poellie01/pentestcompanion

Pentest Companion is a self-hosted web app for penetration testers, bug bounty hunters, and people studying for offensive security certifications like OSCP, OSEP, CRTP, or PNPT. The idea is to give someone a single workspace where they can keep all the moving parts of an engagement, the targets, the tools they ran, the findings, screenshots, notes, and the final report. It is written in Python (the language tag is HTML because of the templates) and runs either as a plain Flask app or in a Docker container, with a default port of 5000. The Tools Hub bundles 43 common command line tools across 10 categories including network scanning (nmap, masscan), web testing (gobuster, ffuf, sqlmap), Active Directory work (enum4linux-ng, netexec, kerbrute), the Impacket suite, password cracking (hydra, hashcat, john), DNS reconnaissance, SSL checks, OSINT helpers, and Linux privilege checks. The app probes the host with which to see which tools are actually installed, dims the missing ones with an apt install hint, and lets you launch the rest from a form. Output streams live to the browser through server-sent events, and parsed findings can be pushed into an engagement with one click. You can also tick tools to run automatically in the background when you add a new target. Engagements are the core unit of work. Each one tracks targets, open ports, a methodology checklist organised around PTES phases (enumeration, initial access, privilege escalation, lateral movement, data exfiltration, persistence, reporting), an attack timeline, a credentials vault, time tracking, and archive or full ZIP export. Findings get a CVSS v3.1 score, evidence uploads, a status workflow, NVD-based CVE lookup, and bulk import from Nessus and Burp Suite XML. There is a 22-template finding library and a reporting layer that produces branded DOCX and PDF reports with cover page, executive summary, and per-section redaction toggles. Other pieces include a browser-based terminal built on xterm.js and a PTY for running commands on the host, a pclog bash helper that pipes any command's output into the app via a personal API token, an Exam Mode with live countdown and screenshot slots, a multi-user setup with roles and invite links, and small utilities like a hash identifier, Base64 codec, and Markdown notes with Obsidian vault import. The first run prints a bootstrap admin login that the README tells you to change. License is MIT.