Pentestify Security Report Generator

Pentestify Security Report Generator

Skill by ara.so — Security Skills collection.

Pentestify is an interactive penetration testing report generator that allows security professionals to:

• Register vulnerabilities using predefined templates or manually
• Visualize risk statistics in real-time
• Export structured corporate reports in PDF format
• Work in bilingual mode (Spanish/English)
• Persist reports and findings to SQLite database
• Manage multiple reports with automatic saving

Built with FastAPI backend (async) and Vanilla JavaScript SPA frontend.

Installation

Quick Start with Docker (Recommended)

# Build the image
docker build -t pentestify:latest .

# Run with persistent volume
docker run -d \
  -p 8000:8000 \
  -v pentestify_data:/app/data \
  --name pentestify \
  pentestify:latest

# Access at http://localhost:8000

Manual Installation

# Clone repository
git clone https://github.com/ccyl13/Pentestify.git
cd Pentestify

# Create virtual environment
python3 -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install dependencies
pip install -r requirements.txt

# Install Playwright browsers for PDF generation
playwright install chromium

# Run the server
python3 run.py

The application will be available at http://localhost:8000

Architecture Overview

Frontend (SPA)
  ├── index.html (Single Page Application)
  ├── js/app.js (Vanilla JavaScript)
  └── css/styles.css (Pure CSS)
       ↓ HTTP/REST
Backend (FastAPI)
  ├── main.py (API endpoints)
  ├── models.py (SQLAlchemy ORM)
  ├── schemas.py (Pydantic validation)
  └── database.py (SQLite connection)
       ↓
Database (SQLite)
  └── pentestify.db
      ├── reports table
      └── findings table

API Endpoints

Reports Management

Create Report

# POST /api/reports
# Request body
{
  "client_name": "Acme Corp",
  "report_date": "2026-05-21",
  "auditor_name": "John Doe",
  "executive_summary": "Security assessment of web application",
  "scope": "Web application, API endpoints",
  "methodology": "OWASP Testing Guide v4.2",
  "language": "en"  # or "es"
}

Get All Reports

# GET /api/reports
# Response: List of reports with metadata

Get Single Report

# GET /api/reports/{report_id}
# Response: Full report with all findings

Update Report

# PUT /api/reports/{report_id}
# Same body structure as POST

Delete Report

# DELETE /api/reports/{report_id}
# Cascades to delete all associated findings

Findings Management

Add Finding to Report

# POST /api/reports/{report_id}/findings
{
  "title": "SQL Injection in Login Form",
  "severity": "critical",  # critical, high, medium, low, info
  "cvss_score": 9.8,
  "description": "The application is vulnerable to SQL injection...",
  "impact": "Complete database compromise possible",
  "affected_systems": "login.php, /api/auth endpoint",
  "evidence": "Payload: ' OR '1'='1 -- ",
  "remediation": "Use parameterized queries...",
  "references": "CWE-89, OWASP A03:2021",
  "order_index": 0  # Position in report
}

Reorder Findings

# PUT /api/reports/{report_id}/findings/reorder
{
  "finding_ids": [3, 1, 2, 4]  # New order by ID
}

Delete Finding

# DELETE /api/findings/{finding_id}
# Automatically reorders remaining findings

PDF Export

Generate PDF Report

# GET /api/reports/{report_id}/export/pdf
# Returns PDF file download with corporate formatting

Database Backup

Export Database

# GET /api/database/export
# Returns pentestify.db file for backup

Import Database

# POST /api/database/import
# Form-data: file (pentestify.db)

Backend Code Examples

Creating a Custom Vulnerability Template

# backend/models.py extension example
from sqlalchemy import Column, Integer, String, Float, ForeignKey, Text
from sqlalchemy.orm import relationship
from .database import Base

class FindingTemplate(Base):
    """Predefined vulnerability templates"""
    __tablename__ = "finding_templates"
    
    id = Column(Integer, primary_key=True, index=True)
    name = Column(String, unique=True, index=True)
    severity = Column(String)
    cvss_base = Column(Float)
    description_template = Column(Text)
    remediation_template = Column(Text)
    cwe_id = Column(String, nullable=True)
    
    def to_finding(self, report_id: int):
        """Convert template to actual finding"""
        return Finding(
            report_id=report_id,
            title=self.name,
            severity=self.severity,
            cvss_score=self.cvss_base,
            description=self.description_template,
            remediation=self.remediation_template,
            references=f"CWE-{self.cwe_id}" if self.cwe_id else ""
        )

Adding Authentication Endpoint

# backend/main.py
from fastapi import Depends, HTTPException, status
from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
import os

security = HTTPBearer()

def verify_token(credentials: HTTPAuthorizationCredentials = Depends(security)):
    """Verify API token from environment"""
    expected_token = os.getenv("PENTESTIFY_API_TOKEN")
    if not expected_token:
        raise HTTPException(
            status_code=status.HTTP_501_NOT_IMPLEMENTED,
            detail="Authentication not configured"
        )
    if credentials.credentials != expected_token:
        raise HTTPException(
            status_code=status.HTTP_401_UNAUTHORIZED,
            detail="Invalid authentication token"
        )
    return credentials.credentials

# Protected endpoint example
@app.post("/api/reports", dependencies=[Depends(verify_token)])
async def create_report_protected(report: ReportCreate, db: Session = Depends(get_db)):
    # Existing logic
    pass

Custom PDF Styling

# backend/main.py - Modify PDF generation
from playwright.async_api import async_playwright

async def generate_pdf_custom(report_html: str, output_path: str):
    """Generate PDF with custom styling"""
    async with async_playwright() as p:
        browser = await p.chromium.launch()
        page = await browser.new_page()
        
        # Inject custom CSS
        custom_css = """
        <style>
            @page { 
                size: A4; 
                margin: 20mm;
                @top-center {
                    content: "CONFIDENTIAL - Internal Use Only";
                    color: red;
                    font-size: 10pt;
                }
            }
            body { 
                font-family: 'Arial', sans-serif;
                line-height: 1.6;
            }
            .severity-critical { 
                background: #dc3545;
                color: white;
                padding: 8px;
                border-radius: 4px;
            }
        </style>
        """
        
        full_html = custom_css + report_html
        await page.set_content(full_html)
        
        await page.pdf(
            path=output_path,
            format='A4',
            print_background=True,
            display_header_footer=True,
            header_template='<div style="font-size:10px; text-align:center; width:100%;">Pentestify Report</div>',
            footer_template='<div style="font-size:10px; text-align:center; width:100%;"><span class="pageNumber"></span> / <span class="totalPages"></span></div>'
        )
        
        await browser.close()

Frontend Integration Examples

Calling the API from JavaScript

// js/app.js example patterns

// Create new report
async function createReport(reportData) {
    try {
        const response = await fetch('/api/reports', {
            method: 'POST',
            headers: {
                'Content-Type': 'application/json',
            },
            body: JSON.stringify(reportData)
        });