---

📸 Screenshots

---

🚀 Features

┌─────────────────────────────────────────────────────────────────────┐
│  ✅ 5-Phase Pipeline    │  Recon → Scan → Vuln → Exploit → Report  │
│  ✅ 30+ Tools           │  nmap, nuclei, sqlmap, ffuf, owscan...  │
│  ✅ Auto-Install        │  Missing tools via onex (370+ tools)     │
│  ✅ PoC Generation      │  Every finding with proof-of-concept     │
│  ✅ Multi-Format Reports│  HTML, Markdown, JSON, CSV, SARIF        │
│  ✅ Non-Standard Ports  │  Full support for custom ports           │
│  ✅ Cross-Validation    │  Two-source confirmation for accuracy    │
└─────────────────────────────────────────────────────────────────────┘

---

⚡ Quick Start

1. Install Dependencies

# Auto-install all tools via onex
cd ~/.pi/agent/skills/pentx/scripts
python3 lib/tool_manager.py auto

# Or manually check
bash tools_check.sh

2. Run Full VAPT Scan

python3 pentx.py https://target.com:4280/

3. Run Single Phase

python3 pentx.py https://target.com --phase 1   # Recon only
python3 pentx.py https://target.com --phase 3   # Vuln assessment
python3 pentx.py https://target.com --phase 5   # Report only

4. Fast Mode

python3 pentx.py https://target.com --fast      # Skip nmap + nuclei
python3 pentx.py https://target.com --no-exploit # Read-only

---

🔧 Tool Stack

---

📊 5-Phase Workflow

┌──────────────────────────────────────────────────────────────────────┐
│                                                                      │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐
│  │   PHASE 1   │→ │   PHASE 2   │→ │   PHASE 3   │→ │   PHASE 4   │→ │   PHASE 5   │
│  │  Recon      │  │  Scan       │  │  Vuln       │  │  Exploit    │  │  Report     │
│  │             │  │             │  │             │  │             │  │             │
│  │ • Subdomain │  │ • Nmap      │  │ • SQLi      │  │ • SQLi Exp  │  │ • HTML      │
│  │ • Tech Stack│  │ • Nikto     │  │ • LFI/XSS   │  │ • Auth Test │  │ • Markdown  │
│  │ • Nuclei    │  │ • FFUF      │  │ • OWScan    │  │ • PoC Gen   │  │ • JSON/CSV  │
│  └─────────────┘  └─────────────┘  └─────────────┘  └─────────────┘  └─────────────┘
│                                                                      │
└──────────────────────────────────────────────────────────────────────┘

---

🛠️ Integration

onex Package Manager

# Check tool status
python3 lib/tool_manager.py status

# Auto-install all missing tools
python3 lib/tool_manager.py auto

# Install specific tool
python3 lib/tool_manager.py install nikto

# List all 370+ tools
python3 lib/tool_manager.py list

owscan Web Scanner

# Run owscan standalone
php tools/owscan/owscan.php -u https://target.com:4280/

# Via wrapper (auto-parses to pentx format)
python3 lib/owscan_wrapper.py https://target.com:4280/ output/owscan

---

📁 Output Structure

output/
├── phase1-recon/        # Recon assets, live hosts, nuclei, findings
├── phase2-scan/         # Nmap XML, ffuf, nikto, findings
├── phase3-vuln/         # SQLi, LFI/XSS/SSRF PoCs + findings
├── phase4-exploit/      # PoC artifacts, banner verification
├── report.html          # HTML report (exec + PoC cards)
├── report.md            # Full technical Markdown report
├── exec-summary.md      # Leadership summary
├── findings-merged.json # Machine-readable findings
├── findings.csv         # CSV for spreadsheets
├── findings.sarif       # SARIF for CI/CD
└── poc-full/            # Per-finding PoC .txt artifacts

---

🎯 PoC Format Example

═══════════════════════════════════════════════════════════════
  SQL Injection on 'id' — https://target.com:4280/page
═══════════════════════════════════════════════════════════════

Request:
  GET /page?id=1'+AND+1=1-- HTTP/1.1
  Host: target.com:4280

Response:
  HTTP/1.1 200 OK
  [Page content with true condition]

Severity: Critical (CVSS 9.8)
Remediation: Use parameterized queries / prepared statements.
═══════════════════════════════════════════════════════════════

---

🔒 Safety Rules

Rule	Description
⚠️ Authorization	Only run against authorized targets
📖 Read-only	Default mode, use --no-exploit
🚫 No Destructive	No DoS, no data destruction
⏱️ Timeouts	All probes use short timeouts
🔐 Safe SQLi	--batch mode, limited level/risk

---

📚 CLI Reference

python3 pentx.py <target> [output] [options]

Options:
  --phase N           Run single phase (1-5)
  --no-exploit        Skip Phase 4 (exploitation)
  --fast              Skip nmap + nuclei, fast scan
  --skip-nmap         Skip nmap scan
  --skip-nuclei       Skip nuclei scan
  --target-port N     Override target port
  --timeout N         Per-phase timeout (default: 300s)
  --check             Check tool availability
  --report <dir>      Regenerate report from output dir
  --tools <cmd>       Tool manager: status|install|list|auto
  --owscan <url>      Run owscan standalone

---

🏆 Sponsored By

---

🙏 Credits