asta-pentest 1.0.1

Industrial-grade penetration testing framework — recon, exploit, C2, post-exploit, AD

⚔️ Asta — Full-Spectrum Penetration Testing Framework

Passive Recon · Active Scanning · Deep Enumeration · Exploitation · C2 · AI Analysis

  ╔══════════════════════════════════════════════════════════════════════╗
  ║  Passive → Active → Enumerate → Exploit → Post-Exploit → C2 → AI   ║
  ║  Full kill chain. One pipeline. AI-powered analysis.                ║
  ╚══════════════════════════════════════════════════════════════════════╝

---

⚡ Quick Start

# Install from PyPI
pip install asta-pentest

# Or clone and install from source
git clone https://github.com/AridsWolfgang/Asta.git && cd Asta
pip install -e .[full]

# Create your config (never commit real keys)
asta --init

# Edit config.yaml with your API keys, then:
asta -t example.com

# Full kill chain (authorized targets only)
asta -t target.com --exploit --yes

---

🧠 AI-Powered Analysis

Asta integrates with LLM providers to give you post-scan intelligence — no more staring at raw JSON.

Supported Providers (free + paid)

Provider	Cost	Key Required	Models
Groq	Free	Yes — console.groq.com	Llama 3 8B/70B, Mixtral
GitHub Models	Free	Yes — GitHub token	GPT-4o-mini, Llama, Mistral
OpenRouter	Pay-as-you-go	Yes — openrouter.ai/keys	200+ models (DeepSeek, GPT, Claude, Gemini)
DeepSeek	Paid	Yes — platform.deepseek.com	deepseek-chat
OpenAI	Paid	Yes — platform.openai.com	GPT-4o, GPT-4o-mini

Setup

# config.yaml (add your key — gitignored by default)
llm:
  provider: openrouter              # Switch providers here
  model: "openai/gpt-4o-mini"      # Leave empty for default
  auto_analysis: true               # Run AI after every scan
  explain_cves: true                # Explain CVEs in plain language
  summarize: true                   # Attack surface summary
  remediate: true                   # Remediation suggestions
  api_keys:
    groq: ""
    deepseek: "sk-..."              # Or use one key for everything
    openrouter: "sk-or-v1-..."
    github: ""
    openai: ""

Usage

# Auto-analysis runs after every scan (toggle with --no-ai)
asta -t example.com

# One-shot question about scan results
asta -t example.com --query "What are the most critical findings?"

# Interactive REPL — ask anything about the scan
asta -t example.com --query
asta> what ports are open?
asta> any SQL injection vectors?
asta> how do I remediate the XSS?
asta> exit

# Override provider from CLI
asta -t example.com --llm-provider groq

What AI Analyzes

• CVE Explanation — Translates raw CVE IDs into plain-English risk descriptions
• Attack Surface Summary — Lists critical entry points in priority order
• Remediation Steps — Actionable fixes for each finding, severity-ranked
• Custom Queries — Ask anything: "which services are outdated?", "is there a path to domain admin?"

