PenTestDB

NOTE: This project is still in development. The CLI may change.

PenTestDB parses the output of various pentesting commands and then stores that data in an SQL database for later reference. The advantage of this is when working in large networks, or with many hosts, it can be easy to lose information. With this tool, the pentester can use SQL queries to sort through all the information they have found about the targets. For Example, which known and scanned hosts have port 80/TCP (HTTP) open? The pentester can use an SQL query like this: SELECT host FROM ports WHERE port = '80' AND protocol = 'TCP'; to answer that question. PenTestDB supports plug-ins so you can write your own parser for custom commands or scripts, or if there just isn't a parser for a program you use.

Dependencies

• GNU script
• PostgreSQL
• python3 (if using the built-in parsers)

Running Tests

on the first run, the container needs to be built so run docker-compose build; docker-compose up --exit-code-from ptdb-test. on subsequent runs, you only need to run the command, docker-compose up --exit-code-from ptdb-test. see here for more.

Installing

from source:

1. Install and configure PostgreSQL.
2. clone this repo.
3. run the install script from this repo's root.
4. source the shell/start.sh script from your shells rc file. (NOTE: This is not currently compatible with fish.)
5. start the PostgreSQL
6. hack

To see more installation options and instructions go to the installtion section of the wiki

Configuring

To see a full and indepth look at configurations, go to the configuration section of the wiki.

but the TL;DR is:

1. copy /etc/ptdb/.config/ptdb/ (or /etc/skel/.config/ptdb/) to ~/.config/ptdb.
2. copy /etc/ptdb/ptdb_start.sh (or /etc/skel/.ptdb_start.sh) to ~/.ptdb_start.sh.
3. run ptdb engagement --new <engagement name> --server default --active to create a new engagement.
4. edit the default database acourding to your needs. the default database is located at .config/ptdb/db-servers/default.toml.

Usage

run queries examples:

• ptdb query --get port state service version --from hosts --where "ip = '192.168.1.42'" "state = 'open'": Requests the ports along with the corresponding states, services, and versions for all open ports on the machine with the IP address 192.168.1.42. The equivalent SQL query would be SELECT port state service version FROM machines JOIN dns_names ON machines.id = dns_names.machine_uid JOIN ports ON machines.id = ports.machine_uid WHERE ip = '192.168.1.42' AND state = 'open';.
• ptdb query --query "SELECT port state service version FROM machines JOIN dns_names ON machines.id = dns_names.machine_uid JOIN ports ON machines.id = ports.machine_uid WHERE ip = '192.168.1.42' AND state = 'open';": Makes the SQL query specified by --query.
• ptdb pause to pause locally (or add --global to the command to pause all sessions.)
• ptdb resume to resume locally (or add --global to the command to resume all sessions.)
• ptdb info will print basic info about the current state of the program.