CXploit Framework - Complete Architecture

Core Engine

CLI Interface

REST API

Reconnaissance

Auxiliary

Post-Exploitation

Payloads

Evasion

AI/Intelligence

Reporting

Utilities

main.py

Entry Point

→

argparse

CLI Args Parse

→

InteractiveConsole

CLI REPL

→

Framework

Singleton Engine

→

ModuleLoader

Dynamic Discovery

→

Modules

109 Python Files

Optional: --api flag → FrameworkAPI (Flask REST) | -r flag → ResourceScript (.rc batch)

⚙

Core Engine — Framework Hub (Singleton Pattern)

Framework — Central Orchestrator (core/framework.py)

Framework

core/framework.py

Singleton engine wiring all components. Metasploit-style use/set/run paradigm.

Key Methods

initialize(), use_module(), run_module(), run_module_background(), list_jobs(), kill_job(), set_option(), get_option(), shutdown()

Internal Imports

ConfigManager Database EventSystem SessionManager ModuleLoader SafetyChecker

ConfigManager

core/config.py

JSON file persistence with dot-notation access. Default config: framework, database, network, scanner, payload, reporting, safety.

Key Methods

load(), save(), get(key_path), set(key_path, val), get_section(), reset(), to_dict()

Imports

os json constants.DATA_DIR

Database

core/database.py

SQLAlchemy ORM + SQLite. Thread-safe with session_scope() context manager.

ORM Models

Target, Service, Vulnerability, Credential, ExploitSession, EventLog

CRUD Methods

add_target(), get_targets(), add_service(), add_vulnerability(), add_credential(), add_exploit_session(), add_event(), clear_events()

Imports

sqlalchemy datetime constants.DB_PATH

EventSystem

core/events.py

Central pub/sub event bus for logging. Emits to file + DB + listeners.

Key Methods

emit(), on()/off(), debug(), info(), warning(), error(), critical(), success()

Imports

logging datetime constants.LOGS_DIR

SessionManager

core/session.py

Manages exploitation sessions with real socket I/O. Bidirectional interact() mode.

Key Methods

create_session(), get_session(), interact(), close_session(), close_all(), list_sessions(), active_count()

Imports

socket select threading uuid

ModuleLoader

core/module_loader.py

Dynamic runtime module discovery. Scans directories, finds classes with run() method, registers non-ABC classes.

Key Methods

discover_modules(), get_module(), create_instance(), list_modules(), search_modules(), reload_module(), count()

Imports

importlib inspect abc constants.MODULE_TYPES

BaseExploit (ABC)

exploits/base.py

Abstract base class for ALL modules. Every module inherits this.

Interface

run() [abstract], check(), cleanup(), set_option(), get_option(), validate_options(), store_vuln(), store_cred(), print_status/good/error()

Imports

abc.ABC abc.abstractmethod

SafetyChecker

utils/validators.py

Authorization gating + emergency stop. Integrated into Framework.run_module().

Key Methods

authorize_target(), is_authorized(), trigger_emergency_stop(), reset_emergency_stop(), is_stopped()

Imports

re ipaddress urllib.parse

⌨

CLI Interface — Interactive Console (Metasploit-style REPL)

InteractiveConsole

cli/console.py (1,112 lines!)

Main REPL loop with prompt_toolkit. Dispatch table for 50+ commands. Lazy imports for all module categories.

Class: InteractiveConsole

prompt_toolkitrichFrameworkCompletercommandsFramework

Command Handlers

cli/commands.py

cmd_help(), cmd_show(), cmd_use(), cmd_set(), cmd_run(), cmd_search(), cmd_sessions(), cmd_jobs(), cmd_stats(), cmd_authorize(), cmd_emergency_stop()

Functions: cmd_*

rich.Consolerich.Tablerich.Panel

FrameworkCompleter

cli/completer.py

Context-aware auto-completion for commands, module names, show subcommands, option names, session IDs.

