🛡️ Security Engineering — Penetration Testing Toolkit (Defensive / Professional) Demo

• A five-phase **methodology** (pre-engagement → recon → scan → analyze → report).
• **Scope-enforcing, dry-run-by-default wrappers** around standard tools (`nmap`,
• A correct, standalone **CVSS v3.1 calculator** so every finding is scored
• A **report generator** that turns a findings file into a clean Markdown report.
• Ready-to-fill **Rules of Engagement, findings, and report templates**.
• **Engagement checklists** that gate each phase.

# 1) Score a finding with CVSS v3.1:
python3 src/cvss.py "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
#    -> 9.8  Critical

# 2) Verify a target against your scope (self-test the guard on the example):
python3 src/scope_guard.py

# 3) Dry-run a scope-checked nmap discovery (prints the command; does NOT run):
python3 src/wrappers/nmap_wrapper.py 203.0.113.10 \
    --scope examples/scope.example.yaml

# 4) Try an out-of-scope target — the wrapper refuses:
python3 src/wrappers/nmap_wrapper.py 203.0.113.1 \
    --scope examples/scope.example.yaml        # REFUSED: not in scope

# 5) Generate a report from findings data:
python3 src/report_generator.py examples/findings.example.json -o my-report.md

# 6) Preflight guardrail (bash):
bash scripts/preflight_scope_check.sh 203.0.113.10 examples/scope.example.yaml

penetration-testing-toolkit/
├── README.md                          # This file
├── LICENSE                            # MIT
├── docs/
│   ├── methodology.md                 # The five-phase defensive workflow
│   ├── rules-of-engagement.md         # Why/how of authorization & scope
│   ├── cvss-v3.1-scoring-guide.md     # Read and apply CVSS v3.1 Base scores
│   ├── engagement-checklist.md        # Phase-gated start-to-finish run sheet
│   └── reporting-guide.md             # How to write findings and the report
├── src/
│   ├── cvss.py                        # CVSS v3.1 Base calculator (CLI + import)
│   ├── scope_guard.py                 # Authorization core; deny-wins scope check
│   ├── report_generator.py            # Findings JSON -> Markdown report
│   └── wrappers/
│       ├── common.py                  # Shared safety plumbing (dry-run, logging)
│       ├── nmap_wrapper.py            # Scope-checked host/service discovery
│       ├── nikto_wrapper.py           # Scope-checked web config checks
│       └── testssl_wrapper.py         # Scope-checked TLS/SSL assessment
├── scripts/
│   └── preflight_scope_check.sh       # Bash scope guardrail before testing
├── templates/
│   ├── rules-of-engagement-template.md   # Fill-in authorization document
│   ├── findings-template.md           # One block per finding
│   └── report-template.md             # Full report skeleton
└── examples/
    ├── scope.example.yaml             # Example authorized scope (RFC 5737)
    ├── findings.example.json          # Example findings dataset
    └── sample-report.md               # The report generated from that dataset