Skip to content

PEART

Pentest execution and reporting, self-hosted and offline.

PEART is an open-source tool for running penetration tests by methodology and turning the findings into client-ready reports, built to a corporate quality bar while staying open source. It runs on your own infrastructure, holds nothing in the cloud, and phones home to no one.

It is built for the people who do the work and the people who evaluate it: the pentester who records a finding once and reuses it, and the auditor or DPO who needs to see how each finding relates to a compliance control, how the evidence is protected, and how the release is built.

Start here

  • Installation — install directly on a Linux host, or with a container.
  • Getting started — from a new engagement to a released report.
  • Concepts — clients, engagements, methodologies, findings, reports.
  • Security and compliance — the threat model, encryption, supply-chain controls, and the compliance mapping, written for auditors and DPOs.

What makes it different

Self-hosted and offline, with the catalogs embedded in the binary, so it works in an isolated network. File-level encryption of evidence and backups, with cryptographic erasure per engagement that reaches even backups you no longer control. A strict content-security model built to store and display hostile payloads without ever executing them. Signed, attested releases with a full software bill of materials. And a compliance mapping that relates findings to NIST, ISO, LGPD and CIS controls without ever claiming to certify.

Language

This handbook is written in English, with a Brazilian Portuguese translation available from the language selector. Some pages are still being filled in.