<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-automated-penetration-testing
description: >-
  Implement automated penetration testing pipelines using scheduled scanning,
  vulnerability validation, safe exploitation checks, and findings correlation
  with MITRE ATT&CK mapping and remediation tracking.
domain: cybersecurity
subdomain: security-operations-automation
tags:
  - penetration-testing
  - vulnerability
  - automation
  - nuclei
  - nmap
  - attack-surface
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Implementing Automated Penetration Testing

## Overview

Automated penetration testing extends vulnerability scanning with safe
exploitation validation, attack chain simulation, and continuous testing
pipelines. This technique covers orchestrating scan tools (Nuclei, Nmap,
Nikto), correlating findings, mapping to ATT&CK, and producing actionable
reports with severity-prioritized remediation.

Mode: `[MODE: RED]` — Authorized automated offensive testing.

DETECTION OPPORTUNITIES: Automated scans generate network noise — defenders
should baseline scanner source IPs and alert on unexpected scan patterns.

## Prerequisites

| Requirement | Details |
|---|---|
| Python 3.10+ with `requests`, `subprocess` | Required |
| Nuclei templates and binary installed | Required |
| Nmap with NSE scripts | Required |
| Authorized scope definition (IP ranges, domains) | Required |

## Key Concepts

### Scan Orchestrator

```python
import subprocess
from datetime import datetime, timezone
from typing import Any


def run_nuclei_scan(
    targets: list[str],
    templates: list[str] | None = None,
    severity: str = "medium,high,critical",
) -> dict[str, Any]:
    """Run Nuclei vulnerability scanner against targets."""
    cmd = [
        "nuclei",
        "-target", ",".join(targets),
        "-severity", severity,
        "-json",
        "-silent",
    ]
    if templates:
        cmd.extend(["-t", ",".join(templates)])

    result = subprocess.run(cmd, capture_output=True, text=True, check=False)
    findings = []
    for line in result.stdout.strip().split("\n"):
        if line:
            import json
            findings.append(json.loads(line))

    return {
        "scanner": "nuclei",
        "targets": targets,
        "findings_count": len(findings),
        "findings": findings,
        "timestamp": datetime.now(timezone.utc).isoformat(),
    }
```

### Findings Correlation

```python
ATTCK_MAP: dict[str, str] = {
    "sqli": "T1190",
    "xss": "T1059.007",
    "rce": "T1059",
    "lfi": "T1083",
    "ssrf": "T1557",
    "default-credentials": "T1078.001",
    "exposed-panel": "T1133",
}


def correlate_findings(findings: list[dict[str, Any]]) -> list[dict[str, Any]]:
    """Enrich findings with ATT&CK mapping and deduplication."""
    seen: set[str] = set()
    correlated: list[dict[str, Any]] = []
    for f in findings:
        key = f"{f.get('template_id')}:{f.get('host')}"
        if key in seen:
            continue
        seen.add(key)
        tags = f.get("tags", [])
        attck_ids = [ATTCK_MAP[t] for t in tags if t in ATTCK_MAP]
        correlated.append({
            **f,
            "attck_ids": attck_ids,
            "deduplicated": True,
        })
    return correlated
```

## Workflow

### Step 1: Define Scope

```bash
node scripts/agent.js --action define-scope --targets 10.0.0.0/24
```

### Step 2: Run Automated Scan

```bash
node scripts/agent.js --action scan --severity high,critical
```

### Step 3: Generate Report

```bash
node scripts/agent.js --action report --format json
```

## Detection

```yaml
title: Automated Penetration Testing Detection
id: e4ee0f04-3e30-4772-a2c5-34e9081adfd7
status: experimental
description: Detects suspicious activity related to implementing automated penetration testing techniques in security operations automation context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*implementing*automated*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.discovery
falsepositives:
  - Orchestration platform executing approved automation workflows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Automated Penetration Testing Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1190 |

## Verification

- [ ] Scans run only against authorized scope
- [ ] Findings deduplicated and correlated across scanners
- [ ] ATT&CK IDs mapped to each finding category
- [ ] Remediation priorities assigned by severity and exploitability

## References

- [Nuclei Scanner](https://github.com/projectdiscovery/nuclei)
- [MITRE ATT&CK Framework](https://attack.mitre.org/)
- [OWASP Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)