---

🏗️ Architecture

┌──────────────────────────────────────────────────────────────────────────┐
│                         CLI / Web Platform                               │
│  asta --web  (unified SPA: dashboard, scans, C2, results)               │
│  asta -t target  (CLI mode)                                              │
└──────────────────────────────┬───────────────────────────────────────────┘
                               │
                               ▼
┌──────────────────────────────────────────────────────────────────────────┐
│               Core — ReconOrchestrator                                   │
│  Phase gating · Plugin hooks · SQLite DB · Proxy mgmt · Diffing         │
└──┬──────┬──────┬──────┬──────┬──────┬──────┬──────┬──────┬──────┬──────┘
   │      │      │      │      │      │      │      │      │      │
   ▼      ▼      ▼      ▼      ▼      ▼      ▼      ▼      ▼      ▼
 ┌────┐ ┌────┐ ┌────┐ ┌────┐ ┌────┐ ┌────┐ ┌────┐ ┌────┐ ┌────┐ ┌────┐
 │P1  │ │P2  │ │P3  │ │P4  │ │P5  │ │P6  │ │ C2 │ │ LLM│ │Web │ │Rep │
 │Ps  │ │Act │ │Enum│ │Exp │ │PE  │ │Crk │ │Srv │ │AI  │ │Plat│ │ort │
 ├────┤ ├────┤ ├────┤ ├────┤ ├────┤ ├────┤ ├────┤ ├────┤ ├────┤ ├────┤
 │•DNS│ │•Pr │ │•S3 │ │•Vul│ │•Pr │ │•Hsh│ │•WS │ │•CVE│ │•Dsh│ │•Jsn│
 │•WIS│ │ Sc │ │•CVE│ │nSc │ │ivEs│ │•Wrd│ │•AES│ │•Sum│ │•Scn│ │•Htm│
 │•Sub│ │•Sv │ │•WAF│ │•Web│ │•Cred│ │list│ │•Cmd│ │•Rem│ │•C2 │ │•CSV│
 │•OSI│ │cDe │ │•Nik│ │•Brt│ │•Piv│ │    │ │•Exf│ │•Que│ │•Rst│ │•XML│
 │•Drk│ │•Htp│ │•WP │ │•Exp│ │•BH │ │    │ │    │ │    │ │•Rep│ │    │
 │•Mal│ │•JS │ │•e4l│ │•MSF│ │•Krb│ │    │ │    │ │    │ │    │ │    │
 │•Soc│ │•SS │ │•Gw │ │•Hyd│ │•Mmk│ │    │ │    │ │    │ │    │ │    │
 │    │ │•Nm │ │•Hyd│ │    │ │•Ltr│ │    │ │    │ │    │ │    │ │    │
 │    │ │•UDP│ │    │ │    │ │    │ │    │ │    │ │    │ │    │ │    │
 │    │ │•OS │ │    │ │    │ │    │ │    │ │    │ │    │ │    │ │    │
 │    │ │•Msc│ │    │ │    │ │    │ │    │ │    │ │    │ │    │ │    │
 │    │ │•Gau│ │    │ │    │ │    │ │    │ │    │ │    │ │    │ │    │
 │    │ │•Sbf│ │    │ │    │ │    │ │    │ │    │ │    │ │    │ │    │
 └────┘ └────┘ └────┘ └────┘ └────┘ └────┘ └────┘ └────┘ └────┘ └────┘
   │      │      │      │      │      │      │      │      │      │
   └──────┴──────┴──────┴──────┴──────┴──────┴──────┴──────┴──────┘
                               │
                   ┌───────────┴───────────┐
                   │  SQLite · Stealth ·   │
                   │  Plugins · Webhooks   │
                   └───────────────────────┘

---

🎯 Features — The Full Stack

Phase 1: Passive Reconnaissance — Zero packets sent

Module	Technique	Output
dns	System resolver + public DNS	A, AAAA, MX, NS, TXT, CNAME, SOA; zone transfer attempt
whois	WHOIS / RDAP	Registrar, org, emails, nameservers, dates
subdomains	crt.sh, AlienVault, URLScan, Wayback, HackerTarget, DNS brute	Subdomains with source attribution
osint	Shodan, SecurityTrails, Censys, VirusTotal	Open ports, technologies, DNS history
dorking	GitHub code search, GitLab	Secrets, config files, internal paths
email_harvester	WHOIS contacts, page scraping, regex	Email addresses with source URLs
social_osint	30+ platform username check + email breach + Hunter.io	Social footprint, breached accounts, domain emails

