Metadata-Version: 2.4
Name: asta-pentest
Version: 1.0.1
Summary: Industrial-grade penetration testing framework — recon, exploit, C2, post-exploit, AD
Author: AridsWolfgangX
License-Expression: MIT
Project-URL: Homepage, https://github.com/AridsWolfgang/Asta
Project-URL: Repository, https://github.com/AridsWolfgang/Asta.git
Project-URL: Issues, https://github.com/AridsWolfgang/Asta/issues
Project-URL: Changelog, https://github.com/AridsWolfgang/Asta/releases
Keywords: pentest,security,reconnaissance,exploitation,c2,osint,penetration-testing
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Information Technology
Classifier: Natural Language :: English
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: aiohttp>=3.9.0
Requires-Dist: aiofiles>=23.0.0
Requires-Dist: dnspython>=2.4.0
Requires-Dist: PyYAML>=6.0
Requires-Dist: jinja2>=3.1.0
Requires-Dist: beautifulsoup4>=4.12.0
Requires-Dist: rich>=13.0.0
Provides-Extra: full
Requires-Dist: scapy; extra == "full"
Requires-Dist: cryptography>=41.0.0; extra == "full"
Requires-Dist: pycryptodome; extra == "full"
Requires-Dist: impacket; extra == "full"
Requires-Dist: pynacl; extra == "full"
Requires-Dist: pdfkit; extra == "full"
Requires-Dist: Pillow; extra == "full"
Provides-Extra: stealth
Requires-Dist: scapy; extra == "stealth"
Provides-Extra: c2
Requires-Dist: cryptography>=41.0.0; extra == "c2"
Provides-Extra: ad
Requires-Dist: impacket; extra == "ad"
Provides-Extra: reporting
Requires-Dist: pdfkit; extra == "reporting"
Requires-Dist: Pillow; extra == "reporting"
Dynamic: license-file

<div align="center">

# ⚔️ Asta — Full-Spectrum Penetration Testing Framework

**Passive Recon · Active Scanning · Deep Enumeration · Exploitation · C2 · AI Analysis**

[![Python 3.11+](https://img.shields.io/badge/Python-3.11%2B-3776AB?logo=python&logoColor=white)](https://python.org)
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
[![Platform](https://img.shields.io/badge/Platform-Windows%20%7C%20Linux%20%7C%20macOS-6a0dad)](.)

```
  ╔══════════════════════════════════════════════════════════════════════╗
  ║  Passive → Active → Enumerate → Exploit → Post-Exploit → C2 → AI   ║
  ║  Full kill chain. One pipeline. AI-powered analysis.                ║
  ╚══════════════════════════════════════════════════════════════════════╝
```

</div>

---

## ⚡ Quick Start

```bash
# Install from PyPI
pip install asta-pentest

# Or clone and install from source
git clone https://github.com/AridsWolfgang/Asta.git && cd Asta
pip install -e .[full]

# Create your config (never commit real keys)
asta --init

# Edit config.yaml with your API keys, then:
asta -t example.com

# Full kill chain (authorized targets only)
asta -t target.com --exploit --yes
```

---

## 🧠 AI-Powered Analysis

Asta integrates with LLM providers to give you post-scan intelligence — no more staring at raw JSON.

### Supported Providers (free + paid)

| Provider | Cost | Key Required | Models |
|----------|------|-------------|--------|
| **Groq** | Free | Yes — [console.groq.com](https://console.groq.com) | Llama 3 8B/70B, Mixtral |
| **GitHub Models** | Free | Yes — [GitHub token](https://github.com/settings/tokens) | GPT-4o-mini, Llama, Mistral |
| **OpenRouter** | Pay-as-you-go | Yes — [openrouter.ai/keys](https://openrouter.ai/keys) | 200+ models (DeepSeek, GPT, Claude, Gemini) |
| **DeepSeek** | Paid | Yes — [platform.deepseek.com](https://platform.deepseek.com/api_keys) | deepseek-chat |
| **OpenAI** | Paid | Yes — [platform.openai.com](https://platform.openai.com/api_keys) | GPT-4o, GPT-4o-mini |

