---

📸 截图

---

🚀 功能特性

┌─────────────────────────────────────────────────────────────────────┐
│  ✅ 5-Phase Pipeline    │  Recon → Scan → Vuln → Exploit → Report  │
│  ✅ 30+ Tools           │  nmap, nuclei, sqlmap, ffuf, owscan...  │
│  ✅ Auto-Install        │  Missing tools via onex (370+ tools)     │
│  ✅ PoC Generation      │  Every finding with proof-of-concept     │
│  ✅ Multi-Format Reports│  HTML, Markdown, JSON, CSV, SARIF        │
│  ✅ Non-Standard Ports  │  Full support for custom ports           │
│  ✅ Cross-Validation    │  Two-source confirmation for accuracy    │
└─────────────────────────────────────────────────────────────────────┘

⚡ 快速开始

1. 安装依赖

# Auto-install all tools via onex
cd ~/.pi/agent/skills/pentx/scripts
python3 lib/tool_manager.py auto

# Or manually check
bash tools_check.sh

2. 运行完整 VAPT 扫描

python3 pentx.py https://target.com:4280/

3. 运行单阶段

python3 pentx.py https://target.com --phase 1   # Recon only
python3 pentx.py https://target.com --phase 3   # Vuln assessment
python3 pentx.py https://target.com --phase 5   # Report only

4. 快速模式

python3 pentx.py https://target.com --fast      # Skip nmap + nuclei
python3 pentx.py https://target.com --no-exploit # Read-only

🔧 工具栈

---

📊 5 阶段工作流

┌──────────────────────────────────────────────────────────────────────┐
│                                                                      │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐
│  │   PHASE 1   │→ │   PHASE 2   │→ │   PHASE 3   │→ │   PHASE 4   │→ │   PHASE 5   │
│  │  Recon      │  │  Scan       │  │  Vuln       │  │  Exploit    │  │  Report     │
│  │             │  │             │  │             │  │             │  │             │
│  │ • Subdomain │  │ • Nmap      │  │ • SQLi      │  │ • SQLi Exp  │  │ • HTML      │
│  │ • Tech Stack│  │ • Nikto     │  │ • LFI/XSS   │  │ • Auth Test │  │ • Markdown  │
│  │ • Nuclei    │  │ • FFUF      │  │ • OWScan    │  │ • PoC Gen   │  │ • JSON/CSV  │
│  └─────────────┘  └─────────────┘  └─────────────┘  └─────────────┘  └─────────────┘
│                                                                      │
└──────────────────────────────────────────────────────────────────────┘

🛠️ 集成

onex 包管理器

# Check tool status
python3 lib/tool_manager.py status

# Auto-install all missing tools
python3 lib/tool_manager.py auto

# Install specific tool
python3 lib/tool_manager.py install nikto

# List all 370+ tools
python3 lib/tool_manager.py list

owscan Web 扫描器

# Run owscan standalone
php tools/owscan/owscan.php -u https://target.com:4280/

# Via wrapper (auto-parses to pentx format)
python3 lib/owscan_wrapper.py https://target.com:4280/ output/owscan

📁 输出结构

output/
├── phase1-recon/        # Recon assets, live hosts, nuclei, findings
├── phase2-scan/         # Nmap XML, ffuf, nikto, findings
├── phase3-vuln/         # SQLi, LFI/XSS/SSRF PoCs + findings
├── phase4-exploit/      # PoC artifacts, banner verification
├── report.html          # HTML report (exec + PoC cards)
├── report.md            # Full technical Markdown report
├── exec-summary.md      # Leadership summary
├── findings-merged.json # Machine-readable findings
├── findings.csv         # CSV for spreadsheets
├── findings.sarif       # SARIF for CI/CD
└── poc-full/            # Per-finding PoC .txt artifacts

🎯 PoC 格式示例

═══════════════════════════════════════════════════════════════
  SQL Injection on 'id' — https://target.com:4280/page
═══════════════════════════════════════════════════════════════

Request:
  GET /page?id=1'+AND+1=1-- HTTP/1.1
  Host: target.com:4280

Response:
  HTTP/1.1 200 OK
  [Page content with true condition]

Severity: Critical (CVSS 9.8)
Remediation: Use parameterized queries / prepared statements.
═══════════════════════════════════════════════════════════════

🔒 安全规则

规则	描述
⚠️ 授权	仅对已授权的目标运行
📖 只读	默认模式，使用 --no-exploit
🚫 无破坏性	无 DoS，无数据破坏
⏱️ 超时	所有探测均使用短超时
🔐 安全 SQLi	--batch 模式，限制 level/risk

---

📚 CLI 参考

python3 pentx.py <target> [output] [options]

Options:
  --phase N           Run single phase (1-5)
  --no-exploit        Skip Phase 4 (exploitation)
  --fast              Skip nmap + nuclei, fast scan
  --skip-nmap         Skip nmap scan
  --skip-nuclei       Skip nuclei scan
  --target-port N     Override target port
  --timeout N         Per-phase timeout (default: 300s)
  --check             Check tool availability
  --report <dir>      Regenerate report from output dir
  --tools <cmd>       Tool manager: status|install|list|auto
  --owscan <url>      Run owscan standalone

🏆 赞助方

---

🙏 致谢

项目	描述	链接
onex	Kali 黑客工具安装器	jackind424/onex
owscan	Web 漏洞扫描器	gameye98/owscan
nuclei	基于模板的扫描器	projectdiscovery/nuclei
sqlmap	SQLi 自动化	sqlmapproject/sqlmap
ffuf	Web 模糊测试器	ffuf/ffuf

---

📄 许可证

MIT 许可证 — 详情请参阅 LICENSE。

---