report --partial-ok --warn-missing-evidence"
Watchtower é um framework de penetration testing baseado em LangGraph com arquitetura multi-agente (Planner, Worker, Analyst) que inclui geração automática de relatórios PDF com findings consolidados.
# Gerar relatório PDF automático após scanning
python -m watchtower.main --report "pentest_report.pdf"
# Watchtower gera automaticamente:
# - Executive Summary
# - Vulnerability Summary by Severity
# - Risk Matrix
# - CVE Details (CVSS, EPSS, KEV, PoC)
# - Technical Findings with Evidence
# - Remediation Recommendations
# - Tool Output Appendices
# - References (NVD, OWASP, vendor advisories)
# Relatório a partir de findings existentes
python -m watchtower.main \
--input findings.json \
--report "consolidated_report.pdf"
# Generate full PDF report
/watchtower-report --output "pentest_report.pdf"
# Generate executive summary only
/watchtower-report --type executive --output "executive_summary.pdf"
# Generate technical report only
/watchtower-report --type technical --output "technical_report.pdf"
# Generate risk matrix
/watchtower-report --type risk-matrix --output "risk_matrix.pdf"
# Generate CVE-specific report
/watchtower-report --cve CVE-2021-44228 --output "cve_report.pdf"
┌─────────────────────────────────────────────────────────────┐
│ Watchtower PDF Report Structure │
├─────────────────────────────────────────────────────────────┤
│ 1. COVER PAGE │
│ - Engagement name, date, classification │
│ - Client name, assessor name │
│ │
│ 2. EXECUTIVE SUMMARY (PTES 6.1) │
│ - Engagement overview │
│ - Key findings summary │
│ - Risk overview (chart) │
│ - Strategic recommendations │
│ │
│ 3. VULNERABILITY SUMMARY (PTES 6.2) │
│ - Findings by severity (Critical, High, Medium, Low) │
│ - Risk matrix visualization │
│ - CVE cross-reference table │
│ │
│ 4. TECHNICAL FINDINGS (PTES 6.2) │
│ - Detailed finding descriptions │
│ - Evidence (screenshots, logs, PoC) │
│ - CVSS scoring breakdown │
│ - EPSS score and KEV status │
│ - Remediation steps │
│ │
│ 5. ATTACK PATHS (PTES 6.3) │
│ - Kill chain diagrams │
│ - Privilege escalation paths │
│ - Business impact analysis │
│ │
│ 6. REMEDIATION ROADMAP (PTES 6.4) │
│ - Prioritized recommendations │
│ - Effort vs. Impact matrix │
│ - Quick wins vs. long-term fixes │
│ │
│ 7. APPENDICES │
│ - Tool output logs │
│ - Full CVE details │
│ - References (NVD, OWASP, vendor) │
│ - Compliance mapping (MITRE ATT&CK, CIS, NIST) │
└─────────────────────────────────────────────────────────────┘
# PDF Report (primary format)
python -m watchtower.main --report "pentest_report.pdf"
# JSON Export (for SIEM integration)
python -m watchtower.main \
--output json \
-o findings.json
# CSV Export (for spreadsheet analysis)
python -m watchtower.main \
--output csv \
-o findings.csv
# SARIF Export (for DefectDojo/SIEM)
python -m watchtower.main \
--output sarif \
-o findings.sarif
# HTML Report (alternative to PDF)
python -m watchtower.main \
--output html \
-o report.html
# 1. AIRecon consolida findings de múltiplas ferramentas
airecon "consolidate findings from nettacker, worstassume, watchtower"
# 2. Watchtower gera relatório PDF
python -m watchtower.main --report "consolidated_report.pdf"
# 3. AIRecon gera formatos adicionais
airecon "export findings to JSON, CSV, SARIF"
# 4. AIRecon gera apresentação para stakeholders
airecon "generate stakeholder presentation slides"
# 1. Nettacker gera relatório HTML
docker run --rm -v $(pwd):/output owasp/nettacker \
-i target.com -m port_scan,*_vuln \
-o /output/nettacker.html --graph d3_tree_v2_graph
# 2. Watchtower consolida com outros findings
python -m watchtower.main \
--input nettacker.json \
--report "combined_report.pdf"
# 3. Watchtower Analyst adiciona:
# - CVE intelligence (EPSS, KEV, PoC)
# - Risk scoring
# - Remediation recommendations
# - Compliance mapping
# 1. WorstAssume exporta findings AWS
worst assess --min-severity HIGH --output json > worst_findings.json
# 2. Watchtower consolida findings
python -m watchtower.main \
--input worst_findings.json \