### Setup

```yaml
# config.yaml (add your key — gitignored by default)
llm:
  provider: openrouter              # Switch providers here
  model: "openai/gpt-4o-mini"      # Leave empty for default
  auto_analysis: true               # Run AI after every scan
  explain_cves: true                # Explain CVEs in plain language
  summarize: true                   # Attack surface summary
  remediate: true                   # Remediation suggestions
  api_keys:
    groq: ""
    deepseek: "sk-..."              # Or use one key for everything
    openrouter: "sk-or-v1-..."
    github: ""
    openai: ""
```

### Usage

```bash
# Auto-analysis runs after every scan (toggle with --no-ai)
asta -t example.com

# One-shot question about scan results
asta -t example.com --query "What are the most critical findings?"

# Interactive REPL — ask anything about the scan
asta -t example.com --query
asta> what ports are open?
asta> any SQL injection vectors?
asta> how do I remediate the XSS?
asta> exit

# Override provider from CLI
asta -t example.com --llm-provider groq
```

### What AI Analyzes

- **CVE Explanation** — Translates raw CVE IDs into plain-English risk descriptions
- **Attack Surface Summary** — Lists critical entry points in priority order
- **Remediation Steps** — Actionable fixes for each finding, severity-ranked
- **Custom Queries** — Ask anything: "which services are outdated?", "is there a path to domain admin?"

---

## 🏗️ Architecture

```
┌──────────────────────────────────────────────────────────────────────────┐
│                         CLI / Web Platform                               │
│  asta --web  (unified SPA: dashboard, scans, C2, results)               │
│  asta -t target  (CLI mode)                                              │
└──────────────────────────────┬───────────────────────────────────────────┘
                               │
                               ▼
┌──────────────────────────────────────────────────────────────────────────┐
│               Core — ReconOrchestrator                                   │
│  Phase gating · Plugin hooks · SQLite DB · Proxy mgmt · Diffing         │
└──┬──────┬──────┬──────┬──────┬──────┬──────┬──────┬──────┬──────┬──────┘
   │      │      │      │      │      │      │      │      │      │
   ▼      ▼      ▼      ▼      ▼      ▼      ▼      ▼      ▼      ▼
 ┌────┐ ┌────┐ ┌────┐ ┌────┐ ┌────┐ ┌────┐ ┌────┐ ┌────┐ ┌────┐ ┌────┐
 │P1  │ │P2  │ │P3  │ │P4  │ │P5  │ │P6  │ │ C2 │ │ LLM│ │Web │ │Rep │
 │Ps  │ │Act │ │Enum│ │Exp │ │PE  │ │Crk │ │Srv │ │AI  │ │Plat│ │ort │
 ├────┤ ├────┤ ├────┤ ├────┤ ├────┤ ├────┤ ├────┤ ├────┤ ├────┤ ├────┤
 │•DNS│ │•Pr │ │•S3 │ │•Vul│ │•Pr │ │•Hsh│ │•WS │ │•CVE│ │•Dsh│ │•Jsn│
 │•WIS│ │ Sc │ │•CVE│ │nSc │ │ivEs│ │•Wrd│ │•AES│ │•Sum│ │•Scn│ │•Htm│
 │•Sub│ │•Sv │ │•WAF│ │•Web│ │•Cred│ │list│ │•Cmd│ │•Rem│ │•C2 │ │•CSV│
 │•OSI│ │cDe │ │•Nik│ │•Brt│ │•Piv│ │    │ │•Exf│ │•Que│ │•Rst│ │•XML│
 │•Drk│ │•Htp│ │•WP │ │•Exp│ │•BH │ │    │ │    │ │    │ │•Rep│ │    │
 │•Mal│ │•JS │ │•e4l│ │•MSF│ │•Krb│ │    │ │    │ │    │ │    │ │    │
 │•Soc│ │•SS │ │•Gw │ │•Hyd│ │•Mmk│ │    │ │    │ │    │ │    │ │    │
 │    │ │•Nm │ │•Hyd│ │    │ │•Ltr│ │    │ │    │ │    │ │    │ │    │
 │    │ │•UDP│ │    │ │    │ │    │ │    │ │    │ │    │ │    │ │    │
 │    │ │•OS │ │    │ │    │ │    │ │    │ │    │ │    │ │    │ │    │
 │    │ │•Msc│ │    │ │    │ │    │ │    │ │    │ │    │ │    │ │    │
 │    │ │•Gau│ │    │ │    │ │    │ │    │ │    │ │    │ │    │ │    │
 │    │ │•Sbf│ │    │ │    │ │    │ │    │ │    │ │    │ │    │ │    │
 └────┘ └────┘ └────┘ └────┘ └────┘ └────┘ └────┘ └────┘ └────┘ └────┘
   │      │      │      │      │      │      │      │      │      │
   └──────┴──────┴──────┴──────┴──────┴──────┴──────┴──────┴──────┘
                               │
                   ┌───────────┴───────────┐
                   │  SQLite · Stealth ·   │
                   │  Plugins · Webhooks   │
                   └───────────────────────┘
```

