Automating the assessment workflow: scripts, templates and reproducibility
You turn repetitive assessment work into scripts with a scope guard, automate how findings and evidence are kept, compare two assessments and generate reports from templates.
Level 401 · 14 lessons · 12 practice labs
Lessons
Scripting repetitive work
- What to automate and what to do by hand
- A Bash scan wrapper driven by a scope file
- Parsing scan output with Python: XML and JSON
- A scope guard: blocking requests to out-of-scope addresses
- Short task: write a script that reads the scope file and scans only authorised targets
Keeping findings and evidence in order
- A findings library: templates for recurring findings
- Collecting evidence automatically: timestamped output folders
- Comparing two assessments: new, closed and open findings
- Generating reports from templates: Markdown to PDF
- Short task: write a script that reports the difference between the previous and the new scan
Safe automation
- Rate and safety limits: automation must not disrupt services
- Storing credentials used by tools safely
- Scheduling regular checks: cron and a job queue
- Capstone: build an end-to-end automated assessment pipeline from scope to report
Practice labs
- Write a Bash wrapper that scans from a scope file: Write a simple scan script that reads addresses from the scope file and produces a dated output file for each, and run it on the lab network.
- Add a guard that blocks requests to out-of-scope addresses: Add scope and deny-list checks to the script, deliberately try an out-of-scope address and show it is refused.
- Parse scan XML output with Python into an inventory: Write a Python script that extracts address, port, service and version from the lab scan XML and produces a CSV inventory.
- Create a template for a recurring finding: Write a finding template with variable fields for a common misconfiguration and fill it with a lab finding.
- Collect evidence automatically into timestamped folders: Write a helper script that saves each command's output into a timestamped folder and updates the hash list.
- Generate a Markdown report from finding templates: Write a script that merges the lab findings' JSON records with templates to produce a Markdown report and a PDF.
- Write a script that reports ports opened between two scans: Write a short script that compares two scan outputs and lists only newly opened ports, and test it on lab data.
- Separate new, closed and ongoing findings between two assessments: Write a script that compares old and new finding lists and reports the three states in separate tables.
- Raise an alert for an unexpected change in the inventory: Build a flow that diffs scheduled scans and writes an alert file for any new service not on the approved change list.
- Put rate and time limits on an automated scan: Add packet rate and allowed-hours checks to the scan script and show it does not run outside the allowed hours.
- Remove credentials from tooling scripts and store them safely: Move the API key embedded in the script to a protected file or secret store and check no trace is left in the repository.
- Build an end-to-end automated assessment pipeline from scope to report: Run a scheduled pipeline on the lab network combining scope checks, rate-limited scanning, diffing and report generation.
About this course
You turn repetitive assessment work into scripts with a scope guard, automate how findings and evidence are kept, compare two assessments and generate reports from templates.
What you will learn
- Scripting repetitive work
- Keeping findings and evidence in order
- Safe automation
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.