RedKit: A Lightweight Penetration Testing Framework Using Docker-Based Isolation

Mohammed Abdelfattah; Youssef Hamdy Abdelazeem; Mohamed Mahmoud Hanafi; Ziad Mahmoud Mohamed; Abdallah Waleed Ab-Delmajeed; Ahmed Mamdouh Salem

Research Article

RedKit: A Lightweight Penetration Testing Framework Using Docker-Based Isolation

by Mohammed Abdelfattah, Youssef Hamdy Abdelazeem, Mohamed Mahmoud Hanafi, Ziad Mahmoud Mohamed, Abdallah Waleed Ab-Delmajeed, Ahmed Mamdouh Salem

International Journal of Computer Applications

Foundation of Computer Science (FCS), NY, USA

Volume 187 - Issue 106

Published: May 2026

Authors: Mohammed Abdelfattah, Youssef Hamdy Abdelazeem, Mohamed Mahmoud Hanafi, Ziad Mahmoud Mohamed, Abdallah Waleed Ab-Delmajeed, Ahmed Mamdouh Salem

10.5120/ijca077168be4e15

PDF

Mohammed Abdelfattah, Youssef Hamdy Abdelazeem, Mohamed Mahmoud Hanafi, Ziad Mahmoud Mohamed, Abdallah Waleed Ab-Delmajeed, Ahmed Mamdouh Salem . RedKit: A Lightweight Penetration Testing Framework Using Docker-Based Isolation. International Journal of Computer Applications. 187, 106 (May 2026), 27-34. DOI=10.5120/ijca077168be4e15

                        @article{ 10.5120/ijca077168be4e15,
                        author  = { Mohammed Abdelfattah,Youssef Hamdy Abdelazeem,Mohamed Mahmoud Hanafi,Ziad Mahmoud Mohamed,Abdallah Waleed Ab-Delmajeed,Ahmed Mamdouh Salem },
                        title   = { RedKit: A Lightweight Penetration Testing Framework Using Docker-Based Isolation },
                        journal = { International Journal of Computer Applications },
                        year    = { 2026 },
                        volume  = { 187 },
                        number  = { 106 },
                        pages   = { 27-34 },
                        doi     = { 10.5120/ijca077168be4e15 },
                        publisher = { Foundation of Computer Science (FCS), NY, USA }
                        }

                        %0 Journal Article
                        %D 2026
                        %A Mohammed Abdelfattah
                        %A Youssef Hamdy Abdelazeem
                        %A Mohamed Mahmoud Hanafi
                        %A Ziad Mahmoud Mohamed
                        %A Abdallah Waleed Ab-Delmajeed
                        %A Ahmed Mamdouh Salem
                        %T RedKit: A Lightweight Penetration Testing Framework Using Docker-Based Isolation%T 
                        %J International Journal of Computer Applications
                        %V 187
                        %N 106
                        %P 27-34
                        %R 10.5120/ijca077168be4e15
                        %I Foundation of Computer Science (FCS), NY, USA

Abstract

RedKit is a Security as a Service (SECaaS) platform designed to facilitate penetration testing across the entire life cycle through a microservices architecture. RedKit includes both manual and automated testing. In manual testing, RedKit offers custom-built Docker containers as a pre-configured environment that includes a web proxy ready for testing. In automated testing, RedKit features an AI-driven vulnerability scanner to automate repetitive tests, reducing the effort required of penetra-tion testers. RedKit includes information gathering, reconnaissance tools, and AI report generation. RedKit integrates all these features into a cloud-based, all-in-one framework, a low-effort solution for end-to-end security assessments. By integrat-ing Docker and merging automated testing with manual testing, RedKit builds a full penetration testing framework with mini-mal resource overhead. By accomplishing 60% of resource management and 90% of time saving for setting up the environment.

