PenPeeper vs Reconmap

PenPeeper is an open-source penetration-testing engagement manager for security professionals. It organizes projects through Gather, Search, Findings, and Report stages, supporting multiple engagements and clients, device tags, asset filters, and targeted reports. Users can import scans, screenshots, and notes, then export complete projects as encrypted files for sharing or backup. Built-in automation integrates Nmap, Nikto, SearchSploit, WhatWeb, Enum4Linux, FFUF, and SNMP, with configurable scan concurrency. PenPeeper retrieves CVE details, severity scores, and descriptions from the National Vulnerability Database. AI features cover vulnerability hunting, evidence examination, remediation recommendations, and executive-summary generation through local or cloud providers including LM Studio, Ollama, OpenRouter, Claude, Gemini, ChatGPT, and custom providers. Guided templates and customizable summary graphics support PDF reports. The software is free for personal or professional use under its stated license terms, but selling it or hosting it as paid SaaS requires permission or is prohibited. It runs on Linux, macOS, and Windows; Windows requires Windows Subsystem for Linux. Vulnerability testing is passive and flags potential issues for manual review.

Reconmap is a free, open-source collaboration platform for planning, conducting, and documenting penetration test projects across assets and clients. It supports multiple top-level organisations and includes project templates, task management, and client management. Vulnerability tracking and a templates database help organize findings, while users can automate security commands and schedule them with cron expressions. Reports can be generated in Word, Markdown, and Typst formats, with custom whitelabel reporting. Integrations can send vulnerabilities to Jira or Azure DevOps and deliver event-driven HTTP notifications through webhooks. Security features include SSO, OpenID and SAML user federation, two-factor authentication, email verification, and an audit log. A REST API with token authentication supports connections to external tools and scripts. Deployment options include Docker Compose, Kubernetes, manual installation, and hosted SaaS maintained by the project’s lead developers through Netfoe. The documentation positions Docker Compose for small teams and Kubernetes for production deployments and large teams; it also cautions that Compose is not designed for high availability or horizontal scaling out of the box.