Phase 2: Active Reconnaissance — Touching the target

Module	Technique	Details
port_scanner	Async TCP connect (asyncio)	4 profiles: fast (20), basic (100), medium (1000), full (65535)
syn_scanner	Raw SYN packets (Scapy)	Half-open stealth scan; requires admin/root
nmap_integration	Wraps nmap binary	Auto-detect, scan type (-sS/-sT/-sU), timing T0-T5, -sV, -O, NSE scripts
masscan	Wraps masscan binary	Ultra-fast port scan at configurable rates
udp_scanner	Async UDP probes with service payloads	DNS, SNMP, NTP, SSDP, mDNS — 26 common UDP ports
service_detection	Banner grab + SSL probe	Connects to open ports, reads banners; HTTP/SSH probes
os_detection	TTL analysis + banner match + keyword FP	Windows vs Unix/Linux guess with confidence score
web_enum	HTTP GET probes + directory fuzz	Status codes, titles, server headers
tech_fingerprint	40+ signature patterns	Web servers, CMS, JS frameworks, CDNs, analytics
httpx	Wraps httpx binary	HTTP probing, tech detection, virtual host discovery
ffuf	Wraps ffuf binary	Directory and file fuzzing with wordlist
subfinder	Wraps subfinder binary	Passive subdomain discovery from 30+ sources
sslscan	Wraps sslscan binary	TLS cipher/protocol deep assessment
gau	Wraps gau binary	Archive URL discovery (Wayback, AlienVault, CommonCrawl)
js_extract	Download + regex scan	API endpoints, secrets, internal IPs in JavaScript

Phase 3: Deep Enumeration — Beyond the surface

Module	Technique	Detection Target
cloud_assets	URL probe	Open S3 buckets, CloudFront, Firebase, GCP/Azure storage
vuln_checks	Path-based probes	Git exposure, backups, phpinfo, admin panels, debug endpoints
cve_matcher	Version extraction → DB lookup	50+ critical CVEs matched against service banners
waf_detection	Header/cookie/body analysis	35+ WAF signatures: CloudFlare, ModSecurity, F5, Akamai, Imperva
nikto	Wraps nikto binary	~7000 dangerous files/CGIs, outdated software, misconfigs
wpscan	Wraps wpscan binary	WordPress plugin/theme/user enumeration (auto-detect WP)
enum4linux	Wraps enum4linux-ng	SMB/RPC enumeration: shares, users, groups, password policy
gowitness	Wraps gowitness binary	Headless Chrome screenshots with HTML gallery
hydra	Wraps hydra binary	Online brute-force against SSH/FTP with discovered usernames

Phase 4: Exploitation ⚠️ Requires --exploit --yes

Module	Technique	Attack Surface
vuln_scanner	TLS/cert analysis, security headers, CORS, default creds	Weak ciphers, expired certs, misconfigurations
web_attacks	SQLi, XSS, LFI, SSRF, CMDi, SSTI, XXE, open redirect, IDOR, GraphQL	Web application OWASP Top 10
waf_bypass	Encoding, case variation, comment insertion	Cloudflare, ModSecurity, AWS WAF bypass
bruteforce	HTTP form bruteforce, FTP, SSH credential testing	Weak credentials using harvested usernames
exploit_engine	Maps CVEs → Metasploit modules → exploit chains	Automated exploit matching with cascading attacks
payload_gen	Reverse shells + webshells	bash, python, php, powershell; php, asp, aspx, jsp webshells
msf_integration	Wraps msfconsole	Direct module execution, .rc resource scripts, session/loot capture

Phase 4b: Password Cracking

Module	Technique	Details
hashcat	Wraps hashcat binary	30+ hash type auto-detection by signature (MD5, NTLM, bcrypt, Kerberos, WPA-PBKDF2, etc.)
wordlist	GitHub downloads + merge/dedup	rockyou, SecLists, Probable-Wordlists

Phase 5: Post-Exploitation — Inside the wire

Module	Capability	Purpose
reverse_shell	Async TCP listener, session mgmt	Catch shells from exploited targets
privesc	Linux kernel exploit check, SUID/GTFO bins, sudo/cron	Escalate to root
pivot_scan	ARP sweep, port scan through active session	Lateral movement
cred_dump	Credential extraction, browser password store	Credential harvesting
bloodhound	BloodHound collector	AD attack path mapping
kerberos	Kerberos attack tooling	Ticket attacks, AS-REP roasting
mimikatz	Mimikatz loader	Credential dumping via reflection
lateral_movement	WMI/SSH lateral movement	Move across the network

AI Analysis (Post-Scan)

