Pegasus-Pentest-Arsenal - A Comprehensive Web Application Security Testing Toolkit That Combines 10 Powerful Penetration Testing Features Into One Tool
/\
_ / |
/ \ | \
| |\| |
| | | /
| /| |/
|/ |/
,/; ; ;
,'/|; ,/,/,
,'/ |;/,/,/,/|
,/; |;|/,/,/,/,/|
,/'; |;|,/,/,/,/,/|
,/'; |;|/,/,/,/,/,/|,
/ ; |;|,/,/,/,/,/,/|
/ ,'; |;|/,/,/,/,/,/,/|
/,/'; |;|,/,/,/,/,/,/,/|
/;/ '; |;|/,/,/,/,/,/,/,/|
██████╗ ███████╗ ██████╗ █████╗ ███████╗██╗ ██╗███████╗
██╔══██╗██╔════╝██╔════╝ ██╔══██╗██╔════╝██║ ██║██╔════╝
██████╔╝█████╗ ██║ ███╗███████║███████╗██║ ██║███████╗
██╔═══╝ ██╔══╝ ██║ ██║██╔══██║╚════██║██║ ██║╚════██║
██║ ███████╗╚██████╔╝██║ ██║███████║╚██████╔╝███████║
╚═╝ ╚══════╝ ╚═════╝ ╚═╝ ╚═╝╚══════╝ ╚═════╝ ╚══════╝
P E N T E S T A R S E N A L
A comprehensive web application security testing toolkit that combines 10 powerful penetration testing features into one tool.
Author
* Letda Kes Dr. Sobri, S.Kom
* GitHub: sobri3195
* Email: muhammadsobrimaulana31@gmail.com
Features
* Subdomain + Curl HTTP Scanner
* Discovers subdomains using a wordlist
* Checks HTTP status and security headers
*
Identifies potential security Misconfigurations" title="Misconfigurations">misconfigurations
*
JWT Token Inspector * Analyzes JWT token structure and claims
* Identifies security issues in token configuration
*
Detects common JWT vulnerabilities
*
Parameter Pollution Finder * Tests for HTTP Parameter Pollution (HPP)
* Identifies vulnerable parameters
*
Detects server-side parameter handling issues
*
CORS Misconfiguration Scanner * Tests for CORS policy misconfigurations
* Identifies dangerous wildcard policies
*
Detects credential exposure risks
*
Upload Bypass Tester * Tests file upload restrictions
* Attempts various bypass techniques
*
Identifies dangerous file type handling
*
Exposed .git Directory Finder * Scans for exposed version control files
* Identifies leaked Git repositories
*
Tests for sensitive information disclosure
*
SSRF (Server Side Request Forgery) Detector * Tests for SSRF vulnerabilities
* Identifies vulnerable parameters
*
Includes cloud metadata endpoint tests
*
Blind SQL Injection Time Delay Detector * Tests for time-based SQL injection
* Supports multiple database types
*
Identifies injectable parameters
*
Local File Inclusion (LFI) Mapper * Tests for LFI vulnerabilities
* Includes path traversal detection
*
Supports various encoding bypasses
*
Web Application Firewall (WAF) Fingerprinter
* Identifies WAF presence
* Detects WAF vendor/type
* Tests WAF effectiveness
Installation
* Clone the repository:
git clone https://github.com/sobri3195/pegasus-pentest-arsenal.git
cd pegasus-pentest-arsenal
* Create a virtual environment (recommended):
python -m venv venv
source venv/bin/activate # On Windows: venv\Scripts\activate
* Install dependencies:
pip install -r requirements.txt
Usage
* Run the main script:
python pegasus_pentest.py
* Select a tool from the menu (1-10)
* Follow the prompts to enter target information
* Review the results
Requirements
* Python 3.8+
* Required packages (see requirements.txt):
* requests
* httpx
* urllib3
* colorama
* pyjwt
* beautifulsoup4
Security Considerations
* This tool is for educational and authorized testing purposes only
* Always obtain proper authorization before testing any target
* Some features may trigger security alerts or be blocked by security controls
* Use responsibly and ethically
Contributing
* Fork the repository
* Create a feature branch
* Commit your changes
* Push to the branch
* Create a Pull Request
License
This project is licensed under the MIT License - see the LICENSE file for details.
Disclaimer
This tool is provided for educational and authorized testing purposes only. Users are responsible for obtaining proper authorization before testing any target. The authors are not responsible for any misuse or damage caused by this tool.
Download Pegasus-Pentest-Arsenal
