DEV Community: exelumare

[Release] TànPhá V3: A state-machine based Pentesting Framework for Termux & Linux (Open Source).

exelumare — Sat, 31 Oct 2026 19:07:14 +0000

A few days ago, I posted an early version of my open-source pentest tool. I received some great feedback, so I went back to the drawing board and completely rewrote the architecture.

TànPhá Framework V3 is now live!

I built this specifically for bug hunters and security researchers who are limited to mobile devices (Termux on Android) or lightweight Linux environments. It doesn't require a high-end laptop to run.

🚀 What's New in V3?

Auto Assessment Engine: Migrated to a state-machine architecture to handle Discovery, Fingerprinting, and Validation automatically.

New Modules: Added LFI (with •php://filter\ support) and PHP2Shell (a stateful RAT with file upload/download).

•Auto Login Engine: Automatically detects and bypasses CSRF tokens to scan authenticated pages.

•Global Ready: 100% English native codebase, prompts, and outputs.

•JSON Reporting: Auto-saves findings to the reports/\ directory.

⚠️ Honest Limitations (Let's be real)

•WAF Bypass: Currently only supports basic evasion (Level 1). Advanced evasion (Chunked encoding, Origin IP) is planned for V4.

•DVWA High: The SQLi engine works perfectly on Low/Medium, but struggles with High (due to stateful session inputs). That's on the V4 roadmap!

🗺️ What's Next? (V4 Roadmap)

This project is actively maintained. Here is what I'm planning to build next:

•Advanced WAF Evasion: Level 2 (Chunked Encoding) & Level 3 (Origin IP Discovery).

•New Modules: XSS, SSRF, and Subdomain Enumeration.

•Headless Mode: CLI arguments (python main.py -u target -m sqli\) for CI/CD automation.

•HTML/PDF Reporting: Generate client-ready reports.

Let me know in the comments if you want a specific feature added to the roadmap!

Note: This tool is for educational purposes and authorized testing only. Please use it responsibly.

I'd love to hear your feedback, bug reports, or feature requests. If you find it useful, a star on GitHub would mean a lot! ⭐

GitHub Link: (https://github.com/exelumare/T-nPh--framework)

Building TànPhá: How I Built a Modular CLI Security Framework in Python Using Termux

exelumare — Tue, 27 Oct 2026 17:08:16 +0000

Hey Dev.to community! 👋

I wanted to share a project I’ve been passionately building entirely on my Android phone using Termux: a lightweight, modular CLI-based automated security testing framework called TànPhá Framework.

💡 Why I Built It
Most security frameworks are either too bloated or require full desktop setups just to run basic automated chains. As someone learning Python and software architecture directly on a mobile device, I wanted to challenge myself to create a tool focused on full-chain execution—moving straight from vulnerability verification to interactive shell access without manual hassle.

⚙️ How It Works & Architecture
The framework is designed to be fully modular and cross-platform (Linux, Windows, and Android/Termux). It avoids heavy external dependencies, relying on clean Python code to handle request chains.

Currently, TànPhá includes:

Arbitrary File Upload Engine: Automatic parameter detection, magic-byte/extension bypass, and instant webshell deployment.
Command Injection Engine: Automated separator variations and WAF-bypass payload encoding.
SQL Injection Engine: Error/Union-based parameter fuzzing.
PHP2Shell Core: An interactive HTTP POST-based command execution engine (RAT/Webshell controller)

.
🛠️ Challenges of Developing on Mobile
Coding an entire framework on a smartphone screen via Termux definitely comes with unique challenges:

Managing clean project directory structures without a full desktop IDE.
Optimizing Python execution speed so it runs smoothly on mobile architecture.
Ensuring all modules properly handle terminal control signals and cross-platform paths.

🚀 What's Next?
The project is completely open-source and I'm currently looking for feedback, code reviews, or ideas for new automated modules (like LFI-to-RCE chains or network credential assessment).

🔗 Check out the repository on GitHub: https://github.com/exelumare/T-nPh--framework

I'd love to hear your thoughts, suggestions, or constructive critiques in the comments below!