--report "aws_assessment_report.pdf"
# 3. Watchtower adiciona:
# - IAM attack chain diagrams
# - Privilege escalation paths
# - Cross-account risk analysis
# - AWS-specific remediation
# Watchtower gera risk matrix automaticamente
python -m watchtower.main --report "pentest_report.pdf"
# Risk Matrix inclui:
# - CVSS Base Score (0-10)
# - EPSS Score (exploit probability)
# - KEV Status (CISA Known Exploited)
# - PoC Availability (exploit maturity)
# - Business Impact (target context)
# Exemplo output:
┌─────────────────────────────────────────────────────────────┐
│ RISK MATRIX │
├──────────────┬──────────┬──────────┬──────────┬─────────────┤
│ Vulnerability│ CVSS │ EPSS │ KEV │ Risk Score │
├──────────────┼──────────┼──────────┼──────────┼─────────────┤
│ CVE-2026-4194│ 9.8 │ 0.95 │ YES │ 98/100 │
│ CVE-2021-4422│ 10.0 │ 0.98 │ YES │ 95/100 │
│ CVE-2023-4232│ 8.7 │ 0.45 │ NO │ 87/100 │
└──────────────┴──────────┴──────────┴──────────┴─────────────┘
# Watchtower usa cve-mcp para enriquecer relatórios:
# 1. CVE Summary
mcp__cve-mcp__get_cve_summary(cve_id="CVE-2021-44228")
# 2. EPSS Score
mcp__cve-mcp__get_epss_score(cve_ids="CVE-2021-44228")
# 3. KEV Check
mcp__cve-mcp__check_kev(cve_id="CVE-2021-44228")
# 4. Exploit Availability
mcp__cve-mcp__check_exploit_availability(cve_id="CVE-2021-44228")
# 5. Risk Score (composite)
mcp__cve-mcp__calculate_risk_score(cve_id="CVE-2021-44228")
# 6. Vendor Advisory
mcp__cve-mcp__get_vendor_advisory(cve_id="CVE-2021-44228")
# Watchtower mapeia findings automaticamente para:
# MITRE ATT&CK
mcp__cve-mcp__get_attack_mapping(cve_id="CVE-2021-44228")
# Returns: Techniques, TTPs, threat groups
# CIS Controls
# Auto-mapped based on vulnerability type:
# - Vuln Mgmt (7.1)
# - Access Control (3.5)
# - Account Mgmt (5.2)
# NIST SP 800-53
# Auto-mapped based on impact category:
# - SI-2 (Flaw Remediation)
# - IA-2 (Identification/Authentication)
# - AC-3 (Access Enforcement)
# Executive Summary Template (PTES 6.1)
python -m watchtower.main \
--template executive \
--report "executive_summary.pdf"
# Technical Report Template (PTES 6.2)
python -m watchtower.main \
--template technical \
--report "technical_report.pdf"
# Risk Assessment Template (PTES 6.3)
python -m watchtower.main \
--template risk-assessment \
--report "risk_assessment.pdf"
# Custom Template
python -m watchtower.main \
--template custom_template.json \
--report "custom_report.pdf"
# Se pfSense testado, Watchtower inclui automaticamente:
# 1. pfSense-specific findings
# - CVE-2023-42326 (Command Injection)
# - CVE-2025-53392 (File Read)
# - CVE-2022-40624 (pfBlockerNG RCE)
# 2. Version-specific CVEs
# - whatweb detecta versão
# - cve-mcp mapeia CVEs para versão
# 3. Remediation específica
# - Upgrade path (2.7.x → 2.8.0+)
# - Package updates
# - Configuration hardening
# 4. Compliance mapping
# - Firewall-specific controls
# - Network segmentation requirements
# Se cPanel testado, Watchtower inclui automaticamente:
# 1. CVE-2026-41940 findings
# - Authentication Bypass (CVSS 9.8)
# - Exploitation evidence
# - Patch verification status
# 2. Version-specific analysis
# - cPanel version detection
# - Patch level verification
# - Vulnerability confirmation
# 3. Remediation específica
# - Upgrade instructions
# - Patch application steps
# - Verification commands
1. AUTOMATIC EVIDENCE CAPTURE
- Screenshots de explorações bem-sucedidas
- Command output logs
- Session information
- Credential dumps (sanitized)
2. CVE INTELLIGENCE ENRICHMENT
- CVSS scores (v2, v3, v4)
- EPSS scores (exploit probability)
- KEV status (CISA Known Exploited)
- PoC availability (Exploit-DB, GitHub)
- Vendor advisories
3. RISK PRIORITIZATION
- Composite risk scoring
- Business impact analysis
- Exploitability assessment
- Remediation effort estimation
4. COMPLIANCE MAPPING
- MITRE ATT&CK techniques
- CIS Controls mapping
- NIST SP 800-53 controls
- ISO 27001 controls
- PCI DSS requirements
5. VISUAL ELEMENTS
- Risk matrix charts
- Attack path diagrams
- Severity distribution graphs
- Timeline visualizations
