Abstract:
Internal computer networks are behind modern organizations and host critical ser vices, sensitive information and internal means of communication; However, these networks are often the victim of attackers exploiting misconfigurations, unpatched weaknesses and poor internal security practices. While powerful open source penetra tion testing tools e.g. Nmap, Metasploit, Wireshark/Tshark, Bloodhound exist, they are mostly command line driven requiring advanced technical skills, and making them relatively hard to adopt for smaller organisations and beginners This Project brings a GUI-Based Internal Network Penetration Testing Tool that combines a variety of already successful security tools under one unified and easy-to-use interface. The system is implemented in the Python language using the PyQt5 framework and is de veloped to fix the Kali Linux. It supports the host and port scanning through Nmap, vulnerability exploiting through the Metasploit Framework, Tshark packet capturing, optional Active Directory path analysis using BloodHound, and centralised logging using report generation (SQLite, and export to the web in the form of an .html file). The tool that has been implemented automates typical penetration testing workflows, such as scanning internal hosts, finding exposed services, searching and launching rele vant Metasploit modules, network traffic monitoring and risk-aware report generation. A controlled virtual lab was set up using a Kali Linux (attacker machine) and Win dows 10 victim system that has a vulnerable Icecast service running on it. The tool was able to successfully detect the vulnerable service - it automatically identified the correct Metasploit module, and set a working exploit succeeded in getting a Meter preter session Testing and evaluation revealed that the system makes the system more usable, lowers the dependency on manual command line operations, and provides an integrated view to internal network security posture. The work involved in the project proves that complex penetration testing flows can be encapsulated within a GUI, mak ing it possible to more internally assess networks easy and affordable, particularly for small-sized organizations and cybersecurity students.