---

## 🎯 Features — The Full Stack

### Phase 1: Passive Reconnaissance — Zero packets sent

| Module | Technique | Output |
|--------|-----------|--------|
| `dns` | System resolver + public DNS | A, AAAA, MX, NS, TXT, CNAME, SOA; zone transfer attempt |
| `whois` | WHOIS / RDAP | Registrar, org, emails, nameservers, dates |
| `subdomains` | crt.sh, AlienVault, URLScan, Wayback, HackerTarget, DNS brute | Subdomains with source attribution |
| `osint` | Shodan, SecurityTrails, Censys, VirusTotal | Open ports, technologies, DNS history |
| `dorking` | GitHub code search, GitLab | Secrets, config files, internal paths |
| `email_harvester` | WHOIS contacts, page scraping, regex | Email addresses with source URLs |
| `social_osint` | 30+ platform username check + email breach + Hunter.io | Social footprint, breached accounts, domain emails |

### Phase 2: Active Reconnaissance — Touching the target

| Module | Technique | Details |
|--------|-----------|---------|
| `port_scanner` | Async TCP connect (asyncio) | 4 profiles: fast (20), basic (100), medium (1000), full (65535) |
| `syn_scanner` | Raw SYN packets (Scapy) | Half-open stealth scan; requires admin/root |
| `nmap_integration` | Wraps **nmap** binary | Auto-detect, scan type (`-sS/-sT/-sU`), timing T0-T5, `-sV`, `-O`, NSE scripts |
| `masscan` | Wraps **masscan** binary | Ultra-fast port scan at configurable rates |
| `udp_scanner` | Async UDP probes with service payloads | DNS, SNMP, NTP, SSDP, mDNS — 26 common UDP ports |
| `service_detection` | Banner grab + SSL probe | Connects to open ports, reads banners; HTTP/SSH probes |
| `os_detection` | TTL analysis + banner match + keyword FP | Windows vs Unix/Linux guess with confidence score |
| `web_enum` | HTTP GET probes + directory fuzz | Status codes, titles, server headers |
| `tech_fingerprint` | 40+ signature patterns | Web servers, CMS, JS frameworks, CDNs, analytics |
| `httpx` | Wraps **httpx** binary | HTTP probing, tech detection, virtual host discovery |
| `ffuf` | Wraps **ffuf** binary | Directory and file fuzzing with wordlist |
| `subfinder` | Wraps **subfinder** binary | Passive subdomain discovery from 30+ sources |
| `sslscan` | Wraps **sslscan** binary | TLS cipher/protocol deep assessment |
| `gau` | Wraps **gau** binary | Archive URL discovery (Wayback, AlienVault, CommonCrawl) |
| `js_extract` | Download + regex scan | API endpoints, secrets, internal IPs in JavaScript |

