Starting Penetration Testing...
Target URL: http://localhost
Output Format: json
============================================================
Running comprehensive penetration tests...
Penetration testing completed!
============================================================
PENETRATION TEST SUMMARY
Timestamp: 2026-02-10 22:31:09
Target: http://localhost
Total Vulnerabilities: 1
Risk Level: Low
Risk Score: 7

VULNERABILITY BREAKDOWN:
  Critical: 0
  High: 1
  Medium: 0
  Low: 0

OWASP TOP 10 RESULTS:
  ✓ A1: Injection                                      PASS
  ✓ A2: Broken Authentication                          PASS
  ✓ A3: Sensitive Data Exposure                        PASS
  ✓ A4: XML External Entities (XXE)                    PASS
  ✓ A5: Broken Access Control                          PASS
  ✓ A6: Security Misconfiguration                      PASS
  ✓ A7: Cross-Site Scripting (XSS)                     PASS
  ✓ A8: Insecure Deserialization                       PASS
  ✓ A9: Using Components with Known Vulnerabilities    PASS
  ✓ A10: Insufficient Logging & Monitoring             PASS

SPECIFIC TEST RESULTS:
  Authentication Tests:
    ✓ Brute Force                    PASS
    ✓ Weak Passwords                 PASS
    ✓ Session Fixation               PASS
    ✓ Password Reset                 PASS

  Authorization Tests:
    ✓ Privilege Escalation           PASS
    ✓ Idor                           PASS
    ✓ Path Traversal                 PASS

  Input Validation Tests:
    ✓ Parameter Pollution            PASS
    ✓ Buffer Overflow                PASS
    ✓ Format String                  PASS
    ✓ Command Injection              PASS

  QR Code Security Tests:
    ✓ Qr Injection                   PASS
    ✓ Qr Tampering                   PASS
    ✓ Qr Type Confusion              PASS

  File Upload Tests:

  Session Management Tests:
    ✓ Session Fixation               PASS
    ✓ Session Hijacking              PASS
    ✓ Csrf                           PASS

  Information Disclosure Tests:

  Business Logic Tests:
    ✓ Price Manipulation             PASS
    ✓ Quantity Manipulation          PASS
    ✓ Workflow Bypass                PASS

DETAILED VULNERABILITIES:
1. NO_RATE_LIMITING (HIGH)
   Category: Authentication
   Endpoint: /portal/ajax/login.php
   Description: No rate limiting detected for login attempts

SECURITY RECOMMENDATIONS:
1. Implement rate limiting for authentication endpoints

Results saved to: /home/hygienetech/public_html/staging-portal/security/../logs/pentest_report_2026-02-10_22-31-09.json

WARNING: High severity vulnerabilities found! Action required!