Configuration Settings

Complete reference for config.json configuration file

Configuration Settings

AutoPentestX uses a centralized config.json file to manage all tool settings, scanning parameters, and behavior options. This file is located in the root directory of the application.

Configuration File Location

autopentestx/
└── config.json

Application Metadata

app_name · string · default: "AutoPentestX"

Application name displayed in reports and output

version · string · default: "1.0.0"

Current version of AutoPentestX

description · string

Application description for documentation and reports

Scan Settings

Core scanning behavior and network reconnaissance parameters.

scan_settings.default_safe_mode · boolean · default: true

Enable safe mode by default to prevent aggressive scanning

scan_settings.timeout · integer · default: 300

Scan timeout in seconds (5 minutes)

scan_settings.max_ports · integer · default: 65535

Maximum port range to scan (1-65535)

Scan Techniques

scan_settings.scan_techniques.tcp_scan · boolean · default: true

Enable TCP port scanning

scan_settings.scan_techniques.udp_scan · boolean · default: true

Enable UDP port scanning

scan_settings.scan_techniques.service_detection · boolean · default: true

Enable service version detection

scan_settings.scan_techniques.os_detection · boolean · default: true

Enable operating system fingerprinting

scan_settings.scan_techniques.version_detection · boolean · default: true

Enable detailed version detection for services

Vulnerability Scanning

Settings for web vulnerability scanners (Nikto, SQLMap).

vulnerability_scanning.nikto_enabled · boolean · default: true

Enable Nikto web server scanner

vulnerability_scanning.sqlmap_enabled · boolean · default: true

Enable SQLMap for SQL injection testing

vulnerability_scanning.nikto_timeout · integer · default: 300

Nikto scan timeout in seconds

vulnerability_scanning.sqlmap_timeout · integer · default: 180

SQLMap scan timeout in seconds

vulnerability_scanning.max_web_crawl_depth · integer · default: 2

Maximum depth for web crawling during vulnerability assessment

Web vulnerability scanning can be time-consuming. Use --skip-web flag to bypass these scans when not needed.

CVE Lookup

Configuration for CVE (Common Vulnerabilities and Exposures) database queries.

cve_lookup.enabled · boolean · default: true

Enable automatic CVE lookups for detected services

cve_lookup.api_url · string · default: "https://cve.circl.lu/api"

Primary CVE API endpoint

cve_lookup.nvd_api_url · string

NIST National Vulnerability Database API endpoint

cve_lookup.max_results_per_service · integer · default: 10

Maximum number of CVE results to retrieve per service

cve_lookup.cache_results · boolean · default: true

Cache CVE results to improve performance on repeated scans

Exploitation Settings

Controls for exploit simulation and Metasploit integration.

exploitation.safe_mode_default · boolean · default: true

Enable safe mode for exploitation (simulation only)

exploitation.metasploit_enabled · boolean · default: true

Enable Metasploit Framework integration

exploitation.max_exploit_attempts · integer · default: 5

Maximum number of exploit attempts per vulnerability

exploitation.generate_rc_scripts · boolean · default: true

Generate Metasploit resource scripts for manual exploitation

Exploitation should ONLY be performed on authorized systems. Safe mode is enabled by default and highly recommended.

Risk Scoring

Risk assessment thresholds and weighting factors.

CVSS Thresholds

risk_scoring.cvss_thresholds.critical · float

Minimum CVSS score for CRITICAL severity (9.0-10.0)

risk_scoring.cvss_thresholds.high · float

Minimum CVSS score for HIGH severity (7.0-8.9)

risk_scoring.cvss_thresholds.medium · float

Minimum CVSS score for MEDIUM severity (4.0-6.9)

risk_scoring.cvss_thresholds.low · float

Minimum CVSS score for LOW severity (0.1-3.9)

