pennacle-security/summitOpen-source web security testing platform: proxy, scanner and fuzzer in one CLI. By Pennacle Security.
One scriptable CLI for web security testing: scanner, TLS-intercepting proxy, fuzzer, authorization testing, WAF analysis, link-hijack detection, race conditions, scheduled monitoring and recon.
58+ checks across 11 families, 37 bundled YAML templates, Intruder-style payload fuzzing and a no-traffic attack-surface map. Free where the equivalents are paid - by Pennacle Security.
We use Burp and ZAP every day. We also kept wanting three things they are not: a scanner we can script against in CI, findings that tell us how sure they are, and a codebase small enough to read in one sitting. Summit now has 58+ checks across 11 families, a one-command attack-surface map, payload fuzzing that speaks the Intruder file format, and a proxy that decrypts HTTPS with a CA it generates itself. Summit is that tool - v2.1.0, MIT, built in the open. Three core dependencies (requests, pyyaml, packaging) plus one optional (cryptography, only for TLS interception), all FLOSS, all standard.
Full documentation: pennacle-security.github.io/summit
Capabilities that usually sit behind paid tooling, plus the scanning core:
| Capability | Summit | The usual route |
|---|---|---|
| Broken access control testing (BOLA/IDOR) | summit authorize | Autorize-style add-on / paid workflows |
| Hidden parameter discovery | summit mine | Param Miner-style add-on |
| OpenAPI-driven scanning | summit scan --openapi | add-ons |
| WAF fingerprinting + bypass probing | built in | partial / add-ons |
| Attack-surface mapping | summit map | add-ons / paid workflows |
| SQLi, XSS, redirect, traversal, takeover, host header, CORS | built in | core scanners (free) |
| Recon chain: subfinder -> httpx -> nmap | summit recon | manual gluing |
| Race condition detection | summit race | Burp Turbo Intruder (paid) |
| Intruder-style payload fuzzing | summit fuzz --request | paid (Intruder) |
| TLS-intercepting proxy | summit proxy --tls-intercept | paid core |
| Scheduled scans with per-round diffing | summit schedule | cron + glue scripts |
| TLS certificate audit | summit tls | manual / sslscan |
| Rate limiting, retries, JWT/encoder toolkit | built in | add-ons / paid |
| CI-ready, confidence-labelled, CWE/CVE-tagged findings | the whole point | paid automation |
| SARIF + JUnit XML output | built in | paid reporting |
| Pre-built binaries (linux/amd64, arm64, windows) | every release | N/A |
Every finding carries a confidence label - confirmed (an observed fact), likely (strong evidence), needs-manual (a heuristic for a human to check) or info - and the label caps severity, so a guess can never pose as critical. That distinction runs through the entire tool.
git clone https://github.com/pennacle-security/summit.git
cd summit
pip install -e .
Python 3.10+. Dependencies: requests, pyyaml, packaging - all FLOSS, all standard.
Install from PyPI:
pip install summit-scanner
Or from source:
git clone https://github.com/pennacle-security/summit.git
cd summit
pip install -e .
Pre-built binaries available on every release:
summit-linux-amd64 - Linux x86_64 (Ubuntu 20.04+, Debian 11+, RHEL 8+)summit-linux-arm64 - Linux ARM64 (AWS Graviton, Raspberry Pi 4+, Apple Silicon)summit-windows-amd64.exe - Windows 10+ / Windows Server 2019+No Python installation required for binaries.
Then watch it work against a deliberately vulnerable local target:
python examples/vuln_app.py # terminal 1 - the target (127.0.0.1 only)
summit map http://127.0.0.1:8765 # attack-surface map, no attack traffic
summit scan http://127.0.0.1:8765 # terminal 2 - the scan
A fuller pass on a real engagement looks like this:
summit recon target.com --json recon.json # subdomains -> hosts -> ports
summit scan https://target.com --depth 2 --rate 10 # crawl + all checks
summit scan --openapi api-spec.json # API: scan what the spec admits to
summit authorize https://target.com/admin?user=1 \
--role 'admin=Cookie: session=abc' \
--role 'user=Cookie: session=xyz' # BOLA/IDOR testing
Every claim on this page is reproduced by examples/evidence.py - it runs the demo target live, measures each feature, and prints PASS/FAIL with the real numbers. CI executes it on every push; a claim that stops holding fails the build.
python examples/evidence.py)