Automated Penetration Analysis and Reporting Tool (APART)

Penetration testing takes time, because a series of varying tools are required and each tool generates a result which must be individually analyzed. The Penetration Application for Analyzing Data networks (PAAD) succeeded in creating an automated penetration testing tool but is lacking in its ability to run reliable penetration tests and to create reliable reports. PAAD inadequacy is due to its dependency on the user to add entries in its database which directly affects the number of vulnerabilities found by the application and the overall credibility of the report. The Automated Penetration Analysis and Reporting Tool (APART) aims to create an improved automated penetration testing tool by running standard penetration testing methods in a logical sequence. The CVE will be used as a common identifier for known security vulnerabilities and CVSS will be used for calculating the security risk of vulnerabilities. The reporting engine uses the data which was retrieved from the sequential penetration tests in order to form a penetration test report with a security risk rating and recommendations on how to mitigate the security vulnerabilities present in the system. Conclusively, this research has met its objective by successfully creating an automated penetration resting took which is capable of integrating additional penetration testing tools in the penetration testing process, as well as supplementing and analyzing the data of the penetration testing tools in order to create information to be used in a comprehensive report