┌─────────────────────────────────────────────────────────────┐
│ Watchtower Report Generation Workflow │
└─────────────────────────────────────────────────────────────┘
│
┌─────────────────────┼─────────────────────┐
│ │ │
▼ ▼ ▼
┌───────────────┐ ┌─────────────────┐ ┌───────────────┐
│ Data Input │ │ Report Gen │ │ Output │
│ │ │ │ │ │
│ - findings │ │ - PDF generation│ │ - PDF report │
│ - tool output │ │ - Charts/graphs │ │ - JSON export │
│ - evidence │ │ - Compliance map│ │ - CSV export │
└───────────────┘ └─────────────────┘ └───────────────┘
# Custom report sections
python -m watchtower.main \
--sections executive,technical,risk-matrix \
--report "custom_report.pdf"
# Add/remove sections
python -m watchtower.main \
--exclude-sections tool-output \
--report "concise_report.pdf"
# Custom branding
python -m watchtower.main \
--branding company_logo.png \
--report "branded_report.pdf"
# Multi-language support
python -m watchtower.main \
--language pt-BR \
--report "relatorio_pt.pdf"
# Watchtower valida relatório antes de gerar:
# 1. Check findings completeness
if not findings:
raise ValueError("No findings to report")
# 2. Check evidence availability
for finding in findings:
if not finding.evidence:
warn("Missing evidence for finding")
# 3. Check CVSS consistency
validate_cvss_scores(findings)
# 4. Generate report only if validation passes
generate_pdf_report(findings, evidence, metadata)
# 1. PentestSwarm campaign findings
airecon "get campaign findings campaign_abc123"
# 2. Watchtower consolida findings
python -m watchtower.main \
--input campaign_findings.json \
--report "pentestswarm_report.pdf"
# 3. Watchtower adiciona:
# - Campaign summary
# - Tool execution timeline
# - Success/failure analysis
# - Recommendations
# Relatórios salvos automaticamente em:
~/.watchtower/reports/
# Estrutura de diretórios:
~/.watchtower/reports/
├── 2026-05-03_target_com/
│ ├── pentest_report.pdf
│ ├── findings.json
│ ├── findings.csv
│ └── evidence/
│ ├── screenshots/
│ ├── logs/
│ └── poc_scripts/
| Fase PTES | Técnica hping3 | Finding Category | Severidade Típica |
|---|---|---|---|
| 2.5.4 Intelligence Gathering | Host Discovery, Port Scan | RECONNAISSANCE | INFO |
| 2.5.4 Intelligence Gathering | Firewall Mapping | NETWORK_RECON | INFO |
| 3.1.1 Vulnerability Analysis | Stateless Firewall Detection | NETWORK_VULNERABILITY | MEDIUM/HIGH |
| 3.1.2 Vulnerability Analysis | IDS/IPS Detection Testing | DETECTION_TESTING | LOW |
| 4.1.1 Exploitation | ACK Scan Bypass | NETWORK_EXPLOITATION | HIGH |
| 4.1.1 Exploitation | Fragmentation Bypass | NETWORK_EXPLOITATION | HIGH |
| 4.1.1 Exploitation | XMAS/NULL Scan Evasion | NETWORK_EXPLOITATION | MEDIUM |
| 5.1.4 Post-Exploitation | Internal Pivoting | LATERAL_MOVEMENT | HIGH |
| 5.1.4 Post-Exploitation | Covert Channel (ICMP) | DATA_EXFILTRATION | HIGH |
CRITICAL Findings:
- Firewall stateless detection: hping3 -A -p <port> target
- Internal database exposure: hping3 -S -p 3306,5432,1433 --scan internal-ip
HIGH Findings:
- Port scanning results: hping3 -S -p 1-1000 --scan target
- Fragmentation bypass: hping3 -S -p <port> -f target
- ICMP tunneling: hping3 -1 -d 1024 target
MEDIUM Findings:
- IDS evasion testing: hping3 -F -P -U -p <port> target
- TTL-based filtering gaps: hping3 -S -p <port> -t <ttl> target
LOW/INFO Findings:
- Host discovery: hping3 -S -p 80 --scan subnet
- OS fingerprinting: hping3 -S -p 80 -t 64,128 target
NETWORK SECURITY ASSESSMENT - HPING3 STATISTICS
Total Hosts Scanned: [X]
Total Ports Tested: [Y]
Findings by Category:
┌─────────────────────────────┬───────┬─────────────┐
│ Category │ Count │ Severity │
├─────────────────────────────┼───────┼─────────────┤
│ Firewall Misconfiguration │ X │ HIGH │
│ Stateless Firewall │ X │ HIGH │
│ IDS Evasion Successful │ X │ MEDIUM │
│ Open Ports (Internal) │ X │ MEDIUM │
│ ICMP Information Leak │ X │ LOW │
└─────────────────────────────┴───────┴─────────────┘
Techniques Tested:
[✓] SYN Scan
[✓] ACK Scan
[✓] XMAS Scan
[✓] NULL Scan
[✓] Fragmentation
[✓] Source Spoofing
[✓] ICMP Tunneling
[✓] TTL Analysis