References

ENISA, “ENISA Threat Landscape 2024,” 2024. [Online]. Availa-ble:https://www.enisa.europa.eu/publications/enisa-threat-landscape-2024
R. Morabito, J. Kjällman, and M. Komu, “Hypervisors vs. lightweight virtualization: A performance comparison,” in Proc. IEEE Int. Conf. on Cloud Engineering (IC2E), 2015, pp. 386–393, doi:10.1109/IC2E.2015.74.
V. Lazarov, P. Seda, Z. Martinasek, and R. Kummel, “Penterep: Comprehensive penetration testing with adapt-able interactive checklists,” Computers & Security, vol. 154, p. 104399, 2025. [Online]. Availa-ble:https://www.sciencedirect.com/science/article/pii/S0167404825000884
S. S. Patil and S. S. Shinde, “Analysis of Penetration Testing Tools,” in Proc. Int. Conf. on Inventive Research in Computing Applications (ICIRCA), 2018. [Online]. Availa-ble:https://www.researchgate.net/publication/326077274
PortSwigger, “Burp Suite: The class-leading vulnerability scanner,” [Online]. Available: https://portswigger.net/burp
OWASP Foundation, “OWASP Zed Attack Proxy (ZAP),”[Online]. Available: https://www.zaproxy.org/
A. Riancho, “w3af: Web Application Attack and Audit Framework,”[Online]. Available: https://github.com/andresriancho/w3af
PTES, “Penetration Testing Execution Standard (PTES),”[Online]. Available: http://www.pentest-standard.org/
K. Scarfone, M. Souppaya, A. Cody, and A. Orebaugh, “Technical Guide to Information Security Testing and As-sessment (NIST SP 800-115),” NIST, 2008. [Online]. Available: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf
Docker Inc., “Docker Documentation,” [Online]. Availa-ble: https://docs.docker.com/
S. Ramirez, “FastAPI framework, high performance, easy to learn,”[Online]. Available:https://fastapi.tiangolo.com
IETF, “RFC 6455: The WebSocket Protocol,” [Online]. Available: https://datatracker.ietf.org/doc/html/rfc6455
d'Itri, M. (2026). whois: Intelligent WHOIS client (Ver-sion 5.5) [Computer software]. GitHub. https://github.com/rfc1036/whois
A. Sykes, “Web-Check: All-in-one OSINT tool for ana-lyzing any website,” [Online]. Available: https://github.com/Lissy93/web-check
R. Halley, “dnspython: A DNS toolkit for Python,” [Online]. Available:https://www.dnspython.org/
Sectigo, “crt.sh: Certificate Search,” [Online]. Available: https://crt.sh/
Nmap Project, “Nmap: Free Security Scanner, Port Scan-ner, & Network Exploration,” [Online]. Available: https://nmap.org
Jaeles Project, “GoSpider: Fast web spider written in Go,” [Online].Available: https://github.com/jaeles-project/gospider
T. Nomnom, “Waybackurls: Fetch all the URLs that the Wayback Machine knows about for a domain,” [Online]. Available: https://github.com/tomnomnom/waybackurls
Internet Archive, “Wayback Machine API,” [Online]. Available: https://archive.org/web/
Kasm Web, “Kali Rolling Desktop Docker Image,” Dock-er Hub. [On-line]. Available: https://hub.docker.com/r/kasmweb/kali-rolling-desktop
Offensive Security, “Kali Linux Penetration Testing OS,” [Online].Available: https://www.kali.org/
Kanaka, “noVNC: HTML5 VNC Client,” [Online]. Available: https://novnc.com/
TigerVNC Project, “High-performance, platform-neutral VNC,” [On-line]. Available: https://tigervnc.org/
A. Cortesi, M. Hils, and T. Kriechbaumer, “mitmproxy: A free and open source interactive HTTPS proxy,” [Online]. Available: https://mitmproxy.org/
Anthropic, “Model Context Protocol Specification,” [Online]. Available:https://modelcontextprotocol.io/
Google DeepMind, “Gemini: The most capable AI mod-els,”[Online]. Available: https://deepmind.google/technologies/gemini/
Cohere Inc., “Cohere LLM Documentation,” [Online]. Available: https://cohere.com/
Oracle Corporation, "Oracle VM VirtualBox," [Online]. Available: https://www.virtualbox.org/
Aristocratos, "btop: Resource monitor," [Online]. Availa-ble: https://github.com/aristocratos/btop
PostgreSQL Global Development Group, “PostgreSQL Documentation,”[Online]. Available: https://www.postgresql.org/docs/
Redis Ltd., “Redis Documentation,” [Online]. Available: https://redis.io/docs/latest/
Kubernetes Authors, “Kubernetes Documentation,” [Online].Available: https://kubernetes.io/docs/

Index Terms

Computer Science

Information Sciences

No index terms available.

Keywords

Containerization Penetration Testing Web Proxy SECaaS (Security as a Service) Methodology LLM Reporting Pay-loads Ethical Hacking Docker