Scripting and Automation for PenTest

Scripting and automation refer to the use of programming or shell scripting languages to automate repetitive tasks during a penetration test. Instead of manually running each tool, parsing output, and deciding next steps, a tester writes a script that orchestrates the entire workflow. This is critical for efficiency, consistency, and scalability. The PT0-002 exam expects you to understand how to write simple scripts in Bash (Linux shell) and Python, and to use regular expressions to parse and extract data from tool output.

The exam objectives explicitly state: "Given a scenario, analyze a script or automate a task." This means you must be able to read a script, understand what it does, identify errors, and modify it for a given purpose. You are not expected to write complex programs from scratch, but you must be comfortable with:

Bash is the default shell on most Linux distributions and is the primary scripting language for pen testers using Kali Linux. A Bash script is a plain text file with a .sh extension, starting with the shebang line #!/bin/bash. This tells the system to use the Bash interpreter.

Variables in Bash are untyped and assigned without spaces around =:

#!/bin/bash
target="10.0.0.1"
port=80
echo "Scanning $target on port $port"

Command substitution captures output of a command into a variable:

result=$(nmap -p $port $target)

Conditionals use if, elif, else, and fi. The test command [ ] or [[ ]] evaluates conditions:

if [ -f "$output_file" ]; then
    echo "File exists"
else
    echo "File missing"
fi

Loops include for, while, and until. Common pattern: iterate over a list of hosts:

for ip in $(cat targets.txt); do
    nmap -sS $ip
    echo "Done with $ip"
done

Functions group reusable code:

function scan_port() {
    nc -zv $1 $2
}
scan_port $target 443

Exit codes are important for error handling. 0 means success, non-zero means failure. Use $? to capture the last command's exit code.

Python is more powerful for complex automation, especially when parsing structured data (JSON, XML) or using libraries like subprocess, socket, and re. The exam expects you to understand Python scripts that call external tools and process their output.

Running system commands uses subprocess.run():

import subprocess
result = subprocess.run(["nmap", "-p", "80", "10.0.0.1"], capture_output=True, text=True)
print(result.stdout)

File I/O:

with open('targets.txt', 'r') as f:
    for line in f:
        ip = line.strip()
        print(f"Scanning {ip}")

Error handling with try/except:

try:
    result = subprocess.run(["nmap", ip], capture_output=True, timeout=30)
except subprocess.TimeoutExpired:
    print(f"Scan of {ip} timed out")

Regular expressions via the re module are critical for parsing tool output:

import re
output = "22/tcp open ssh"
match = re.search(r'(\d+)/tcp\s+(\w+)', output)
if match:
    port = match.group(1)
    state = match.group(2)
    print(f"Port {port} is {state}")

Regular expressions (regex) are patterns used to match text. The exam tests your ability to read and write simple regex patterns. Key metacharacters: - . - any single character - * - zero or more of preceding - + - one or more of preceding - ? - zero or one of preceding - ^ - start of line - $ - end of line - [abc] - character class: a, b, or c - [^abc] - negated character class: not a, b, c - \d - digit (0-9) - \w - word character (alphanumeric + underscore) - \s - whitespace - | - alternation (OR) - () - grouping

Example: Extract all IP addresses from a file:

import re
pattern = r'\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b'
with open('nmap_output.txt') as f:
    content = f.read()
    ips = re.findall(pattern, content)
    print(ips)

Common exam trap: The greedy vs non-greedy matching. By default, * and + are greedy (match as much as possible). Use *? or +? for non-greedy.

Network scanning automation: A script that takes a list of CIDR ranges, runs Nmap, and saves results per host.

#!/bin/bash
for range in $(cat ranges.txt); do
    nmap -sS -sV -O $range -oA scan_$range
done

Service enumeration: Parse Nmap output to identify web servers and run Nikto:

#!/bin/bash
for ip in $(grep "open" scan.gnmap | awk '{print $2}'); do
    ports=$(grep $ip scan.gnmap | grep -oP '\d+/open' | cut -d'/' -f1)
    for port in $ports; do
        if [ $port -eq 80 ] || [ $port -eq 443 ]; then
            nikto -h $ip -p $port
        fi
    done
done

Credential testing: Use Hydra with a list of users and passwords:

#!/bin/bash
for user in $(cat users.txt); do
    hydra -l $user -P passwords.txt ssh://target_ip
done

Report generation: Combine multiple tool outputs into a single report using Python:

import json
results = {}
# Parse Nmap XML
# Parse Nikto JSON
# Combine into final report
with open('report.json', 'w') as f:
    json.dump(results, f, indent=4)

Scripts often chain multiple tools. For example: 1. Run Nmap to discover open ports. 2. Parse output to identify services. 3. For each web service, run Nikto or Gobuster. 4. For SSH, run Hydra with common credentials. 5. Aggregate results into a CSV or JSON.

This is the essence of automation: reduce manual intervention, ensure consistency, and allow repeatability. The exam expects you to understand how to combine tools in a script.

Pattern 1: Loop through a file of targets and run a command.

while read line; do
    command $line
done < targets.txt

Pattern 2: Parse command output and act on it.

import subprocess
import re
output = subprocess.run(['nmap', '-p', '80', '10.0.0.1'], capture_output=True, text=True)
if 'open' in output.stdout:
    print('Port 80 is open')

Pattern 3: Use regex to extract data.

import re
data = "Host: 192.168.1.1 (router.local)"
match = re.search(r'Host: (\S+) \((\S+)\)', data)
if match:
    ip = match.group(1)
    hostname = match.group(2)

Pattern 4: Error handling with retries.

import time
for attempt in range(3):
    result = subprocess.run(['ping', '-c', '1', ip], capture_output=True)
    if result.returncode == 0:
        print(f'{ip} is up')
        break
    else:
        time.sleep(2)

In a typical enterprise penetration test, a tester might face 10,000+ IP addresses across multiple subnets. Manually scanning each with Nmap would take days. Instead, the tester writes a Bash script that reads a CIDR list, runs Nmap with the -sn ping sweep to discover live hosts, then feeds the live hosts into a full port scan. The script parses the .gnmap output to extract open ports and launches appropriate enumeration tools (e.g., Nikto for HTTP, Hydra for SSH) in parallel using background processes or xargs. This reduces a 40-hour manual task to a few hours of automated scanning.

Another scenario: During a web application test, the tester needs to check for common directories on hundreds of sites. A Python script using requests library iterates over a wordlist and a list of base URLs, sending GET requests and logging HTTP status codes. It uses threading to speed up the process and writes results to a CSV file. The script includes error handling for timeouts and SSL errors, and it respects robots.txt if needed. This automation catches hidden endpoints that would be missed by manual browsing.

A third scenario: Post-exploitation, the tester must extract sensitive data from multiple compromised hosts. A Python script uses paramiko to SSH into each host, runs commands to collect password hashes, configuration files, and browser history, then downloads the files via SFTP. The script logs all actions and handles connection failures gracefully. This ensures consistent data collection across dozens of hosts without manual intervention.

Common misconfigurations: Not setting timeouts causes scripts to hang indefinitely on unresponsive hosts. Hardcoded credentials in scripts can be exposed if the script is shared. Lack of logging makes debugging impossible. Over-parallelization can overwhelm the network or target. The experienced tester designs scripts with configuration files, logging, and rate limiting to avoid these issues.