Penetration Testing Findings Generator
FreeChatGPT-powered penetration testing findings generator
FreeFree tier
About Penetration Testing Findings Generator
FinGen is an open-source penetration testing findings generator powered by ChatGPT, designed to help penetration testers save time and produce more readable findings. It generates structured findings including description, remediation, implication, risk rating (with likelihood and impact), and optional risk rating justification. The tool accepts finding titles as input and can generate multiple findings at once. It is a proof-of-concept and should not be used to write entire reports without human oversight. Requires an OpenAI API key (paid, ~1 cent per 100 findings) and is written in Python.
Key Features
Generates structured findings: Description, Remediation, Implication, Risk Rating (likelihood + impact)
Optional risk rating justification
Supports generating multiple findings at once by passing multiple titles
Customizable company name for report context
Open-source (GPL-3.0 license), written in Python
Lightweight: ~1 cent per 100 findings with OpenAI API
Pros & Cons
Pros
- Saves significant time writing repetitive findings
- Produces more readable and structured findings than manual writing
- Open source with permissive GPL-3.0 license, allowing customization
- Very low cost per finding (approximately 1 cent per 100 using GPT-3.5)
- Supports batch generation for multiple vulnerabilities
Cons
- Requires a paid OpenAI API key to use
- Generated findings must be verified and contextualized before inclusion in real reports
- Proof-of-concept tool not used internally by Stratus Security, limited support
- May require GPT-4 for best results, increasing cost
- No graphical interface; command-line only
Best For
Automating the creation of penetration testing report findingsGenerating more readable and consistent findings for security assessmentsQuickly producing draft findings for common vulnerabilities (e.g., Auto Complete Not Disabled, Blind SQL Injection, Reflected XSS)Speeding up the report writing phase for penetration testers
FAQ
How do I install FinGen?
You can install via pip: `pip3 install FinGen` then run `python3 -m FinGen --api-key "your_api_key" --title "finding title"`. Alternatively, clone the repository and run from source.
What does the OpenAI API cost to use with FinGen?
The cost is approximately 1 cent per 100 findings using GPT-3.5. OpenAI offers an $18 free trial for new users.
Can I generate multiple findings at once?
Yes, you can pass multiple --title arguments: `python3 FinGen.py --api-key "key" --title "Finding A" --title "Finding B"`.
Should I use the generated findings directly in a report?
No, you must verify the findings and add context. The tool is a proof of concept and should not be used to write entire reports without human oversight.
Is FinGen free?
Yes, the tool itself is free and open-source, but it requires a paid OpenAI API key to generate findings.