Class: FrameworkCompleter

prompt_toolkit.completion

🌐

REST API & Dashboard

FrameworkAPI

api/server.py

Flask REST API for remote framework control. Routes: /status, /modules, /modules/name/run, /targets, /vulnerabilities, /sessions, /report

Class: FrameworkAPI

flaskthreadingFramework

Dashboard

api/dashboard.py

Real-time web dashboard with embedded HTML/CSS/JS. Shows targets, services, vulns, creds, sessions, heatmap, event log.

Class: Dashboard

flaskwerkzeugwebbrowserEventSystem

🤖

Core Intelligence — AI-Powered Engines

AutoPwn

core/autopwn.py

AI-driven auto-exploitation pipeline with MITRE ATT&CK mapping. Phased execution with attack chains.

requestsurllib3jsoncollections

AiAttackPlanner

core/ai_attack_planner.py

Graph-based attack tree builder with MITRE ATT&CK technique mapping and success probability estimation.

jsontime

ExploitSuggest

core/exploit_suggest.py

CVE-to-exploit mapping with curated database of 100+ CVEs (Log4Shell, EternalBlue, BlueKeep, etc.).

json

VulnChainer

core/vuln_chainer.py

Kill chain visualization, MITRE ATT&CK mapping, multi-stage exploit chaining with templates.

jsontime

VulnScorer

core/vuln_scorer.py

AI-powered CVSS v3.1 vulnerability scoring with heuristic rules, service risk multipliers, critical pattern detection.

json

ZeroDayDetector

core/zeroday_detector.py

Behavior-based zero-day anomaly detection. Patterns: stack trace leaks, version disclosure, SQL errors, default creds.

jsonrequests

TargetProfiler

core/target_profile.py

Aggregates all findings per target into risk-scored profiles.

json

CredentialStore

core/credential_store.py

Central credential management with import/export and hash cracking integration.

json

ResourceScript

core/resource_script.py

.rc automation script parser with variables, loops, conditionals, delays for batch execution.

timere

RedteamCollab

core/redteam_collab.py

Red team collaboration hub: shared findings, operator sync, target assignments, engagement timeline.

jsonthreading

🔍

Reconnaissance (22 Modules)

PortScanner

recon/port_scanner.py

Multi-mode: SYN/FIN/XMAS/NULL/ACK stealth, timing profiles, service detection.

socketstructthreadingutils.network

OSINTRecon

recon/osint.py (53KB!)

Social media, Google dorks, WHOIS, Shodan, breach data lookup.

aiohttprequestsbeautifulsoup4

NetworkMapper

recon/network_mapper.py

Network topology discovery, SNMP walk, ARP table mapping.

python-nmapsocket

VulnScanner

recon/vuln_scanner.py

500+ vulnerability checks, CVE correlation, SSL analysis.

requestsjson

WebScanner

recon/web_scanner.py

Web app scanner: directory enum, tech detection, SSL analysis.

requestsutils.constants

CloudScanner

recon/cloud_scanner.py

AWS/Azure/GCP misconfiguration scanner, S3 bucket enumeration.

requestsjson

ADEnumerator

recon/ad_enum.py

Active Directory/LDAP enumeration, Kerberoasting, AS-REP roasting.

socketldap3

DnsEnum

recon/dns_enum.py

Zone transfers, DNSSEC, subdomain bruteforce enumeration.

socketdnspython

HostDiscovery

recon/host_discovery.py

ARP/ICMP/TCP host discovery with CIDR expansion.

socketscapyutils.network

OSFingerprint

recon/os_fingerprint.py

TTL-based + banner-based OS detection.

socketstruct

ServiceEnumerator

recon/service_enum.py

Banner grabbing, version detection for services.

socketutils.network

DirBruteforce

recon/dir_bruteforce.py

Web path discovery (gobuster-style) with multi-threading.

requeststhreading

CVEDatabase

recon/cve_db.py

Offline CVE data, service-to-CVE mapping.