Feature	Description
CVE Explanation	Translates raw CVE IDs into plain-English risk descriptions
Attack Surface Summary	Lists critical entry points in priority order
Remediation Suggestions	Actionable fixes for each finding, severity-ranked
Interactive Query	Ask questions about scan results in natural language

C2 Infrastructure

Component	Technology	Features
C2Server	aiohttp WebSocket	AES-256-GCM encryption, session mgmt, task dispatch
Implant (Go)	Native Go agent	Beacon, command exec, file exfil, screenshot, persistence, evasion
Profiles	DNS / HTTPS / mTLS / WebSocket	Multiple C2 profiles for stealth
CryptoLayer	AES-256-GCM	Key rotation, encrypt/decrypt, key derivation

Web Platform — http://127.0.0.1:8080

Page	Features
Dashboard	Stats cards (scans/ports/CVEs), launch scan form, recent scans, live SSE events
Scans	Full history table, phase-by-phase JSON detail
C2 Console	Session list, xterm.js terminal, command history
Results	Phase-tabbed findings browser with severity filter
Reports	Download generated reports (JSON, HTML, CSV, XML)

---

🚀 CLI Reference

Basic

asta -t example.com                    # Full scan (passive + active + enum + AI)
asta -t example.com --passive-only     # Passive recon only
asta -t example.com --active-only      # Active recon only
asta -t example.com --enum-only        # Enumeration only

Scan Profiles

asta -t example.com --scan-profile fast    # 20 ports (~30s)
asta -t example.com --scan-profile basic   # 100 ports (~2min) [default]
asta -t example.com --scan-profile medium  # 1000 ports (~10min)
asta -t example.com --scan-profile full    # 65535 ports (~hours)

Module Toggles

asta -t example.com --no-cve       # Skip CVE matching
asta -t example.com --no-waf       # Skip WAF detection
asta -t example.com --no-dork      # Skip GitHub/GitLab dorking
asta -t example.com --no-email     # Skip email harvesting

Stealth & Evasion

asta -t example.com --tor                   # Route through Tor
asta -t example.com --proxies "http://p1:8080,http://p2:8080"  # Proxy rotation

AI Analysis

asta -t example.com                       # Auto AI analysis after scan
asta -t example.com --no-ai               # Skip AI analysis
asta -t example.com --llm-provider groq   # Use specific provider
asta -t example.com --query               # Interactive query REPL
asta -t example.com --query "List all open services with versions"  # One-shot

Advanced

asta -t example.com --scan-profile full --syn-scan     # Full stealth SYN scan
asta -t example.com --exploit --yes                     # Full kill chain with exploitation
asta -t example.com --debug                             # Debug logging
asta -t example.com -o ./my-reports                     # Custom output directory

Servers

asta --web                          # Web platform (dashboard + C2 + terminal)
asta --c2 --c2-port 8443            # C2 server only
asta --api                          # REST API
asta --dashboard                    # Legacy dashboard
asta --schedule "0 3 * * *" -t example.com  # Scheduled scans

---

📋 Configuration

Asta reads from config.yaml by default. Copy the template and customize:

cp config.example.yaml config.yaml   # config.yaml is gitignored

Key Sections

# Target (can be overridden with -t)
target: ""

# API keys for external intelligence sources
api_keys:
  shodan: ""
  censys: ""
  securitytrails: ""
  github: ""
  gitlab: ""

# LLM / AI analysis
llm:
  provider: openrouter
  model: "openai/gpt-4o-mini"
  auto_analysis: true
  api_keys:
    groq: ""
    deepseek: ""
    github: ""
    openai: ""
    openrouter: "sk-or-v1-..."

