Releases: https://github.com/cjlfilm/Offline-Pentest-Script/releases

offline_pentest.py

An adaptive, read-only network assessment tool for internal networks. It discovers hosts, fingerprints OS/vendor/platform, identifies services — including VPN endpoints, Tor nodes, Kubernetes/OpenShift clusters, hypervisor/container management APIs, and common databases/coordination services — and produces a findings report with severities. Nothing is exploited and no credentials are guessed anywhere in the tool.

Requirements

Required

• Linux, any distribution
• Python 3.9 or later — standard library only, no pip install needed for anything
• nmap — the only hard dependency; the script will not start without it
• root / sudo — not strictly enforced, but SYN scanning (-sS) and OS fingerprinting (-O) need raw sockets. Without root the script prints a warning and Nmap falls back to slower, less reliable connect-scan methods.

Optional (each is detected individually; missing tools are skipped gracefully, not fatal)

Tool	Used for	Debian/Ubuntu	Fedora/RHEL	Arch
curl	HTTP(S) probing, URL crawling, K8s/hypervisor endpoint checks	apt install curl	dnf install curl	pacman -S curl
openssl	TLS certificate/cipher inspection	apt install openssl	dnf install openssl	pacman -S openssl
dig	reverse DNS (preferred)	apt install dnsutils	dnf install bind-utils	pacman -S bind
nslookup	reverse DNS (fallback if dig missing)	apt install dnsutils	dnf install bind-utils	pacman -S bind
smbclient	anonymous SMB session/share checks	apt install smbclient	dnf install samba-client	pacman -S smbclient
enum4linux-ng	deeper SMB enumeration (--mode deep/intrusive)	see project's GitHub (not in all repos)	same	same
rpcinfo	RPC portmapper enumeration	apt install rpcbind	dnf install rpcbind	pacman -S rpcbind
showmount	NFS export listing	apt install nfs-common	dnf install nfs-utils	pacman -S nfs-utils
nbtscan	NetBIOS name resolution	apt install nbtscan	dnf install nbtscan (EPEL)	AUR
snmpget	SNMP probing (needs OFFLINE_PENTEST_SNMP_COMMUNITY env var set)	apt install snmp	dnf install net-snmp-utils	pacman -S net-snmp

One-line install for the common case (Debian/Ubuntu):

sudo apt install nmap curl openssl dnsutils smbclient rpcbind nfs-common nbtscan snmp

Nothing else is needed. All of the VPN, Tor, Kubernetes/OpenShift, hypervisor/container, and database protocol probes are implemented directly in Python using raw sockets and TLS — they need no oc/kubectl, no VPN client, no Tor client, no database client, no Docker/Podman CLI. curl is only used because it was simpler than reimplementing HTTP parsing in the standard library.

Check what's actually installed on your system at any time with:

./offline_pentest.py --tools

This also lists several tools (arp-scan, fping, ip, ss, snmpwalk, snmp-check, ldapsearch, netexec/nxc, smbmap, redis-cli, psql, mysql) that the script does not itself execute — they're suggestions attached to device-classification profiles for your own manual follow-up, not run automatically.

Quick start

sudo ./offline_pentest.py 192.168.1.0/24

See TLDR.md for a one-page cheat sheet, and offline_pentest_manual.md for the full usage manual with examples.

What it does

1. Discovery — finds live hosts on the target range.
2. Port scanning — common TCP ports by default (--full-tcp for all 65535), targeted UDP including VPN ports.
3. OS/vendor/platform fingerprinting — via Nmap -O, capturing every returned match rather than just the top guess, plus a dedicated classifier that reconciles Nmap evidence, service banners, and TLS certificates.
4. Fallback role identification — for hosts Nmap can't classify, sends non-authenticating protocol probes to work out what the host actually does: SNMP, NetBIOS, RDP, LDAP/Active Directory, Redis, PostgreSQL, MySQL, RPC portmapper, VPN protocols (OpenVPN, WireGuard, IKEv2/IPsec, L2TP, PPTP), Tor (SOCKS5, control port), databases and coordination services (MongoDB, etcd, Consul, Elasticsearch, CouchDB, RabbitMQ, ZooKeeper), anonymous FTP, and rsync module listing.
5. OpenShift/Kubernetes probe (--mode deep/intrusive only) — confirms a cluster via standard, intentionally-public discovery endpoints and maps OpenShift ingress routes.
6. Hypervisor/container audit — confirms unauthenticated management APIs on Proxmox, ESXi, Docker, Podman, unRAID, XenServer, KVM/libvirt, Nutanix AHV/Prism, oVirt/RHV, and OpenStack Keystone.
7. Adaptive read-only checks — SMB share listing, NFS export listing (graded by exposure), URL crawling of discovered web services with secret-pattern detection (API keys, tokens, private keys — values are hashed, never stored raw).
8. Reports — JSON (for scripting/archival), per-host text, and an HTML report with a sortable, filterable index.

