pentool - A modern, console-based web penetration testing to

项目说明

⚡ Pentool — AI-Powered Web Pentesting, Right in Your Terminal

> Fast, easy, lightweight. An AI assistant drives your pentest in the terminal —
> picks the right checks, bypasses WAF, finds hidden endpoints. No heavy IDE, no lag.

![PyPI ]()
![Python ]()
![CI]()
![Downloads]()

🌐 Languages: English · Русский · 中文 · हिन्दी

---

Pentool is a terminal-based (TUI) security tool for penetration testers and security researchers.
It combines HTTP interception, scanning, automated attacks, AI assistance, and data analysis — all inside your terminal.
Fast, transparent, and built for real-world testing.

Your AI in the loop: point it at a URL once and Pentool spins up the proxy, generates + imports
a trusted CA cert into a headless browser, sends the first request, and fills the project — so you
can start auditing immediately. No lag, no hea.

> ⚠️ Use a modern terminal emulator. Pentool's TUI relies on mouse support, true color, and modern rendering (built on the Textual framework). Legacy terminals (e.g. Windows cmd.exe) will render incorrectly. Recommended: Windows Terminal, iTerm2 (macOS), GNOME Terminal / Kitty / Alacritty / WezTerm (Linux). On Windows, running inside WSL gives the best experience.

---

🎬 O

!Pentool demo

---

✨ Features

🌐 Proxy

Intercept and modify HTTP/HTTPS traffic in real time. Manage scope, apply Match & Replace rules, capture WebSocket messages.

🔄 Repeater

Replay requests with any modifications. Save tabs between sessions and switch between scenarios instantly.

💥 Intruder

Run automated payload attacks with four strategies: Sniper, Battering Ram, Pitchfork, Cluster Bomb.
Turbo Mode (PRO) delivers 10× speed and connection pooling.

🔍 Scanner

Active and passi analysis: SQLi, XSS, SSTI, LFI, RCE, SSRF, XXE, CORS, JWT flaws, and more.
Smart context-aware payloads, WAF bypass, time-based and boolean-blind techniques.

🕷 Spider

Crawl targets automatically — collect pages, forms, API endpoints, and JS files.
Ja rendering supported (Lightpanda — fast & lightweight, built-in).

🎯 Target / Site Map

Build a site map from proxy traffic, manage testing scope, and filter hosts directly from the UI.

🔐 Decoder · Comparer · Sequencer

- Decoder — 19 encode/decode/hash operations with chaining support
- Comparer — side-by-side diff with change highlighting
- Sequencer — entropy analysis of tokens (sessions, CSRF, JWT) with FIPS tests

🧩 Plugin System

Extend functionality without touching the core. PRO plugins add ad scanners, smart payloads, and report generators.

⚡ Async Core

Fully async engine handles thousands of concurrent connections and hundreds of requests per second.

📦 One-line Install

uv tool install pentool — no complex setup, works on Linux, macOS, and Windows (WSL).

🆓 Open Source + PRO Extensions

The base is free and open. PRO extensions unlock exclusi and support the project.

---

🚀 Quick Start

---

🤖 CI/CD — Headless Security Scanning

Pentool runs fully headless for CI/CD pipelines. See the full CI/CD Guide.

CLI Flags for CI/CD

| Flag | Default | Description |
|------|---------|-------------|
| --url URL | required | Target URL (repeatable) |
| --headless | — | Run without TUI |
| --output PATH | — | Sa |
| --check NAMES | all | Comma-separated checks |
| --threads N | 10 | Parallel threads |
| --delay SEC | 0.0 | Request delay |
| --use-ai | — | AI-assisted scanning |
| --crawl | — | Crawl before scan |
| --depth N | 3 | Crawl depth |
| --max-pages N | 100 | Max pages |
| --format FMT | auto | Report format (json/html/csv) |

Full examples and a ready-to-copy GitHub Actions / GitLab CI template —
see the CI/CD Guide.

---

📚 Documentation

🚀 First Run: Certificate & First Intercept — start here

Quick Start Guide

User Guide

CI/CD Guide (headless)

Installation

Plugin De

Plugin API Reference

Full docs: pentool.pro

---

🧪 Beta / Testing Mode

> Pentool is currently in public beta.
> All free modules are fully functional. PRO features are actively being built — a 14-day trial is a so you can e e upfront.

🎙 For Bloggers & Content Creators

Running a security blog, YouTube channel, or
Write an honest review and recommend Pentool to your audience — we'll give you a permanent PRO license, completely free.

No minimum follower count. We value quality o.
→ Reach out: on

---

💰 Support the Project

Pentool is built and maintained by a solo de in spare time.
If it saves you hours on a pentest — consider giving back. Every contribution directly funds new features, fixes, and faster releases.

⭐ Star on GitHub — free, takes 2 seconds, helps enormously

💸 Sponsor the project — $5 (indi) or $50 (company, includes logo placement)

🔑 PRO license — $29 beta price — early access + lifetime loyalty discount

💬 Share — tell a colleague, post a review, or mention Pentool in your writeups

> Building tools is lonely work. A star or a kind word genuinely matters. Thank you. 🙏

---

🤝 Contributing

Contributions are welcome!
Please read CONTRIBUTING.md before opening a PR.

---

🙏 Acknowledgments

Special thanks to:

codeby.net — For community support and feedback

---

📄 License

Distributed under the AGPL-3.0 license. See LICENSE for details.
PRO extensions are a under a commercial license.

---

📬 Contact

Website: pentool.pro

t.me/pentool_pro

Email:

Author: Anatoly Kashtano)

---

⭐ If Pentool saves you time, a GitHub star helps the project grow — thanks!

项目信息

开发语言：Python

Star 数：8

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A modern, console-based web penetration testing toolkit with a TUI. Features an HTTP/HTTPS proxy, active/passive vulnerability scanner, Repeater, Intruder, Spider, and more. Free & open-source.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。