# Module toggles
modules:
  passive:
    enabled: true
    dns: true
    whois: true
    subdomains: true
    osint: true
    dorking: true
    email_harvest: true
    social_osint: true
  active:
    enabled: true
    port_scan: true
    service_detection: true
    web_enum: true
    syn_scan: false             # Requires admin/root + scapy
    nmap_scan: true
    udp_scan: true
    os_detection: true
    masscan: true
    ffuf: true
    httpx: true
    subfinder: true
    sslscan: true
    gau: true
  enumeration:
    enabled: true
    cloud_assets: true
    vuln_checks: true
    attack_surface: true
    cve_matching: true
    waf_detection: true
    nikto: true
    wpscan: true
    enum4linux: true
    gowitness: true
    hydra: true
  exploit:
    enabled: false              # MUST opt in via --exploit --yes
  cracking:
    enabled: false
    hashcat: true
  post_exploit:
    enabled: false

See config.example.yaml for the full reference.

---

🛠️ Installation & Dependencies

Python Dependencies

Package	Required	Purpose
aiohttp>=3.9	✅	Async HTTP client + server, WebSocket, LLM API calls
PyYAML	✅	Config parsing
jinja2	✅	HTML report templates
beautifulsoup4	✅	HTML parsing
rich>=13.0	✅	Terminal UI: spinners, panels, tables, themes
dnspython	❌	Advanced DNS queries (installed by default)
scapy	❌	SYN scan (raw packets)
cryptography	❌	C2 channel encryption
pycryptodome	❌	Credential cracking tools

External Tools (auto-detected at runtime)

Install any for enhanced capability:

• nmap — Advanced port scanning with OS detection and NSE scripts
• masscan — Ultra-fast port scanning (millions of packets/sec)
• ffuf — Web directory fuzzing
• httpx — HTTP probing and tech detection
• subfinder — Passive subdomain discovery
• sslscan — TLS cipher/protocol assessment
• gau — Archive URL discovery
• nikto — Web server vulnerability scanner
• wpscan — WordPress vulnerability scanner
• enum4linux-ng — SMB/RPC enumeration
• gowitness — Web screenshots
• hydra — Online brute-force attacks
• hashcat — Offline password cracking

Development Install

git clone https://github.com/AridsWolfgang/Asta.git && cd Asta
python -m venv .venv
.venv\Scripts\activate     # Windows
source .venv/bin/activate   # Linux/macOS
pip install -e .[full]

# Or install minimal (core only)
pip install -e .

# Optional extras
pip install cryptography    # C2 encryption
pip install scapy           # SYN scan

---

⚡ Performance

Asta's architecture is built for speed. Each phase maximizes concurrency while respecting dependency chains:

PHASE 1 (Passive)         PHASE 2 (Active)           PHASE 3 (Enumeration)
────────────────────     ──────────────────────      ─────────────────────
┌─ DNS ─┐                Port Scan (serial)          Cloud Assets
├─ WHOIS┤                ╲                            Vuln Checks
├─ Subdo├─ asyncio.gather ╲  ┌─ SYN Scan ─┐           Attack Surface
├─ OSINT┤                ╱  ├─ Nmap ──────┤           Nikto + WPScan +
├─ Dork ├─ 7 modules    ╱   ├─ Masscan ───┤           Enum4linux + GoWit
├─ Email│               ╱   ├─ UDP Scan ──┤─ gather   ness + Hydra (opt)
└─ Social┘              ╱   ├─ Srv Detect─┤           Plugin tasks gather
↓ sequential after     ╱    ├─ Subfinder ─┤
  gather (zone xfer,  ╱     ├─ SSLScan ───┤
  email_harvest on   ╱      ├─ Gau ───────┤
  whois results)   ╱        └─ Proxy Test─┘
                  ╱         ↓
                 ╱        Web Enumeration + chain
                ╱         (tech_fp → httpx → ffuf →
               ╱           js_extract → cve_match → waf)
              ╱
            Plugin tasks gather

                                    PHASE 4 (Post-Scan)
                                    ┌─────────────────┐
                                    │ AI Analysis      │
                                    │ ┌─ CVE Explain ─┤
                                    │ ├─ Summary ─────┤
                                    │ ├─ Remediation ─┤
                                    │ └─ Query REPL ──┤
                                    └─────────────────┘

