Skip to main content

Phase 5: Pentesting Tools

This is the largest phase and the core value proposition of the platform. It delivers the scan and report services, Kubernetes Job-based tool execution for four scanner types, real-time output streaming, scheduled scans, and the scan results UI.

Prerequisites

  • Phase 4 -- Domain verification must be working so that scans are only run against verified domains.
  • Phase 1 -- ClickHouse (scan metrics) and Elasticsearch (report indexing) must be deployed.

Blocks

IDBlockDescriptionAcceptance Criteria
5.1scan-service scaffolding & protoScaffold the scan-service NestJS application with gRPC transport. Define scan.proto (StartScan, GetScan, ListScans, CancelScan RPCs) and generate TypeScript stubs.Service starts, registers with the API Gateway, and responds to a health-check RPC.
5.2report-service scaffolding & protoScaffold the report-service NestJS application with gRPC transport. Define report.proto (GenerateReport, GetReport, ListReports RPCs) and generate TypeScript stubs.Service starts, registers with the API Gateway, and responds to a health-check RPC.
5.3K8s Job creation for scan workersImplement the scan-service logic that creates a Kubernetes Job for each scan request, mounts the correct scanner image, passes target and config as environment variables, and collects exit status.A StartScan call creates a K8s Job visible via kubectl get jobs; the Job runs to completion and the scan-service records its exit code.
5.4Nmap scanner container & integrationBuild a Docker image wrapping nmap with a thin entrypoint script that reads target/config from env, runs the scan, and publishes structured JSON results to NATS.An Nmap scan Job completes, publishes results to scan.results.nmap, and the scan-service persists the output.
5.5ZAP scanner container & integrationBuild a Docker image wrapping OWASP ZAP in headless mode with a similar entrypoint: env-based config, structured JSON output, NATS publish.A ZAP scan Job completes within the configured timeout, publishes results, and the scan-service persists the output.
5.6SSLyze scanner container & integrationBuild a Docker image wrapping sslyze with the same entrypoint pattern. Output includes certificate details, protocol support, and vulnerability flags.An SSLyze scan Job completes, publishes results to scan.results.sslyze, and the scan-service persists the output.
5.7DNS recon container & integrationBuild a Docker image wrapping subfinder and dnsx for subdomain enumeration and DNS record collection.A DNS recon Job completes, publishes discovered subdomains and records, and the scan-service persists the output.
5.8Real-time output streaming (WebSocket)Implement WebSocket endpoint on the API Gateway that subscribes to NATS scan output subjects and streams lines to the connected client in real time.While a scan is running, the client receives live output lines; when the scan finishes, the stream closes cleanly.
5.9Scheduled scans (cron)Add cron-based scheduling to the scan-service: users configure a cron expression per domain, and the service creates Jobs on schedule. Store schedule definitions in PostgreSQL.A scan with cron expression 0 3 * * * triggers automatically at 03:00; the next run time is displayed in the UI.
5.10Scan results UIBuild the admin portal scan pages: scan list (filterable by domain, tool, status), scan detail (raw output, parsed findings, severity badges), and report download (PDF/JSON).Users can browse, filter, and inspect scan results; findings are displayed with severity color-coding; PDF export produces a readable report.

Estimated Scope

AreaFiles / Resources
Backend servicesservices/scan-service/, services/report-service/
Proto filesproto/scan.proto, proto/report.proto
Scanner imagesscanners/nmap/Dockerfile, scanners/zap/Dockerfile, scanners/sslyze/Dockerfile, scanners/dnsrecon/Dockerfile
DatabasePostgreSQL schemas: scan, report (tables: scans, scan_results, schedules, reports)
ClickHouseTables: scan_metrics (duration, finding counts, tool type)
ElasticsearchIndex: scan-reports (full-text search over findings)
NATS subjectsscan.start, scan.cancel, scan.results.*, scan.output.*
Angular modulesadmin/src/app/scans/, admin/src/app/reports/
Kubernetesk8s/scan-service/, k8s/report-service/, RBAC for Job creation