Base
Hardened build
minimal ports, security patches applied at build time
Pwndoc on Ubuntu 24.04
Azure
Security
Pwndoc, the open source penetration test reporting platform that turns findings into a finished, client ready Word report.
Overview
Pwndoc is an open source reporting platform built for penetration testers. It replaces the copy and paste report workflow with a shared workspace: a reusable vulnerability knowledge base holds your standard findings with their descriptions, remediation advice and CVSS scoring, and each engagement pulls from that base rather than starting from a blank document. Testers write findings collaboratively in a rich text editor with live updates between everyone in the same audit, attach evidence images, record scope and network hosts, and track each finding through its own review state. Audits are multilingual, custom fields and custom sections let you shape the workspace to your own methodology, and the finished engagement is exported to a Word document generated from your own DOCX template, so every report comes out in your house style without manual formatting.
It suits consultancies and internal security teams who run repeat engagements and need their findings, their scoring and their report template to live in one place that the whole team works from.
Why the cloudimg image
cloudimg delivers Pwndoc as a native systemd appliance rather than a container stack, fully installed on a hardened, fully patched Ubuntu base and pinned to a verified upstream release commit. It is secure by default, which matters for a system that holds client penetration test findings: every secret is minted on the instance's own first boot, never baked into the image. That includes the database credential, the token signing secrets and the first administrator password, all written to a root only file, plus a freshly generated per instance TLS certificate, so the published private keys that ship inside the upstream project never reach your instance. The database is bound to loopback with authentication enabled, the web interface is served over HTTPS only because session cookies are secure only, and there is no self registration. All engagement data, uploaded report templates and evidence live on a dedicated data disk, and the instance arrives already usable with a language, a report template and an audit type in place. The base keeps receiving unattended security updates, and every deployment is paired with a step by step deploy guide and backed by 24/7 cloudimg support.
Common uses
- Run penetration test engagements from a shared findings workspace
- Build a reusable vulnerability knowledge base with CVSS scoring
- Generate client ready Word reports from your own DOCX template
See it running
Real screenshots taken while testing this image against its deployment guide.
More in Security
KeePass Password Manager
Security
KeePass is a free, open source password manager that stores all your passwords in a highly encrypted database. The datab...
CrowdSec
Security
This image runs CrowdSec, the free and open source collaborative behavioural security engine.
Ollama GPU-Accelerated LLM Server
Security
This image runs Ollama 0.30, the easiest way to run open large language models locally - pull and serve Llama, Mistral, ...
OWASP ZAP
Security
This image runs OWASP ZAP (the Zed Attack Proxy), the world's most widely used open source web-application security scan...
step-ca
Security
This image runs step-ca, the open source online certificate authority from Smallstep for secure, automated X.509 and ACM...
Trivy Security Scanner
Security
This image runs Trivy, the open source, Apache-2.0 licensed all-in-one security scanner from Aqua Security.