Optimizations

Optimization	Before	After
Inline imports	~50 from ..submodule import x inside functions	Zero — all hoisted to module top
Passive phase	7 modules in strict sequence	7 modules via asyncio.gather
Active phase	15+ modules in strict sequence	Port scan → 11 modules in parallel via asyncio.gather
Phase plugins	Sequential for loop	asyncio.gather with return_exceptions=True
Rate limiter	Shared deque with time.time (race condition)	Token bucket with asyncio.Lock + loop.time()
Database inserts	Row-by-row for+execute	executemany batch inserts
Report generation	Sync file I/O, sequential formats	Async I/O via aiofiles, formats in parallel
Config defaults	Rebuilt on every access	Cached after first build, copy.deepcopy thereafter
Plugin discovery	Re-scanned on every access	Cached after first call
Nmap integration	subprocess.run (blocking)	create_subprocess_exec + tempfile.mkstemp
LLM analysis	None	Async API calls via asyncio.gather with 45s timeout

---

📁 Project Structure

├── config.example.yaml           # Configuration template (copy to config.yaml)
├── pyproject.toml                # Package metadata & dependencies
└── asta/
    ├── cli.py                    # Argument parsing + dispatch + query REPL
    ├── config.py                 # YAML loader with deep merge
    ├── core/
    │   └── orchestrator.py       # 5-phase pipeline controller + LLM analysis
    ├── phases/
    │   ├── passive/              # DNS, WHOIS, subdomains, OSINT, dorking, email, social
    │   ├── active/               # Port scan, SYN, nmap, masscan, UDP, OS detect,
    │   │                         # service detect, web enum, tech FP, JS extract,
    │   │                         # httpx, ffuf, subfinder, sslscan, gau
    │   ├── enumeration/          # Cloud assets, CVE matcher, WAF detect, vuln checks,
    │   │                         # nikto, wpscan, enum4linux, gowitness, hydra
    │   ├── exploit/              # Vuln scanner, web attacks, WAF bypass, bruteforce,
    │   │                         # exploit engine, payload gen, msf integration
    │   ├── cracking/             # Hashcat wrapper, wordlist manager
    │   └── post_exploit/         # Reverse shell, privesc, pivot, cred dump,
    │                             # bloodhound, kerberos, mimikatz, lateral move
    ├── infrastructure/
    │   ├── llm/                  # AI/LLM client (multi-provider) + analysis functions
    │   ├── stealth/              # Proxy rotation, user-agent rotation
    │   ├── storage/              # SQLite database (scans, findings, targets)
    │   └── utils/                # Terminal UI, logging, rate limiter, webhooks
    ├── c2/                       # C2 server, encryption, Go implant, profiles
    ├── reporting/                # JSON, HTML, CSV, Nmap/Nessus/Burp XML exporters
    ├── interfaces/web/           # Unified SPA: dashboard + scans + C2 + results + reports
    └── plugins/                  # Plugin loader + hook system

---

📊 Database

Location: data/asta.db (auto-created)

-- Latest scan for a target
SELECT * FROM scans WHERE target = 'example.com' ORDER BY scan_date DESC LIMIT 1;

-- All findings for a scan phase
SELECT * FROM findings WHERE category LIKE 'active%' LIMIT 50;

-- Cross-scan diff
SELECT * FROM findings WHERE scan_id IN (1, 2) AND category = 'open_port';

-- Compare current vs last scan
asta --diff -t example.com

---

🔐 Security Notes

• API keys — config.yaml is gitignored. Use config.example.yaml as template.
• Exploitation — Requires explicit --exploit --yes flag. Never runs automatically.
• Rate limiting — Default 10 req/s with jitter. Adjust for stealth.
• Proxy support — HTTP proxy rotation, Tor SOCKS5 routing.
• Random User-Agent — Enabled by default to evade basic fingerprinting.

---

⚖️ Legal

Only use this tool on systems you own or have explicit written authorization to test. Unauthorized access is illegal in most jurisdictions.

Authorized use cases: Penetration tests (signed ROE), bug bounty hunting (in-scope), CTF competitions, security research on your own infrastructure.

---

MIT License · Built for the offensive security community

Report Bug · Request Feature