[Release] TànPhá V3: A state-machine based Pentesting Framework…

A few days ago, I posted an early version of my open-source pentest tool. I received some great feedback, so I went back to the drawing board and completely rewrote the architecture.

TànPhá Framework V3 is now live!

I built this specifically for bug hunters and security researchers who are limited to mobile devices (Termux on Android) or lightweight Linux environments. It doesn't require a high-end laptop to run.

🚀 What's New in V3?

Auto Assessment Engine: Migrated to a state-machine architecture to handle Discovery, Fingerprinting, and Validation automatically.

New Modules: Added LFI (with \`php://filter\` support) and PHP2Shell (a stateful RAT with file upload/download).

Auto Login Engine: Automatically detects and bypasses CSRF tokens to scan authenticated pages.

Global Ready: 100% English native codebase, prompts, and outputs.

JSON Reporting: Auto-saves findings to the \`reports/\` directory.

⚠️ Honest Limitations (Let's be real)

WAF Bypass: Currently only supports basic evasion (Level 1). Advanced evasion (Chunked encoding, Origin IP) is planned for V4.

DVWA High: The SQLi engine works perfectly on Low/Medium, but struggles with High (due to stateful session inputs). That's on the V4 roadmap!

🗺️ What's Next? (V4 Roadmap)

This project is actively maintained. Here is what I'm planning to build next:

Advanced WAF Evasion: Level 2 (Chunked Encoding) & Level 3 (Origin IP Discovery).

New Modules: XSS, SSRF, and Subdomain Enumeration.

Headless Mode: CLI arguments (\`python main.py -u target -m sqli\`) for CI/CD automation.

HTML/PDF Reporting: Generate client-ready reports.

Let me know in the comments if you want a specific feature added to the roadmap!

Note: This tool is for educational purposes and authorized testing only. Please use it responsibly.

I'd love to hear your feedback, bug reports, or feature requests. If you find it useful, a star on GitHub would mean a lot! ⭐

GitHub Link: https://github.com/exelumare/T-nPh--framework

Impact

This framework enables security researchers and penetration testers to perform automated vulnerability discovery and exploitation on web applications from mobile or lightweight Linux environments. It supports multiple attack vectors including SQL injection, command injection, file upload, and local file inclusion, which can lead to unauthorized access, remote code execution, and post-exploitation capabilities via a stateful PHP RAT. The tool's automation and CSRF bypass features increase testing efficiency. However, it is designed for authorized testing and educational use only. There is no indication of malicious use or exploitation in the wild from the provided data.

Defensive guidance

This is a penetration testing tool intended for authorized security assessments. No mitigation is required against the tool itself. Organizations should ensure they have proper authorization and monitoring in place to detect unauthorized use of such tools within their environments. Users of the tool should operate it responsibly and only against targets with explicit permission.

Summary

TànPhá Framework V3 is a CLI-based penetration testing and auto-attack tool tailored for mobile and lightweight Linux systems. It employs a state-machine engine to automate the phases of penetration testing such as discovery, fingerprinting, assessment, validation, and reporting. The framework includes modules for SQL injection (error-based, boolean-based, time-based blind), command injection, file upload with polyglot magic byte bypass, local file inclusion with php://filter support, and a PHP2Shell post-exploitation RAT with stateful directory tracking. It automatically detects and bypasses CSRF tokens to scan authenticated pages and implements basic WAF evasion techniques. The tool generates JSON reports and is designed for bug hunters and security researchers limited to mobile or low-resource environments. Future updates aim to add advanced WAF evasion, new exploit modules (XSS, SSRF, subdomain enumeration), headless CLI operation, and enhanced reporting. The tool is open source and intended for ethical use only.

[Release] TànPhá V3: A state-machine based Pentesting Framework for Termux & Linux (Open Source).

Discussion

Links cited in the discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 1 Nov 2026, 11:13 UTC

Technical details

References

Community reviews

Related threats