jsonsqlite3

ThreatIntel

recon/threat_intel.py

Multi-source IP/domain reputation, IoC aggregation.

requestsjson

WifiScanner

recon/wifi_scanner.py

WiFi deauth, handshake capture, WPA cracking.

scapysubprocess

BluetoothScanner

recon/bluetooth_scanner.py

BLE/Classic discovery, GATT enumeration.

subprocess

CertAnalyzer

recon/cert_analyzer.py

SSL/TLS certificate chain analysis, cipher audit, Heartbleed.

socketssl

ScadaScanner

recon/scada_scanner.py

SCADA/ICS: Modbus, DNP3, OPC-UA, BACnet protocols.

socketstruct

DarkwebOsint

recon/darkweb_osint.py

Dark web breach lookup, paste monitoring via Tor.

requestssocks

SupplyChainAuditor

recon/supply_chain_auditor.py

npm/pip/maven/nuget dependency vulnerability analysis.

requestsjson

BlockchainAuditor

recon/blockchain_auditor.py

Solidity smart contract analysis, reentrancy detection.

jsonre

WirelessProtocol

recon/wireless_protocol.py

Zigbee, Z-Wave, LoRa, BLE, RFID protocol scanning.

socketstruct

⚙

Auxiliary Modules (18 Modules)

CredSprayer

auxiliary/cred_sprayer.py

Multi-protocol credential spraying (SSH/RDP/SMB/FTP/HTTP), lockout awareness, NTLM relay.

paramikorequestssmbprotocol

HashCracker

auxiliary/hash_cracker.py

50+ hash types, rule-based cracking, rainbow table support.

hashlibthreading

Phishing

auxiliary/phishing.py

Site cloning, MFA phishing, QR attacks, SMS spoofing.

requestsbeautifulsoup4

Sniffer

auxiliary/sniffer.py

ARP spoofing, PCAP export, protocol decode, deep packet inspection.

scapysocket

NetworkPivot

auxiliary/pivot.py

Port forwarding, SOCKS proxy, TCP tunneling for pivoting.

socketthreadingselect

SmbScanner

auxiliary/smb_scanner.py

Share enumeration, null sessions, signing checks.

socketstruct

SSHScanner

auxiliary/ssh_scanner.py

Version enumeration, weak algorithm detection.

paramikosocket

SSLScanner

auxiliary/ssl_scanner.py

Heartbleed, POODLE, cipher strength analysis.

socketssl

EmailTester

auxiliary/email_tester.py

SPF/DKIM/DMARC validation, SMTP relay testing.

dnspythonsmtplib

HttpTunnel

auxiliary/http_tunnel.py

HTTP/DNS covert tunneling for data exfiltration.

requestssocket

TrafficAnalyzer

auxiliary/traffic_analyzer.py

Deep packet inspection, protocol reconstruction, anomaly detection.

scapystruct

RDPScanner

auxiliary/rdp_scanner.py

NLA check, BlueKeep detection.

socketstruct

FTPScanner

auxiliary/ftp_scanner.py

Anonymous login check, writable directory detection.

ftplib

SNMPScanner

auxiliary/snmp_scanner.py

Community string sweep, interface enumeration.

socket

IPMIScanner

auxiliary/ipmi_scanner.py

Cipher zero exploit, BMC information extraction.

socketstruct

NetBIOSScanner

auxiliary/netbios_scanner.py

Name query, workgroup discovery.

socketstruct

SocksProxy

auxiliary/socks_proxy.py

SOCKS4/5 traffic routing proxy.

socketstructthreading

HTTPScanner / Tools

auxiliary/http_scanner.py / tools.py

HTTP methods, WebDAV, robots.txt, file server, DNS lookup, WHOIS, wordlist gen.

requestshttp.serversocket

☠

Post-Exploitation (11 Modules)

PrivescSuggest

post/privesc_suggest.py (28KB!)

