pentool 1.0.0__tar.gz

pentool-1.0.0/LICENSE

@@ -0,0 +1,34 @@
+GNU AFFERO GENERAL PUBLIC LICENSE
+Version 3, 19 November 2007
+
+Copyright (C) 2026 Pentool Project
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published
+by the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+---
+
+Additional Terms:
+
+This software is dual-licensed:
+
+1. Community Edition: AGPL-3.0 (this license)
+   - Free for personal and open-source use
+   - Source code modifications must be shared
+
+2. Commercial/PRO Edition: Commercial License
+   - Contact: sales@pentool.dev
+   - For proprietary/closed-source use
+   - Includes enterprise features and support
+
+For commercial licensing inquiries, please contact: sales@pentool.dev

pentool-1.0.0/PKG-INFO

@@ -0,0 +1,155 @@
+Metadata-Version: 2.4
+Name: pentool
+Version: 1.0.0
+Summary: Modern Web Pentesting TUI - Professional security testing tool
+Author-email: Pentool Team <dev@pentool.pro>
+License: AGPL-3.0
+Project-URL: Homepage, https://github.com/pentool/pentool
+Project-URL: Documentation, https://pentool.dev/docs
+Project-URL: Repository, https://github.com/pentool/pentool
+Project-URL: Issues, https://github.com/pentool/pentool/issues
+Project-URL: Changelog, https://github.com/pentool/pentool/blob/main/CHANGELOG.md
+Keywords: pentesting,security,burp,proxy,scanner,intruder
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Topic :: Security
+Classifier: License :: OSI Approved :: GNU Affero General Public License v3
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Operating System :: OS Independent
+Classifier: Environment :: Console
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: textual>=0.40.0
+Requires-Dist: aiohttp>=3.9.0
+Requires-Dist: aiosqlite>=0.19.0
+Requires-Dist: beautifulsoup4>=4.12.0
+Requires-Dist: click>=8.1.0
+Requires-Dist: cryptography>=41.0.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: rich>=13.0.0
+Provides-Extra: dev
+Requires-Dist: pytest>=7.4.0; extra == "dev"
+Requires-Dist: pytest-asyncio>=0.21.0; extra == "dev"
+Requires-Dist: pytest-cov>=4.1.0; extra == "dev"
+Requires-Dist: pytest-timeout>=2.1.0; extra == "dev"
+Requires-Dist: ruff>=0.1.0; extra == "dev"
+Requires-Dist: mypy>=1.5.0; extra == "dev"
+Requires-Dist: pre-commit>=3.4.0; extra == "dev"
+Dynamic: license-file
+
+# 🔐 Pentool — Modern Web Pentesting TUI
+
+[![PyPI version](https://badge.fury.io/py/pentool.svg)](https://badge.fury.io/py/pentool)
+[![Python](https://img.shields.io/pypi/pyversions/pentool)](https://pypi.org/project/pentool/)
+[![License: AGPL-3.0](https://img.shields.io/badge/License-AGPL--3.0-blue.svg)](LICENSE)
+[![Tests](https://github.com/docx/pentool/actions/workflows/ci.yml/badge.svg)](https://github.com/docx/pentool/actions)
+
+**Pentool** is a fast, modular web security testing tool with a terminal UI. Built for pentesters and security researchers who prefer working in the terminal.
+
+```bash
+pip install pentool
+pentool
+```
+
+---
+
+## ✨ Features
+
+- **🌐 Proxy** — Intercept and modify HTTP/HTTPS traffic in real time, manage scope, apply match & replace rules
+- **🔄 Repeater** — Replay requests with any modifications, persist tabs between sessions
+- **💥 Intruder** — Automated attacks with 4 strategies: Sniper, Battering Ram, Pitchfork, Cluster Bomb
+- **🚀 Turbo Intruder** — 10× speed via HTTP Keep-Alive and connection pooling (100–200 req/sec)
+- **🔍 Scanner** — Detect SQLi, XSS, SSTI, LFI, RCE, SSRF, XXE and more (active + passive modes)
+- **🕷 Spider** — Crawl sites automatically, collect pages, forms and JS endpoints
+- **🎯 Target / Site Map** — Build a site map and manage testing scope from the UI
+- **🔐 Decoder + Comparer + Sequencer** — Encode/decode, diff requests, analyze token entropy
+- **🧩 Plugin system** — Extend functionality without recompiling
+- **⚡ Async core** — Fully async, optimized for high load
+- **🆓 Open Source + PRO** — Free base, optional PRO license for advanced features
+
+---
+
+## 📦 Installation
+
+**Requirements:** Python 3.10+, Linux / macOS / Windows
+
+```bash
+pip install pentool
+```
+
+From source:
+
+```bash
+git clone https://github.com/docx/pentool.git
+cd pentool
+pip install -e ".[dev]"
+```
+
+---
+
+## 🚀 Quick Start
+
+```bash
+# Launch the TUI
+pentool
+
+# Start proxy on custom port
+pentool proxy start --port 8080
+
+# Run active scan
+pentool scan active --url https://example.com
+```
+
+---
+
+## 💰 Pricing
+
+| Plan | Price | Features |
+|------|-------|----------|
+| **Free** | $0 | Proxy, Repeater, Intruder, Decoder | 
+| **Lite** | $29/mo | + Scanner, Spider, Match & Replace |
+| **Medium** | $99/mo | + WebSocket, Plugins, Turbo Mode |
+| **Full** | $299/mo | + PRO Reports, API, Unlimited |
+
+[Get PRO license →](https://pentool.pro)
+
+---
+
+## 🤝 Support the project
+
+Pentool is developed in free time. If it helps your work, consider supporting:
+
+- [GitHub Sponsors](https://github.com/sponsors/docx)
+- [Buy PRO license](https://pentool.pro) — also supports development
+
+---
+
+## 📖 Documentation
+
+- [Quick Start](docs/QUICKSTART.md)
+- [User Guide](docs/user/)
+- [Architecture](docs/ARCHITECTURE_AUDIT.md)
+- [API Reference](docs/API_CONTRACTS.md)
+
+---
+
+## 🧪 Tests
+
+```bash
+pytest tests/unit/ -q
+```
+
+---
+
+## 🤝 Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md). Report vulnerabilities to security@pentool.pro.
+
+## 📄 License
+
+Community Edition: [AGPL-3.0](LICENSE) · PRO Edition: Commercial

