Sangamesh.Dandin
Résumé
All projects

Case 02 / 09Pentest automationCompleted

REDTEAM COPILOT AI.

An automated recon-to-report pentest assistant.

A FastAPI service that automates the recon-to-report part of a penetration test in four fixed stages: OSINT (DNS records, a subdomain wordlist, crt.sh and WHOIS), an nmap service scan, CVE lookups against the NVD with CISA KEV escalation, and a Groq-written report rendered as a PDF and stored in Supabase. A React front end streams progress as the scan runs. CVE matches are keyword lookups to review, not confirmed vulnerabilities.

What I built

  • Built the four-stage pipeline as a FastAPI background task, streaming live progress to the React UI over server-sent events.
  • Implemented OSINT (DNS, crt.sh, WHOIS and a subdomain wordlist), nmap service scanning, and NVD CVE lookups with CISA KEV escalation.
  • Generated PDF reports with ReportLab from Groq-written analysis, stored in Supabase.
Problem
Slow manual recon
Built with
FastAPI, Groq, nmap
Result
PDF pentest reports
  • Python
  • FastAPI
  • Groq
  • nmap
  • NVD API
  • Supabase
  • React

▶Demo

See it work.

An animated walkthrough of the interface, not a screen recording. The target, findings and timings shown are example values, not a real scan.

01Architecture

How it's built.

Drawn from the project's source code, not its README: what each part actually does and how a request moves through it.

RedTeam Copilot scan pipeline and control points An operator submits a target and module toggles from the browser to an unauthenticated FastAPI endpoint that applies a string-prefix check, then a single background task runs OSINT, port scanning, CVE matching and report generation in fixed order, each summarised by a Groq model; the port scan probes whatever address the target resolves to, results and a PDF go to Supabase, and the ledger lists the three implemented controls and three limits including template-generated evidence in the PDF. WHAT EACH STAGE REACHES OUT TO OPERATOR RUN_FULL_PIPELINE · FIXED ORDER POST /API/SCAN TASK DOMAIN NMAP · TCP C3 none PRODUCT + VER SSE PROGRESS PDF + JSON SCANS ROW Operator browser C1 React · TargetForm.jsx target domain 3 module toggles (“scope”) permission checkbox reads /api/report + PDF link FastAPI scan handler C2 main.py · no authentication rejects 6 private prefixes requires a “.” in target → scan_id, background task in-memory queue for SSE 1 · subdomains OSINT DNS A / MX / TXT / CNAME 50-name subdomain list crt.sh + WHOIS 2 · ports Port scan nmap -sV --top-ports 1000 else TCP connect, 11 ports → services list 3 · cves CVE match L2 keyword search per service severity filter: HIGH KEV → CRITICAL 4 · any module on Report L1 LLM-written markdown ReportLab PDF template “Evidence” blocks Groq · llama-3.3-70b-versatile — called by every stage for analysis text; on failure the error string is returned as text Public lookups third-party services DNS resolvers crt.sh certificate log WHOIS Target host probed directly IP = gethostbyname(target) resolved IP not re-checked subdomains not scanned NVD · CISA KEV third-party services NVD CVE API 2.0, 5/service KEV JSON feed (cached) only nmap-named services STORE Supabase scans: target, status, findings JSON, pdf_url bucket: get_public_url() optional · mock URL if unset “Scope” chooses which modules run. Nothing records which hosts the operator may test. The only server-side check reads the target string; nmap then scans whatever address that name resolves to. CONTROLS AS IMPLEMENTED LIMITS FOUND IN CODE C1 Browser: the permission checkbox and domain regex only enable the button. Neither is sent to, or checked by, the API. C2 API: rejects targets starting 10. · 192.168. · 172.16. · 127. · localhost · ::1 and requires a dot. No auth, allow-list, approval step or rate limit. C3 Execution: none. A domain that resolves to a private address passes C2 and is scanned. No automated tests cover any control. L1 PDF finding cards include “Evidence” request/response text built from templates (e.g. “uid=0(root)”). No exploitation is performed. L2 CVEs are NVD keyword matches on nmap’s product string, not confirmed vulnerabilities. TCP-fallback services have no product and are skipped. L3 No engagements, agent orchestration or human-approval workflow exist. SHODAN_API_KEY is listed in .env.example but never read. LEGEND Person Code component Scan pipeline Third-party service Store Active probe of target Data / control flow Progress events HTTP C1 Control / limit

Read from the code at commit e283b6c · Open full size ↗

02Under the hood

How it works.

  1. 01

    OSINT

    DNS records, a subdomain wordlist, crt.sh and WHOIS

  2. 02

    Port scan

    nmap service scan of the top 1,000 ports

  3. 03

    CVE match

    NVD keyword lookup; CISA KEV entries escalate to critical

  4. 04

    Report

    Groq writes it up; ReportLab renders the PDF

→Up next · 03 / 09

Next project.

ByteHunter — Malware triage for Windows executables, with one model deciding the verdict.

Back to all projects