Hey Dev.to community! 👋
I wanted to share a project I’ve been passionately building entirely on my Android phone using Termux: a lightweight, modular CLI-based automated security testing framework called TànPhá Framework.
💡 Why I Built It
Most security frameworks are either too bloated or require full desktop setups just to run basic automated chains. As someone learning Python and software architecture directly on a mobile device, I wanted to challenge myself to create a tool focused on full-chain execution—moving straight from vulnerability verification to interactive shell access without manual hassle.
⚙️ How It Works & Architecture
The framework is designed to be fully modular and cross-platform (Linux, Windows, and Android/Termux). It avoids heavy external dependencies, relying on clean Python code to handle request chains.
Currently, TànPhá includes:
Arbitrary File Upload Engine: Automatic parameter detection, magic-byte/extension bypass, and instant webshell deployment.
Command Injection Engine: Automated separator variations and WAF-bypass payload encoding.
SQL Injection Engine: Error/Union-based parameter fuzzing.
PHP2Shell Core: An interactive HTTP POST-based command execution engine (RAT/Webshell controller)
.
🛠️ Challenges of Developing on Mobile
Coding an entire framework on a smartphone screen via Termux definitely comes with unique challenges:
Managing clean project directory structures without a full desktop IDE.
Optimizing Python execution speed so it runs smoothly on mobile architecture.
Ensuring all modules properly handle terminal control signals and cross-platform paths.
🚀 What's Next?
The project is completely open-source and I'm currently looking for feedback, code reviews, or ideas for new automated modules (like LFI-to-RCE chains or network credential assessment).
🔗 Check out the repository on GitHub: https://github.com/exelumare/T-nPh--framework
I'd love to hear your thoughts, suggestions, or constructive critiques in the comments below!
Top comments (0)