pentool-1.0.0/README.md

@@ -0,0 +1,111 @@
+# 🔐 Pentool — Modern Web Pentesting TUI
+
+[![PyPI version](https://badge.fury.io/py/pentool.svg)](https://badge.fury.io/py/pentool)
+[![Python](https://img.shields.io/pypi/pyversions/pentool)](https://pypi.org/project/pentool/)
+[![License: AGPL-3.0](https://img.shields.io/badge/License-AGPL--3.0-blue.svg)](LICENSE)
+[![Tests](https://github.com/docx/pentool/actions/workflows/ci.yml/badge.svg)](https://github.com/docx/pentool/actions)
+
+**Pentool** is a fast, modular web security testing tool with a terminal UI. Built for pentesters and security researchers who prefer working in the terminal.
+
+```bash
+pip install pentool
+pentool
+```
+
+---
+
+## ✨ Features
+
+- **🌐 Proxy** — Intercept and modify HTTP/HTTPS traffic in real time, manage scope, apply match & replace rules
+- **🔄 Repeater** — Replay requests with any modifications, persist tabs between sessions
+- **💥 Intruder** — Automated attacks with 4 strategies: Sniper, Battering Ram, Pitchfork, Cluster Bomb
+- **🚀 Turbo Intruder** — 10× speed via HTTP Keep-Alive and connection pooling (100–200 req/sec)
+- **🔍 Scanner** — Detect SQLi, XSS, SSTI, LFI, RCE, SSRF, XXE and more (active + passive modes)
+- **🕷 Spider** — Crawl sites automatically, collect pages, forms and JS endpoints
+- **🎯 Target / Site Map** — Build a site map and manage testing scope from the UI
+- **🔐 Decoder + Comparer + Sequencer** — Encode/decode, diff requests, analyze token entropy
+- **🧩 Plugin system** — Extend functionality without recompiling
+- **⚡ Async core** — Fully async, optimized for high load
+- **🆓 Open Source + PRO** — Free base, optional PRO license for advanced features
+
+---
+
+## 📦 Installation
+
+**Requirements:** Python 3.10+, Linux / macOS / Windows
+
+```bash
+pip install pentool
+```
+
+From source:
+
+```bash
+git clone https://github.com/docx/pentool.git
+cd pentool
+pip install -e ".[dev]"
+```
+
+---
+
+## 🚀 Quick Start
+
+```bash
+# Launch the TUI
+pentool
+
+# Start proxy on custom port
+pentool proxy start --port 8080
+
+# Run active scan
+pentool scan active --url https://example.com
+```
+
+---
+
+## 💰 Pricing
+
+| Plan | Price | Features |
+|------|-------|----------|
+| **Free** | $0 | Proxy, Repeater, Intruder, Decoder | 
+| **Lite** | $29/mo | + Scanner, Spider, Match & Replace |
+| **Medium** | $99/mo | + WebSocket, Plugins, Turbo Mode |
+| **Full** | $299/mo | + PRO Reports, API, Unlimited |
+
+[Get PRO license →](https://pentool.pro)
+
+---
+
+## 🤝 Support the project
+
+Pentool is developed in free time. If it helps your work, consider supporting:
+
+- [GitHub Sponsors](https://github.com/sponsors/docx)
+- [Buy PRO license](https://pentool.pro) — also supports development
+
+---
+
+## 📖 Documentation
+
+- [Quick Start](docs/QUICKSTART.md)
+- [User Guide](docs/user/)
+- [Architecture](docs/ARCHITECTURE_AUDIT.md)
+- [API Reference](docs/API_CONTRACTS.md)
+
+---
+
+## 🧪 Tests
+
+```bash
+pytest tests/unit/ -q
+```
+
+---
+
+## 🤝 Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md). Report vulnerabilities to security@pentool.pro.
+
+## 📄 License
+
+Community Edition: [AGPL-3.0](LICENSE) · PRO Edition: Commercial