Weight Factors

risk_scoring.weight_factors.exploitable · float

Risk multiplier for exploitable vulnerabilities (2x)

risk_scoring.weight_factors.public_exploit · float

Risk multiplier when public exploits exist (1.5x)

risk_scoring.weight_factors.network_accessible · float

Risk multiplier for network-accessible services (1.3x)

risk_scoring.weight_factors.authenticated · float

Risk reducer for vulnerabilities requiring authentication (0.7x)

Reporting

Report generation settings and output formats.

reporting.format · string · default: "pdf"

Default report format (pdf, html, json)

reporting.generate_json · boolean · default: true

Generate JSON output alongside PDF report

reporting.include_screenshots · boolean · default: false

Include screenshots in reports (requires additional tools)

reporting.confidential_watermark · boolean · default: true

Add “CONFIDENTIAL” watermark to PDF reports

reporting.default_tester_name · string · default: "AutoPentestX Team"

Default tester name for reports (can be overridden with -n flag)

Database Configuration

database.type · string · default: "sqlite"

Database type (currently only SQLite is supported)

database.path · string · default: "database/autopentestx.db"

Path to SQLite database file

database.backup_enabled · boolean · default: true

Enable automatic database backups

database.retention_days · integer · default: 90

Number of days to retain scan data before cleanup

See Database Configuration for detailed schema information.

Logging

Application logging configuration.

logging.enabled · boolean · default: true

Enable application logging

logging.level · string · default: "INFO"

Log level: DEBUG, INFO, WARNING, ERROR, CRITICAL

logging.log_dir · string · default: "logs"

Directory for log files

logging.max_log_size_mb · integer · default: 10

Maximum log file size in megabytes before rotation

logging.backup_count · integer · default: 5

Number of rotated log files to keep

Output Directories

Default directories for various output types.

output.reports_dir · string · default: "reports"

Directory for generated reports

output.logs_dir · string · default: "logs"

Directory for application logs

output.database_dir · string · default: "database"

Directory for database files

output.exploits_dir · string · default: "exploits"

Directory for generated exploit scripts

Network Settings

HTTP client configuration for web requests.

network.user_agent · string · default: "Mozilla/5.0 (AutoPentestX Security Scanner)"

User-Agent header for HTTP requests

network.request_timeout · integer · default: 30

HTTP request timeout in seconds

network.max_retries · integer · default: 3

Maximum number of retries for failed requests

network.rate_limit_delay · integer · default: 1

Delay in seconds between requests to avoid rate limiting

Example Configuration

config.json

{
  "app_name": "AutoPentestX",
  "version": "1.0.0",
  "description": "Automated Penetration Testing & Vulnerability Assessment Toolkit",
  
  "scan_settings": {
    "default_safe_mode": true,
    "timeout": 300,
    "max_ports": 65535,
    "scan_techniques": {
      "tcp_scan": true,
      "udp_scan": true,
      "service_detection": true,
      "os_detection": true,
      "version_detection": true
    }
  },
  
  "vulnerability_scanning": {
    "nikto_enabled": true,
    "sqlmap_enabled": true,
    "nikto_timeout": 300,
    "sqlmap_timeout": 180,
    "max_web_crawl_depth": 2
  },
  
  "risk_scoring": {
    "cvss_thresholds": {
      "critical": 9.0,
      "high": 7.0,
      "medium": 4.0,
      "low": 0.1
    },
    "weight_factors": {
      "exploitable": 2.0,
      "public_exploit": 1.5,
      "network_accessible": 1.3,
      "authenticated": 0.7
    }
  },
  
  "database": {
    "type": "sqlite",
    "path": "database/autopentestx.db",
    "backup_enabled": true,
    "retention_days": 90
  }
}

Modifying Configuration

1. Edit the config.json file in the root directory
2. Validate JSON syntax before saving
3. Restart AutoPentestX for changes to take effect

Invalid JSON will cause AutoPentestX to fail at startup. Always validate your configuration file after making changes.

Related Resources

• Scan Options - CLI flags and runtime options
• Database Configuration - Database schema and queries
• Quick Start Guide - Get started with AutoPentestX