WinPEAS/LinPEAS-level privilege escalation checks.

ossubprocessre

Persistence

post/persistence.py

30+ persistence mechanisms: registry, cron, service, WMI, startup, DLL hijack, etc.

ossubprocessjson

LateralMove

post/lateral_move.py

WMI exec, PSExec, SMB copy, Pass-the-Hash, SSH lateral movement.

paramikosubprocesssocket

CredentialHarvest

post/credential_harvest.py

Universal credential harvester: browser, WiFi, system, app credentials.

osjsonsubprocess

Antiforensics

post/antiforensics.py

Log tampering, timestomping, MFT manipulation, artifact wiping.

ossubprocessstruct

ContainerEscape

post/container_escape.py

Docker/K8s escape, capability abuse, pod breakouts.

subprocessjson

MemoryForensics

post/memory_forensics.py

Process dump, credential extraction, DLL injection analysis.

structctypes

RansomwareSimulator

post/ransom_sim.py

Safe, reversible encryption for incident response testing.

Crypto.Cipher.AESos

WindowsPostExploit

post/windows_post.py

Mimikatz integration, token manipulation, persistence.

subprocessctypes

LinuxPostExploit

post/linux_post.py

Linux enum, privesc, persistence, credential harvesting.

ossubprocess

SysEnum / LootManager

post/sys_enum.py / loot_manager.py

System enumeration, centralized loot storage.

osjson

💣

Payloads (11 Modules)

PayloadGenerator

payloads/generator.py

Multi-platform: Python/PowerShell/Bash/Java/C/PHP/Node/Ruby.

utils.cryptobase64json

ShellcodeFactory

payloads/shellcode_factory.py

x86/x64 shellcode, XOR/AES encoding, obfuscation.

structutils.crypto

ShellcodeGenerator

payloads/shellcode_generator.py

x86/x64 reverse/bind TCP/UDP shellcode, staged delivery.

struct

MeterpreterPayload

payloads/meterpreter.py

Post-exploitation stager, reflective DLL injection.

socketstructctypes

MultiHandler

payloads/multi_handler.py

Multi-protocol listener, staged/stageless payload handling.

socketthreading

PayloadEncoder

payloads/encoder.py

Base64, XOR, alpha, shikata_ga_nai encoding.

utils.cryptobase64

PayloadObfuscator

payloads/obfuscator.py

Multi-layer encoding, string encryption, junk code, control flow flattening.

randombase64

PolymorphicGenerator

payloads/polymorphic.py

Self-modifying code, metamorphic engine.

utils.cryptorandom

NopGenerator

payloads/nop_generator.py

Polymorphic NOP sled for x86/x64/ARM.

random

MacroBuilder

payloads/macro_builder.py

VBA reverse shell, download-exec, keylogger, persistence macros.

base64random

BindShellConnector

payloads/bind_shell.py

Connect to bind shells on target systems.

socketselect

🕵

Evasion (6 Modules)

AVEvasion

evasion/av_evasion.py

Process injection, AMSI bypass, sandbox detection and evasion.

ctypessubprocess

IdsEvasion

evasion/ids_evasion.py

Fragment overlap, TTL manipulation, protocol anomaly for IDS/IPS bypass.

scapystruct

WAFBypass

evasion/waf_bypass.py

HTTP/2 smuggling, chunked encoding, Unicode normalization.

requestssocket

Stego

evasion/stego.py

LSB PNG/BMP, WAV audio steganography, PDF embedding.

structPIL

TrafficEvasion

evasion/traffic_evasion.py

Protocol tunneling, domain fronting, DNS/ICMP exfiltration.

socketdnslib

PayloadEncryptor

evasion/encryption.py

Payload encryption, traffic obfuscation, anti-forensics, timing randomization.

utils.cryptoos

🌐

Command & Control (2 Modules)

C2Server + C2Handler

c2/c2_server.py

Multi-protocol C2 (HTTP/DNS/SMB/TCP), staging, tasking, DNS over HTTPS.