### Phase 3: Deep Enumeration — Beyond the surface

| Module | Technique | Detection Target |
|--------|-----------|-----------------|
| `cloud_assets` | URL probe | Open S3 buckets, CloudFront, Firebase, GCP/Azure storage |
| `vuln_checks` | Path-based probes | Git exposure, backups, phpinfo, admin panels, debug endpoints |
| `cve_matcher` | Version extraction → DB lookup | 50+ critical CVEs matched against service banners |
| `waf_detection` | Header/cookie/body analysis | 35+ WAF signatures: CloudFlare, ModSecurity, F5, Akamai, Imperva |
| `nikto` | Wraps **nikto** binary | ~7000 dangerous files/CGIs, outdated software, misconfigs |
| `wpscan` | Wraps **wpscan** binary | WordPress plugin/theme/user enumeration (auto-detect WP) |
| `enum4linux` | Wraps **enum4linux-ng** | SMB/RPC enumeration: shares, users, groups, password policy |
| `gowitness` | Wraps **gowitness** binary | Headless Chrome screenshots with HTML gallery |
| `hydra` | Wraps **hydra** binary | Online brute-force against SSH/FTP with discovered usernames |

### Phase 4: Exploitation ⚠️ Requires `--exploit --yes`

| Module | Technique | Attack Surface |
|--------|-----------|----------------|
| `vuln_scanner` | TLS/cert analysis, security headers, CORS, default creds | Weak ciphers, expired certs, misconfigurations |
| `web_attacks` | SQLi, XSS, LFI, SSRF, CMDi, SSTI, XXE, open redirect, IDOR, GraphQL | Web application OWASP Top 10 |
| `waf_bypass` | Encoding, case variation, comment insertion | Cloudflare, ModSecurity, AWS WAF bypass |
| `bruteforce` | HTTP form bruteforce, FTP, SSH credential testing | Weak credentials using harvested usernames |
| `exploit_engine` | Maps CVEs → Metasploit modules → exploit chains | Automated exploit matching with cascading attacks |
| `payload_gen` | Reverse shells + webshells | bash, python, php, powershell; php, asp, aspx, jsp webshells |
| `msf_integration` | Wraps **msfconsole** | Direct module execution, `.rc` resource scripts, session/loot capture |

### Phase 4b: Password Cracking

| Module | Technique | Details |
|--------|-----------|---------|
| `hashcat` | Wraps **hashcat** binary | 30+ hash type auto-detection by signature (MD5, NTLM, bcrypt, Kerberos, WPA-PBKDF2, etc.) |
| `wordlist` | GitHub downloads + merge/dedup | rockyou, SecLists, Probable-Wordlists |

### Phase 5: Post-Exploitation — Inside the wire

| Module | Capability | Purpose |
|--------|-----------|---------|
| `reverse_shell` | Async TCP listener, session mgmt | Catch shells from exploited targets |
| `privesc` | Linux kernel exploit check, SUID/GTFO bins, sudo/cron | Escalate to root |
| `pivot_scan` | ARP sweep, port scan through active session | Lateral movement |
| `cred_dump` | Credential extraction, browser password store | Credential harvesting |
| `bloodhound` | BloodHound collector | AD attack path mapping |
| `kerberos` | Kerberos attack tooling | Ticket attacks, AS-REP roasting |
| `mimikatz` | Mimikatz loader | Credential dumping via reflection |
| `lateral_movement` | WMI/SSH lateral movement | Move across the network |

### AI Analysis (Post-Scan)

| Feature | Description |
|---------|-------------|
| `CVE Explanation` | Translates raw CVE IDs into plain-English risk descriptions |
| `Attack Surface Summary` | Lists critical entry points in priority order |
| `Remediation Suggestions` | Actionable fixes for each finding, severity-ranked |
| `Interactive Query` | Ask questions about scan results in natural language |

### C2 Infrastructure

| Component | Technology | Features |
|-----------|------------|----------|
| `C2Server` | aiohttp WebSocket | AES-256-GCM encryption, session mgmt, task dispatch |
| `Implant (Go)` | Native Go agent | Beacon, command exec, file exfil, screenshot, persistence, evasion |
| `Profiles` | DNS / HTTPS / mTLS / WebSocket | Multiple C2 profiles for stealth |
| `CryptoLayer` | AES-256-GCM | Key rotation, encrypt/decrypt, key derivation |

