A few days ago, I posted an early version of my open-source pentest tool. I received some great feedback, so I went back to the drawing board and completely rewrote the architecture.
TànPhá Framework V3 is now live!
I built this specifically for bug hunters and security researchers who are limited to mobile devices (Termux on Android) or lightweight Linux environments. It doesn't require a high-end laptop to run.
🚀 What's New in V3?
Auto Assessment Engine: Migrated to a state-machine architecture to handle Discovery, Fingerprinting, and Validation automatically.
New Modules: Added LFI (with •php://filter\ support) and PHP2Shell (a stateful RAT with file upload/download).
•Auto Login Engine: Automatically detects and bypasses CSRF tokens to scan authenticated pages.
•Global Ready: 100% English native codebase, prompts, and outputs.
•JSON Reporting: Auto-saves findings to the reports/\ directory.
⚠️ Honest Limitations (Let's be real)
•WAF Bypass: Currently only supports basic evasion (Level 1). Advanced evasion (Chunked encoding, Origin IP) is planned for V4.
•DVWA High: The SQLi engine works perfectly on Low/Medium, but struggles with High (due to stateful session inputs). That's on the V4 roadmap!
🗺️ What's Next? (V4 Roadmap)
This project is actively maintained. Here is what I'm planning to build next:
•Advanced WAF Evasion: Level 2 (Chunked Encoding) & Level 3 (Origin IP Discovery).
•New Modules: XSS, SSRF, and Subdomain Enumeration.
•Headless Mode: CLI arguments (python main.py -u target -m sqli\) for CI/CD automation.
•HTML/PDF Reporting: Generate client-ready reports.
Let me know in the comments if you want a specific feature added to the roadmap!
Note: This tool is for educational purposes and authorized testing only. Please use it responsibly.
I'd love to hear your feedback, bug reports, or feature requests. If you find it useful, a star on GitHub would mean a lot! ⭐
GitHub Link: (https://github.com/exelumare/T-nPh--framework)
Top comments (0)