Pentest Evidence Capture

Every host, credential, and finding. In one place.

During an engagement you run dozens of tools. Their output scatters across terminals, files, and windows. Alpha captures it all, parses it into structured data, and puts it on a shared server your whole team can search and query.

Get Started View on GitHub

$ al run nmap -sV 10.0.0.1

Starting Nmap 7.94 ... Nmap scan report for 10.0.0.1 PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9 80/tcp open http nginx 1.18 443/tcp open ssl/http nginx 1.18

$ al query host --format ips

10.0.0.1 10.0.0.5 10.0.0.12

HOST 10.0.0.1 SVC :443 CRED admin

Capture

Your workflow doesn't change

Prefix any command with al run. Alpha records the full output through a PTY. The command runs exactly as you typed it.

No injected flags, no sidecar files, no footprint changes
Works with every tool, not just the ones Alpha knows how to parse
If the server is unreachable, runs queue locally and sync when it comes back

Learn more

$ al run nmap -sV -sC 10.0.0.0/24

Starting Nmap 7.94 ( https://nmap.org ) Nmap scan report for 10.0.0.1 Host is up (0.0012s latency). PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 80/tcp open http nginx 1.18.0 443/tcp open ssl/http nginx 1.18.0 |_ssl-cert: CN=app.internal Nmap scan report for 10.0.0.5 Host is up (0.0015s latency). PORT STATE SERVICE VERSION 3389/tcp open ms-wbt Microsoft Terminal 445/tcp open smb Windows Server 2019

Parse

Raw output becomes structured data

The server recognizes the tool and extracts hosts, services, credentials, and findings. Everything is deduplicated and linked within the engagement.

30+ parsers for common pentest tools
Hosts, services, credentials, identities, and findings
Raw output always stored and full-text searchable

See supported tools

HOST 10.0.0.1 nmap

HOST 10.0.0.5 nmap

SERVICE 10.0.0.1:22 ssh OpenSSH 8.9

SERVICE 10.0.0.1:443 https nginx 1.18

CREDENTIAL admin:P@ssw0rd netexec

IDENTITY CORP\admin ldapsearch

FINDING CVE-2024-1234 (Critical) nuclei

Correlate

See how everything connects

Every entity links back to the run that found it. The graph shows attack paths, credential reuse, and relationships across the entire engagement.

Interactive graph with hosts, services, credentials, and identities
Attack path detection and high-value target identification
Active Directory import for domain-joined environments

Explore the graph

Collaborate

Built for teams, secure by default

Run Alpha on your own infrastructure. Multiple operators work against the same engagement. Credentials are masked until you explicitly reveal them.

Admin, operator, and read-only roles with optional MFA
Credentials masked by default with audited reveal
Export to Markdown, PDF, or push to SysReptor

Read the docs

Identity	Credential	Source	Status
CORP\admin	* * * * * * * *	netexec	Valid
CORP\svc-sql	* * * * * * * *	impacket	Valid
root	* * * * * * * *	hydra	Expired
CORP\j.smith	* * * * * * * *	kerbrute	Valid
sa	* * * * * * * *	sqlmap	Reused

See it in action

Screenshots coming soon. The UI is live and ready to try.

Dashboard Coming soon

Entity graph Coming soon

Findings board Coming soon

Terminal capture Coming soon

Supported Tools

30 parsers and counting

Alpha recognizes tool output and extracts structured entities automatically. Scanning, web testing, Active Directory, credential spraying, password cracking. If a parser doesn't exist yet, raw output is still captured and full-text searchable.

Missing a tool? Open a PR or request it on GitHub.

$ al parsers list

SCANNING

nmap masscan naabu httpx dnsx subfinder whatweb

WEB

nuclei gobuster ffuf feroxbuster nikto wpscan sqlmap gau

ACTIVE DIRECTORY

netexec impacket ldapsearch certipy bloodyad SharpHound

kerbrute rpcclient

SMB

smbclient smbmap enum4linux-ng

CREDENTIALS

hydra medusa hashcat john

30 parsers loaded

Deploy in under a minute

Clone the repo. Run docker compose. You're done.

$ git clone https://github.com/shoamshilo/alpha-security && cd alpha-security/deploy && docker compose up -d

copy

Read the docs View on GitHub

Deployment guide Configuration Security policy