Design principles

• Read-only and non-authenticating. Every probe is a single, standard, unauthenticated request or protocol handshake — nothing is exploited, no credentials are sent or guessed, no destructive action is ever taken.
• Honest about confidence. Where something can't be confirmed (e.g. a RADIUS or WireGuard server correctly staying silent to an unrecognized client, per their protocol design), the report says so explicitly instead of guessing. Findings distinguish "confirmed unauthenticated" from "reachable, authentication required" from "weak signal, port only."
• Traceable. Every finding's evidence is something actually observed, logged to raw/ for independent verification.

Output layout

offline_pentest_report/<timestamp>_<ip>.<mask>/
├── report.json              # machine-readable: metadata + every host's full profile/findings
├── reports/
│   ├── index.html           # start here — sortable host inventory, collapsible findings by severity
│   ├── summary.txt
│   └── <ip>.html / <ip>.txt # one pair per host
└── raw/                      # raw probe/tool transcripts, per host, for verifying any finding yourself

The run directory name is YYYYMMDDThhmmss_<ip>.<mask> (or a sanitized version of the target if it wasn't a plain IP/CIDR). The parent output folder defaults to ./offline_pentest_report, changeable with -o/--output.

Command-line reference

sudo ./offline_pentest.py <target> [options]

<target> accepts anything Nmap accepts — a single IP, CIDR, hyphen range, comma list, or hostname.

Flag	Purpose
--mode {quick,deep,intrusive}	scan depth (default quick)
--workers N	concurrent host scanners (default 10)
-e, --interface IFACE	scan through a specific network interface
-o, --output DIR	parent directory for reports (default ./offline_pentest_report)
--timeout N	per-command timeout
--full-tcp	scan all 65535 TCP ports instead of the common-port list
--no-udp	skip UDP scanning
--no-nse	skip Nmap NSE scripts
--no-role-probe	disable fallback active protocol probing on unidentified hosts
--no-url-crawl	disable the read-only URL crawler
--url-crawl-pages N	cap pages crawled per host (default scales with --mode)
--no-k8s-probe	disable OpenShift/Kubernetes probing (deep/intrusive only to begin with)
--openshift-apps-domain DOMAIN	supply the cluster's *.apps. domain directly instead of guessing it
--no-hypervisor-probe	disable the hypervisor/container audit
--tools	list which optional external tools are installed
--profiles	list the built-in device-classification profiles
-v, --verbose	print every command as it runs
--version	print the version and exit

Scan modes

Mode	What's different
quick (default)	common ports, standard NSE scripts, fallback role probing, hypervisor/container audit
deep	adds the OpenShift/Kubernetes probe; --full-tcp becomes meaningful; more NSE scripts
intrusive	adds heavier NSE scripts — SMB share/user enumeration, HTTP vulnerability checks

Use intrusive only on networks you're explicitly authorized to test that aggressively.

Severity scale

Severity	Meaning
CRITICAL	Confirmed, serious exposure (e.g. an unauthenticated database/API with full read/write access)
HIGH	Confirmed exposure with a credible real-world impact (e.g. anonymous FTP login, a deprecated VPN protocol)
MEDIUM	A real but lower-impact exposure, or something confirmed-present that needs the admin's judgment
LOW	Minor hardening gap
INFO	Identification/informational — not itself a vulnerability

Changelog

See offline_pentest_changelog.md for the full version history.

License / authorization

This tool performs active network scanning. Only run it against networks and hosts you are explicitly authorized to test.