pentool-1.0.0/pentool/__init__.py

@@ -0,0 +1,4 @@
+"""Pentool — консольный аналог Burp Suite с TUI на Textual."""
+
+__version__ = "0.1.0"
+__author__ = "pentool"

pentool-1.0.0/pentool/__main__.py

@@ -0,0 +1,17 @@
+"""Точка входа: без аргументов — TUI, с аргументами — CLI."""
+
+import sys
+
+
+def main() -> None:
+    """Запустить TUI или CLI в зависимости от аргументов."""
+    if len(sys.argv) > 1:
+        from pentool.cli.main import cli
+        cli()
+    else:
+        from pentool.tui.app import PentoolApp
+        PentoolApp().run()
+
+
+if __name__ == "__main__":
+    main()

pentool-1.0.0/pentool/api/__init__.py

@@ -0,0 +1,45 @@
+"""API-слой pentool — публичный интерфейс между modules/ и TUI/CLI.
+
+TUI и CLI импортируют только из pentool.api, не из pentool.modules напрямую.
+Это позволяет независимо менять логику и отображение.
+"""
+
+from pentool.api.proxy_api     import ProxyAPI, InterceptedRequest, MatchReplaceRule
+from pentool.api.repeater_api  import RepeaterAPI
+from pentool.api.scanner_api   import ScannerAPI
+from pentool.api.intruder_api  import IntruderAPI, IntruderConfig, IntruderAttack
+from pentool.api.spider_api    import SpiderAPI
+from pentool.api.target_api    import TargetAPI
+# Decoder/Comparer/Sequencer — функциональные API без класса-обёртки
+from pentool.api.decoder_api   import (  # noqa: F401
+    OPERATIONS, OP_LABELS, DecoderChain,
+    decode_op, decode_smart, encode_op, run_chain,
+)
+from pentool.api.comparer_api  import (  # noqa: F401
+    compare, compare_lines, CompareStats, DiffLine, DiffResult,
+)
+from pentool.api.sequencer_api import (  # noqa: F401
+    Sequencer, SequencerReport, token_entropy, charset_size,
+)
+
+__all__ = [
+    # Proxy
+    "ProxyAPI", "InterceptedRequest", "MatchReplaceRule",
+    # Repeater
+    "RepeaterAPI",
+    # Scanner
+    "ScannerAPI",
+    # Intruder
+    "IntruderAPI", "IntruderConfig", "IntruderAttack",
+    # Spider
+    "SpiderAPI",
+    # Target
+    "TargetAPI",
+    # Decoder
+    "OPERATIONS", "OP_LABELS", "DecoderChain",
+    "decode_op", "decode_smart", "encode_op", "run_chain",
+    # Comparer
+    "compare", "compare_lines", "CompareStats", "DiffLine", "DiffResult",
+    # Sequencer
+    "Sequencer", "SequencerReport", "token_entropy", "charset_size",
+]

