Offline Pentest Script 4.16.3

• Fixed: a second, separate cause of a static screen - this one right after "Discovery complete", not during discovery itself. Hostname identification (reverse DNS) ran in a plain sequential for loop over every discovered host, with no progress display and no timeout on the underlying socket.gethostbyaddr() call. On a network where most hosts have no PTR record (the norm, not the exception), each lookup could hang for several seconds on the system resolver's own retry behaviour, one host at a time - on a 50-host network that alone could be minutes of nothing visible happening. Now: (1) routed through parallel_host_scan() like every other phase, so it runs concurrently with live per-host progress, and (2) the unbounded gethostbyaddr() call is capped at 3 seconds via a joined background thread (not socket.setdefaulttimeout(), which is process-global and would have affected every other concurrently running thread's sockets too). Verified with a simulated 20-host scan where each lookup blocks for 1 second: total time dropped from a sequential 20s to a parallel ~2s.

• Fixed: the discovery phase showed nothing but a static "Discovery..." line, often for minutes on a large range, while every other phase showed live per-host progress. The underlying cause: discovery is one single, long-running Nmap command rather than a per-host loop, and Runner.run() fully buffers a command's output and returns nothing until the process exits — so there was no natural place to hook progress into. Discovery now runs behind a live elapsed-time heartbeat ([+] Discovery | running (00:42)), updating every second, with the same completion line style as every other phase.

Offline Pentest Script 4.16.1

Minor fixes and upgrades

Offline Pentest Script 4.15.0

4.15.0

• Added: nine new unauthenticated-exposure checks, all read-only, non-destructive, single-request confirmations:
  • etcd (GET /v2/keys/) — CRITICAL. Full cluster secrets/config exposure.
  • MongoDB (legacy isMaster wire-protocol handshake) — CRITICAL. Full database read/write.
  • Consul (GET /v1/status/leader) — CRITICAL. Service catalog + KV store exposure.
  • Elasticsearch (root endpoint, cluster_name/tagline check) — CRITICAL. Full index access.
  • CouchDB (GET /_all_dbs) — CRITICAL if unauthenticated, INFO if it correctly required auth.
  • RabbitMQ management API (GET /api/overview) — CRITICAL if unauthenticated, INFO if it correctly required auth.
  • ZooKeeper (ruok four-letter word) — MEDIUM. Silence is treated as inconclusive, not negative (modern ZooKeeper disables this by default).
  • Anonymous FTP login (USER anonymous / PASS) — HIGH.
  • rsync module listing (daemon protocol handshake, empty module name) — MEDIUM.
• Ports 2181, 2379, 5984, 8500 added to the scan list (MongoDB/FTP/rsync/RabbitMQ/Elasticsearch were already scanned but unconfirmed).
• Memcached (11211) deliberately excluded — avoids any possibility of the tool being used as a UDP amplification source.

Offline Pentest Script 4.14.1

4.14.1

• Fixed: on the index page, each "Assessment status" block's title ("Warnings", "Recommendations", "Info") now appears above the collapse/expand control, not below it.
• Changed: the "Host inventory" section is now collapsible (open by default), matching the other list sections.

Offline Pentest Script 4.14.0

4.14.0
— Tor detection
Added Tor service detection, ported from a standalone Tor-finder script:
9051 — PROTOCOLINFO control-port probe → HIGH if confirmed (the one genuinely strong signal)
9050 / 9150 — SOCKS5 negotiation → MEDIUM, explicitly labeled unconfirmed (SOCKS5 alone isn't proof of Tor)
8118 — HTTP proxy probe (Privoxy pairing) → INFO
9001 / 9030 / 9040 — port-open-only weak signals (ORPort/directory/transparent proxy) → INFO, can never outrank a confirmed role
Fixed a bug caught during testing: the SOCKS5 finding was wrongly chained as elif off the control-port finding, so it silently disappeared whenever both were present on the same host. Both are now independent findings.
— Adaptive phase progress display
The "Adaptive read-only checks" phase (SMB listing, NFS exports, URL crawl, etc.) was the one phase that never used the live per-host progress display the other phases have — it printed one static line and nothing until it finished. It now goes through the same parallel_host_scan() mechanism as everything else, so you see live per-host timers during this phase too.
— Index page changes
Reordered the Assessment status boxes: Warning → Recommendations → Info (was Recommendations → Warnings → Info).
Those three boxes are now collapsible (

), and expanding one lists every finding in that category with severity, title, and host IP — each item links directly to that host's report page.
Removed the "Assessment: Offline" card; replaced it with the actual scan mode used (QUICK / DEEP / INTRUSIVE).
Page title and heading changed from "Offline Pentest Assessment" to "Pentest Assessment: /" (falls back to the raw target string if it wasn't a plain IP/CIDR).

Offline Pentest Script 4.12.0

Updated reports with more collapsible items.
Added hypervisor and container platform detection.
(Proxmox, Kubernetes, Openshift, VMWare ESXi, Podman, UnRaid, Docker, WinRM)
Added VPN server detection.
(OpenVPN, WireGuard, IKEv2/IPsec, L2TP/IPsec, PPTP)

Offline Pentest Script 4.8.1

Added a url/web crawler

Offline Pentest Script 4.7.1

Reworked os/vendor/platform detection.

Offline Pentest Script 4.7.0

Updated the vendor/os detection.
Updated Role detection.