socketthreadingjsonssl

C2Agent + Agent

c2/c2_agent.py

Agent implant: process injection, AMSI bypass, sleep obfuscation, sandbox evasion.

socketctypesjson

🔧

Utilities — Shared Foundation Layer

constants

utils/constants.py

Framework-wide: BASE_DIR, DB_PATH, LOGS_DIR, MODULE_TYPES, EXPLOIT_RANKINGS, PAYLOAD_TYPES, PLATFORMS, USER_AGENTS, COMMON_DIRS, SQLI/XSS/LFI_PAYLOADS, Colors (ANSI).

crypto

utils/crypto.py

md5/sha1/sha256/sha512 hashes, base64 encode/decode, XOR encrypt, AES encrypt/decrypt, random bytes/string generation.

hashlibCrypto.Cipher.AESbase64os

network

utils/network.py

get_local_ip(), resolve_host(), reverse_dns(), is_valid_ip(), expand_cidr(), parse_port_range(), random_user_agent(), create_tcp/udp_socket(), grab_banner(), ip_to_int().

socketstructipaddressconstants

validators

utils/validators.py

validate_ip/port/url/cidr/email/mac(), sanitize_input(), is_private_ip(). SafetyChecker: authorize_target(), emergency_stop().

reipaddressurllib.parse

📄

Reporting & Plugins

ReportGenerator

reporting/report_gen.py

HTML (Jinja2), JSON, PDF (ReportLab), CSV report generation.

jinja2reportlabjsoncsv

ComplianceReport

reporting/compliance_report.py

PCI-DSS, HIPAA, SOC2, ISO 27001, GDPR, NIST compliance reporting.

jsondatetime

ReportGenerator (Core)

core/report_generator.py

Core HTML/JSON/Markdown pentest report generation.

jsondatetime

PluginManager

plugins/plugin_manager.py

Plugin discovery, loading, marketplace. BasePlugin ABC for extensions.

importlibinspectjson

📦

External Dependencies (requirements.txt)

scapy

v2.5.0

Packet crafting/sniffing (sniffer, wifi_scanner)

paramiko

v3.4.0

SSH connections (ssh_scanner, lateral_move)

requests

v2.31.0

HTTP client (20+ modules)

beautifulsoup4

v4.12.2

HTML parsing (web_scanner, osint, phishing)

prompt-toolkit

v3.0.43

Interactive CLI with completion

pycryptodome

v3.20.0

AES, RSA, padding (utils/crypto, payloads, evasion)

jinja2

v3.1.3

HTML templating (report_gen)

reportlab

v4.1.0

PDF generation (report_gen)

flask

v3.0.2

REST API + web dashboard

python-nmap

v0.7.1

Nmap wrapper (network_mapper)

rich

v13.7.0

Terminal formatting/tables

aiohttp

v3.9.3

Async HTTP (osint)

sqlalchemy

v2.0.25

ORM + SQLite database

colorama

v0.4.6

Cross-platform terminal colors

🔗

Inter-Module Dependency Map — How Modules Connect

main.py
  → cli/console.InteractiveConsole
       ↓ (singleton)
       core/framework.Framework  ←── CENTRAL HUB
       ↓         ↓         ↓         ↓         ↓
   ConfigMgr  Database  EventSys  SessionMgr  ModuleLoader  SafetyChecker
       ↓         ↓         ↓                       ↓
   constants  constants  constants          discovers all module classes with run()

InteractiveConsole ── lazy imports ──→ recon/*  auxiliary/*  post/*  payloads/*  evasion/*  c2/*  core/intel*

recon/  →  utils.network (port_scanner, host_discovery, service_enum)
recon/  →  utils.constants (web_scanner, port_scanner)
payloads/ → utils.crypto (generator, encoder, polymorphic)
evasion/  → utils.crypto (encryption)
api/server → Framework + reporting/report_gen
api/dashboard → EventSystem

Framework.run_module() flow:
  authorize_target() → validate_options() → module.run() → results → DB store

CXploit Framework v2.0