pentool-1.0.0/pentool/api/base_api.py

@@ -0,0 +1,52 @@
+"""ExportableAPI — base mixin for API classes supporting project persistence.
+
+All API classes that implement export_project_data/import_project_data should
+inherit from this mixin for type consistency and documentation.
+"""
+
+from __future__ import annotations
+
+from abc import ABC, abstractmethod
+
+
+class ExportableAPI(ABC):
+    """Mixin for API classes that support project data export/import.
+
+    Subclasses must implement export_project_data and import_project_data.
+    These methods are called by core.project.save_project/load_project.
+
+    Usage::
+
+        class MyAPI(ExportableAPI):
+            def export_project_data(self) -> dict:
+                return {"my_data": [...]}
+
+            def import_project_data(self, data: dict) -> int:
+                items = data.get("my_data", [])
+                # restore items
+                return len(items)
+    """
+
+    @abstractmethod
+    def export_project_data(self) -> dict:
+        """Export module state to a serializable dict.
+
+        Returns:
+            dict: Module-specific data structure (e.g., {"results": [...]}).
+                  Must be JSON-serializable (no datetime, use .isoformat()).
+        """
+        raise NotImplementedError
+
+    @abstractmethod
+    def import_project_data(self, data: dict) -> int | tuple[int, str]:
+        """Import module state from a loaded project dict.
+
+        Args:
+            data: The module's block from project.json (e.g., data["intruder"]).
+
+        Returns:
+            int: Number of items loaded successfully.
+            OR
+            tuple[int, str]: (count, error_message) — empty string if OK.
+        """
+        raise NotImplementedError

pentool-1.0.0/pentool/api/comparer_api.py

@@ -0,0 +1,23 @@
+"""ComparerAPI — публичный интерфейс Comparer для TUI.
+
+TUI-экраны импортируют только этот модуль,
+не modules/comparer.py напрямую.
+"""
+
+from __future__ import annotations
+
+from pentool.modules.comparer import (  # noqa: F401
+    compare,
+    compare_lines,
+    CompareStats,
+    DiffLine,
+    DiffResult,
+)
+
+__all__ = [
+    "compare",
+    "compare_lines",
+    "CompareStats",
+    "DiffLine",
+    "DiffResult",
+]

pentool-1.0.0/pentool/api/decoder_api.py

@@ -0,0 +1,28 @@
+"""DecoderAPI — публичный интерфейс Decoder/Encoder для TUI.
+
+TUI-экраны импортируют только этот модуль,
+не modules/decoder.py напрямую.
+"""
+
+from __future__ import annotations
+
+# Реэкспорт всего публичного из modules/decoder
+from pentool.modules.decoder import (  # noqa: F401
+    OPERATIONS,
+    OP_LABELS,
+    DecoderChain,
+    decode_op,
+    decode_smart,
+    encode_op,
+    run_chain,
+)
+
+__all__ = [
+    "OPERATIONS",
+    "OP_LABELS",
+    "DecoderChain",
+    "decode_op",
+    "decode_smart",
+    "encode_op",
+    "run_chain",
+]

