Skip to content

installation.md

Latest commit

 

History

History
117 lines (82 loc) · 3.42 KB

installation.md

File metadata and controls

117 lines (82 loc) · 3.42 KB
Raw

Installation and First Run

PTK can be used as a browser extension, from source, through the npm package, or inside OWASP ZAP. Use the path that matches your workflow.

Browser Store Install

Install PTK from the browser extension store for your browser:

  • Firefox Add-ons
  • Chrome Web Store
  • Microsoft Edge Add-ons

Links are available from:

Recommended browser setup:

  1. Create a dedicated browser profile named PTK Testing.
  2. Install PTK only in that profile.
  3. Disable unrelated extensions.
  4. Use test accounts only.
  5. Clear cookies and storage between clients or engagements.
  6. Keep a separate profile for each high-sensitivity engagement.

Build From Source

Use this when you want to inspect, modify, or test the extension locally.

git clone https://github.com/DenisPodgurskii/pentestkit.git
cd pentestkit
npm ci
npm run build

Load the unpacked extension:

Chrome / Edge / Brave
Extensions -> Developer mode -> Load unpacked -> select pentestkit/src

For Firefox development, use the generated build or temporary add-on loading flow documented by Firefox.

Build Packaged Extension Artifacts

Use this when you need CRX/XPI/ZIP artifacts:

npm run build_pkg

Artifacts are written under pentestkit/dist. Store artifacts keep automation disabled; PTK Auto artifacts use the -automation suffix and include dev.local.json with automation enabled by default.

npm Automation Install

Use npm when you want CLI, CI, or SDK-driven scans:

npm install -D pentestkit
npx playwright install chromium
npx ptk-agent --doctor-extension

Start with:

npx ptk-scan https://target.example \
  --engine DAST \
  --max-routes 50 \
  --output-dir .ptk/artifacts/quick

See Automation and ZAP for extension and ZAP concepts. For CLI and framework automation, use the canonical PTK Agent npm documentation.

OWASP ZAP Add-On

Use the ZAP add-on when you want ZAP to launch browsers and import PTK findings into ZAP alerts.

High-level setup:

  1. Install the OWASP PTK add-on in ZAP.
  2. Open ZAP options for OWASP PTK.
  3. Enable the PTK active scan rule for current automation plans.
  4. Select browser family, headed/headless mode, and browser count.
  5. Run a ZAP automation plan that uses the PTK active scan rule.

Legacy spiderClient automation is still supported for compatibility, but the active scan rule is the preferred path for current release validation.

First-Run Validation

After installing PTK:

  1. Open an authorized target page.
  2. Sign in with a test account if the app requires authentication.
  3. Browse a few normal workflows.
  4. Open PTK from the browser toolbar.
  5. Confirm Dashboard, Proxy, cookies, and storage show target data.
  6. Run a small DAST scan on a known safe page or selected request.
  7. Export results and confirm the artifact contains findings or scan metadata.

If PTK shows no data, see Troubleshooting.

Engagement Setup Checklist

  • Dedicated browser profile created
  • PTK installed and visible in toolbar
  • Target scope written down
  • Test account credentials ready
  • Rate/concurrency limits agreed
  • Destructive actions disabled unless allowed
  • Export folder prepared outside the repository
  • Secrets stored in environment variables or a password manager