Configuration Reference

Penetration-v3 reads settings.conf from the same directory as the binary on startup. All keys are optional. The file refreshes in the background based on proxy_refresh_minutes.

settings.conf

Place settings.conf next to the pentest-v3 binary:

pentest-v3
settings.conf

HTTP Proxy URLs

Key	Type	Default	Description
http_proxy_url	URL	none	Repeatable. Raw HTTP proxy list (ip:port per line).

Used by all L7 attacks (http, https, xmlrpc, rudy, ws, h2rapid). Proxies rotate per connection.

TIP

Add multiple http_proxy_url lines for redundancy. Dead providers are skipped silently.

SOCKS5 Proxy URLs

Key	Type	Default	Description
socks5_proxy_url	URL	none	Repeatable. Raw SOCKS5 proxy list (ip:port per line).

Same rotation behavior as HTTP proxies.

Refresh Interval

Key	Type	Default	Description
proxy_refresh_minutes	int	5	How often to re-fetch proxy/resolver lists.

Set to a higher value if your provider rate-lists you.

Optional Auto-Fetched Lists

Key	Type	Default	Description
resolver_url	URL	none	DNS amplifier IPs (ip per line). Loaded into resolvers: automatically.
target_list_url	URL	none	Target list for scripted multi-target attacks.
useragent_url	URL	none	Custom User-Agent strings. Replaces the built-in UA pool.
payload_url	URL	none	Custom payload strings for pattern:custom.

WARNING

Only point these at resources you control or have permission to use.

Example settings.conf

http_proxy_url=https://api.proxyscrape.com/v2/?request=displayproxies&protocol=http&timeout=10000&country=all&ssl=all&anonymity=all
http_proxy_url=https://raw.githubusercontent.com/TheSpeedX/PROXY-List/master/http.txt

socks5_proxy_url=https://api.proxyscrape.com/v2/?request=displayproxies&protocol=socks5&timeout=10000&country=all&ssl=all&anonymity=all
socks5_proxy_url=https://raw.githubusercontent.com/TheSpeedX/PROXY-List/master/socks5.txt

proxy_refresh_minutes=5

Environment Variables

Variable	Required	Description
PENTEST_AUTH_HASH	Yes	Bcrypt hash of the operator password. Tool fails closed if unset.

Common Mistakes

1. Placing settings.conf in the source directory instead of next to the binary.
   • The binary resolves the path from os.Executable(), not $PWD.
2. Using proxy lists that require authentication or are not raw ip:port.
   • Lines that fail net.SplitHostPort are dropped silently.
3. Setting proxy_refresh_minutes too low.
   • Public providers may rate-limit aggressive refreshes.