Ceretrix · Self-hosted pentest workspace

Pentest Companion

Engagements, findings, attack paths, a 55-tool hub, scanning and client-ready reports — kept together, cross-linked, and on your own box.

Deploy it View on GitHub ↗

Self-hostedDocker or Python
AGPL-3.0Source available
REST APIAutomate anything

Live dashboard 218 findings tracked 45 / 95 tools ready

Pentest Companion dashboard: eight active engagements, 218 findings, a findings-by-severity donut and tool availability.

Everything a pentest touches — targets, ports, creds, loot, findings, evidence, timelines — kept together and cross-linked, then exported as one .pcbundle.

55: curated tools
10: categories
2,400+: finding templates
7: PTES phases tracked

The tour

Eight screens. Same workspace.

Real interface, scroll to move through it →

01 / 08

Command centre

Every engagement, live severity mix and tool readiness the moment you log in. Import a bundle, spin up a new engagement, done.

Severity donut
Tool availability
.pcbundle import

Dashboard with engagement cards, findings-by-severity donut and a 45/95 tool-availability meter.

02 / 08

The engagement workspace

Targets, open ports, the seven-phase PTES checklist, a credential vault and loot — one screen per engagement, nothing scattered across notebooks.

Targets & ports
PTES checklist
Credential vault

Engagement detail view showing targets, ports and progress.

03 / 08

Timelines & loot

A running timeline and time log per engagement, with loot organised where you can find it again — and evidence attached to the finding it proves.

Timeline
Time logging
Loot organiser

Engagement view showing timeline and loot organisation.

04 / 08

Findings that write themselves

CVSS v3.1 scoring, evidence uploads, CVE/CWE lookups and a 2,400-plus template library with cross-engagement dedupe. Bulk-import from Nessus and Burp.

CVSS v3.1
2,400+ templates
Nessus / Burp import

Findings library with CVSS scoring and template catalogue.

05 / 08

See the path to Domain Admin

An interactive Cytoscape graph of hosts, users, credentials and services, edges labelled with the technique. Click highlight paths to goal and it lights the shortest route.

Interactive graph
Technique edges
Path to goal

Attack-path graph with identity, host and objective nodes and a highlighted route to Administrator.

06 / 08

Fifty-five tools, auto-discovered

A hub of curated tools across ten categories. It finds the binaries already installed, marks them ready, and streams live output straight into the engagement.

Auto-discovery
Live output
10 categories

Tools hub with Windows/AD, Impacket and Password categories, each tool marked ready.

07 / 08

Passive web scanner

TLS, headers, cookies, CORS, HTTP methods, exposed files and tech fingerprinting — graded A–F, with scan comparison over time. Built in, plus a Kali-tools bridge.

A–F grading
TLS · headers · CORS
Scan diff

Web scanner with HTTP Security Scanner, TerminatorZ and Kali Tools options and a target URL field.

08 / 08

Pipe your shell straight in

Add | pclog to any command and the output lands in the engagement as a session — with full ANSI replay, rendered or raw, and one-click download.

pclog sessions
ANSI replay
API tokens

Terminal logging: an nmap run piped through pclog and replayed inside the engagement.

Capabilities

Most of what it does,
screen by screen becomes system.

Engagement management

Targets, ports, PTES checklists, credential vaults, loot, timelines and time logging — the whole engagement in one place, exported as a portable .pcbundle.

Seven-phase PTES
Credential vault
.pcbundle export/import

Findings & evidence

CVSS v3.1 scoring, evidence uploads, CVE/CWE lookups, confidence and false-positive flags, and a 2,400+ template library with cross-engagement dedupe.

2,400+ templates
Nessus & Burp import
CVE / CWE lookups

Attack paths & tooling

Cytoscape graphs of hosts, users, creds and services with technique-labelled edges, alongside a 55-tool hub that auto-discovers binaries and streams live output.

Path-to-goal highlighting
55 tools, 10 categories
Live output streaming

Scanning & automation

A passive web scanner graded A–F, auto-scan rules that match ports and services, finding triggers, false-positive suppression and scheduled recurring scans.

TLS · headers · CORS
Auto-scan rules
Scheduled scans

Reporting & sharing

DOCX and PDF with custom branding, executive summaries, technical sections and per-engagement redaction — plus token-based, read-only client portals.

DOCX & PDF
Per-engagement redaction
Client portals

Team, API & the rest

Role-based access, TOTP MFA and audit logging; a REST API and Slack/Discord/Teams webhooks; playbooks, exam mode, notes, a hash identifier and a Base64 codec.

RBAC & TOTP MFA
REST API & webhooks
Exam mode

Tools hub

55 tools across ten categories.
The ones you have, marked ready.

AD / Windows 17

BloodHound · Evil-WinRM · NetExec · LDAPSearch · SMBMap

Impacket 8

GetNPUsers · GetUserSPNs · PSExec · SecretsDump

Password attacks 11

Hashcat · Hydra · John the Ripper · Medusa

Web

Nikto · Gobuster · WPScan

Network

Nmap · service & port discovery

DNS

Enumeration & zone checks

SSL / TLS

Certificate & cipher analysis

OSINT

Recon & exposure discovery

Linux

Privilege-escalation checks

Custom

Run it

Self-hosted in a couple of minutes.

Your data stays on your box. Docker is the quick path; a plain Python venv works too.

docker — recommended

# clone, seed a secret, bring it up
$ git clone https://github.com/Poellie01/PentestCompanion.git
$ cd PentestCompanion
$ cp .env.example .env
$ docker compose up -d
→ http://localhost:5000

python — venv

$ git clone https://github.com/Poellie01/PentestCompanion.git
$ cd PentestCompanion
$ python3 -m venv venv && source venv/bin/activate
$ pip install -r requirements.txt
$ python app.py
→ http://localhost:5000

Get it on GitHub ↗ First run bootstraps an admin login.

Get it

Run it on your own box.

Free and source-available under AGPL-3.0. Clone it, bring it up, and keep every artifact of every engagement in one place.

View on GitHub ↗

Pentest Companion · a Ceretrix tool · AGPL-3.0, commercial licensing from info@ceretrix.net · Ceretrix engagements