pentool-1.0.0/pentool/api/intruder_api.py

@@ -0,0 +1,209 @@
+"""Публичный API Intruder-модуля для TUI и CLI."""
+
+from __future__ import annotations
+
+
+
+from pentool.modules.intruder import (
+    AttackType,
+    IntruderAttack,
+    IntruderConfig,
+    IntruderResult,
+    count_markers,
+    extract_marker_defaults,
+    generate_char_payloads,
+    generate_numeric_payloads,
+    load_payloads_from_file,
+    process_payload,
+)
+
+__all__ = [
+    "IntruderAPI",
+    "AttackType",
+    "IntruderAttack",
+    "IntruderConfig",
+    "IntruderResult",
+    "count_markers",
+    "extract_marker_defaults",
+    "generate_char_payloads",
+    "generate_numeric_payloads",
+    "load_payloads_from_file",
+    "process_payload",
+]
+
+
+class IntruderAPI:
+    """Публичный интерфейс Intruder-модуля.
+
+    Тонкая обёртка над IntruderAttack.
+    Не знает о Textual.
+    """
+
+    def __init__(self, db_path: str | None = None) -> None:
+        self._db_path = db_path
+        self._attack: IntruderAttack | None = None
+
+    async def start_attack(
+        self,
+        config: IntruderConfig,
+        on_result=None,
+        on_progress=None,
+        turbo_mode: bool = False,
+    ) -> str:
+        """Запустить атаку. Возвращает attack_id.
+
+        Args:
+            config: Конфиг атаки.
+            on_result: Callback(IntruderResult) — вызывается на каждый результат.
+            on_progress: Callback(done, total) — вызывается при обновлении прогресса.
+            turbo_mode: Использовать Turbo Mode (HTTP Keep-Alive, connection pooling).
+
+        Returns:
+            str: attack_id (UUID).
+        """
+        if turbo_mode:
+            # Turbo Mode: connection pooling + Keep-Alive
+            from pentool.modules.intruder_turbo import TurboIntruderAttack
+            self._attack = TurboIntruderAttack(config)
+        else:
+            # Обычный режим
+            self._attack = IntruderAttack(config, db_path=self._db_path)
+
+        _on_result = on_result if on_result else lambda r: None
+        _on_progress = on_progress if on_progress else lambda d, t: None
+
+        import asyncio
+        asyncio.create_task(self._attack.run(_on_result, _on_progress))
+        return self._attack.attack_id if hasattr(self._attack, 'attack_id') else "turbo"
+
+    async def pause(self) -> None:
+        """Поставить атаку на паузу."""
+        if self._attack:
+            await self._attack.pause()
+
+    async def resume(self) -> None:
+        """Возобновить атаку после паузы."""
+        if self._attack:
+            await self._attack.resume()
+
+    async def stop(self) -> None:
+        """Остановить атаку."""
+        if self._attack:
+            await self._attack.stop()
+
+    def get_results(self) -> list[IntruderResult]:
+        """Получить список результатов текущей атаки."""
+        if self._attack:
+            # Turbo mode использует get_results(), обычный - results property
+            if hasattr(self._attack, 'get_results'):
+                return self._attack.get_results()
+            return self._attack.results
+        return []
+
+    def get_progress(self) -> tuple[int, int]:
+        """Вернуть (done, total) текущей атаки."""
+        if self._attack:
+            return self._attack.progress
+        return (0, 0)
+
+    @property
+    def is_running(self) -> bool:
+        """Возвращает True если атака сейчас выполняется."""
+        return bool(self._attack and self._attack.is_running)
+
+    async def load_payloads(self, path: str) -> list[str]:
+        """Загрузить payload'ы из файла."""
+        return load_payloads_from_file(path)
+
+    async def generate_numeric(self, start: int, end: int, step: int = 1) -> list[str]:
+        """Сгенерировать числовые payload'ы."""
+        return generate_numeric_payloads(start, end, step)
+
+    async def generate_chars(
+        self, charset: str, min_len: int, max_len: int
+    ) -> list[str]:
+        """Сгенерировать символьные payload'ы."""
+        return generate_char_payloads(charset, min_len, max_len)
+
+    def export_csv(self, path: str) -> None:
+        """Экспортировать результаты в CSV."""
+        if self._attack:
+            self._attack.export_csv(path)
+
+    # ── Project persistence ────────────────────────────────────────────────────
+
+    def export_project_data(self) -> dict:
+        """Экспортировать результаты Intruder в сериализуемый dict.
+
+        Returns:
+            dict с ключом "results" — список IntruderResult в виде dict.
+        """
+        results = self.get_results()
+        return {
+            "results": [
+                {
+                    "id": r.id,
+                    "attack_id": r.attack_id,
+                    "request_number": r.request_number,
+                    "payload_values": r.payload_values,
+                    "request_raw": r.request_raw,
+                    "response_status": r.response_status,
+                    "response_length": r.response_length,
+                    "response_time_ms": r.response_time_ms,
+                    "error": r.error,
+                    "timestamp": r.timestamp.isoformat(),
+                }
+                for r in results
+            ]
+        }
+
+    def import_project_data(self, data: dict) -> int:
+        """Импортировать результаты Intruder из загруженного dict проекта.
+
+        Args:
+            data: Блок "intruder" из project.json ({"results": [...]}).
+
+        Returns:
+            Количество загруженных результатов.
+        """
+        from datetime import datetime, timezone
+        from pentool.modules.intruder import IntruderResult
+
+        results_data = data.get("results", [])
+        # Создаём фиктивный attack для хранения результатов
+        # без реального запуска атаки
+        if self._attack is None:
+            # Ленивая инициализация — просто храним в атрибуте
+            self._restored_results: list[IntruderResult] = []
+        else:
+            self._restored_results = []
+
+        loaded = 0
+        for rd in results_data:
+            try:
+                ts_raw = rd.get("timestamp", "")
+                try:
+                    ts = datetime.fromisoformat(ts_raw)
+                except Exception:
+                    ts = datetime.now(timezone.utc)
+                result = IntruderResult(
+                    id=rd.get("id", ""),
+                    attack_id=rd.get("attack_id", ""),
+                    request_number=rd.get("request_number", 0),
+                    payload_values=rd.get("payload_values", []),
+                    request_raw=rd.get("request_raw", ""),
+                    response_status=rd.get("response_status"),
+                    response_length=rd.get("response_length"),
+                    response_time_ms=rd.get("response_time_ms"),
+                    error=rd.get("error"),
+                    timestamp=ts,
+                )
+                if hasattr(self, "_restored_results"):
+                    self._restored_results.append(result)
+                loaded += 1
+            except Exception as exc:
+                from pentool.core.logging import get_logger
+                get_logger(__name__).warning(
+                    "IntruderAPI.import_project_data: skip result: %s", exc
+                )
+        return loaded