### Web Platform — `http://127.0.0.1:8080`

| Page | Features |
|------|----------|
| **Dashboard** | Stats cards (scans/ports/CVEs), launch scan form, recent scans, live SSE events |
| **Scans** | Full history table, phase-by-phase JSON detail |
| **C2 Console** | Session list, xterm.js terminal, command history |
| **Results** | Phase-tabbed findings browser with severity filter |
| **Reports** | Download generated reports (JSON, HTML, CSV, XML) |

---

## 🚀 CLI Reference

### Basic

```bash
asta -t example.com                    # Full scan (passive + active + enum + AI)
asta -t example.com --passive-only     # Passive recon only
asta -t example.com --active-only      # Active recon only
asta -t example.com --enum-only        # Enumeration only
```

### Scan Profiles

```bash
asta -t example.com --scan-profile fast    # 20 ports (~30s)
asta -t example.com --scan-profile basic   # 100 ports (~2min) [default]
asta -t example.com --scan-profile medium  # 1000 ports (~10min)
asta -t example.com --scan-profile full    # 65535 ports (~hours)
```

### Module Toggles

```bash
asta -t example.com --no-cve       # Skip CVE matching
asta -t example.com --no-waf       # Skip WAF detection
asta -t example.com --no-dork      # Skip GitHub/GitLab dorking
asta -t example.com --no-email     # Skip email harvesting
```

### Stealth & Evasion

```bash
asta -t example.com --tor                   # Route through Tor
asta -t example.com --proxies "http://p1:8080,http://p2:8080"  # Proxy rotation
```

### AI Analysis

```bash
asta -t example.com                       # Auto AI analysis after scan
asta -t example.com --no-ai               # Skip AI analysis
asta -t example.com --llm-provider groq   # Use specific provider
asta -t example.com --query               # Interactive query REPL
asta -t example.com --query "List all open services with versions"  # One-shot
```

### Advanced

```bash
asta -t example.com --scan-profile full --syn-scan     # Full stealth SYN scan
asta -t example.com --exploit --yes                     # Full kill chain with exploitation
asta -t example.com --debug                             # Debug logging
asta -t example.com -o ./my-reports                     # Custom output directory
```

### Servers

```bash
asta --web                          # Web platform (dashboard + C2 + terminal)
asta --c2 --c2-port 8443            # C2 server only
asta --api                          # REST API
asta --dashboard                    # Legacy dashboard
asta --schedule "0 3 * * *" -t example.com  # Scheduled scans
```

---

## 📋 Configuration

Asta reads from `config.yaml` by default. Copy the template and customize:

```bash
cp config.example.yaml config.yaml   # config.yaml is gitignored
```

### Key Sections

```yaml
# Target (can be overridden with -t)
target: ""

# API keys for external intelligence sources
api_keys:
  shodan: ""
  censys: ""
  securitytrails: ""
  github: ""
  gitlab: ""

# LLM / AI analysis
llm:
  provider: openrouter
  model: "openai/gpt-4o-mini"
  auto_analysis: true
  api_keys:
    groq: ""
    deepseek: ""
    github: ""
    openai: ""
    openrouter: "sk-or-v1-..."

# Module toggles
modules:
  passive:
    enabled: true
    dns: true
    whois: true
    subdomains: true
    osint: true
    dorking: true
    email_harvest: true
    social_osint: true
  active:
    enabled: true
    port_scan: true
    service_detection: true
    web_enum: true
    syn_scan: false             # Requires admin/root + scapy
    nmap_scan: true
    udp_scan: true
    os_detection: true
    masscan: true
    ffuf: true
    httpx: true
    subfinder: true
    sslscan: true
    gau: true
  enumeration:
    enabled: true
    cloud_assets: true
    vuln_checks: true
    attack_surface: true
    cve_matching: true
    waf_detection: true
    nikto: true
    wpscan: true
    enum4linux: true
    gowitness: true
    hydra: true
  exploit:
    enabled: false              # MUST opt in via --exploit --yes
  cracking:
    enabled: false
    hashcat: true
  post_exploit:
    enabled: false
```

See [`config.example.yaml`](config.example.yaml) for the full reference.

---

## 🛠️ Installation & Dependencies

### Python Dependencies

| Package | Required | Purpose |
|---------|----------|---------|
| `aiohttp>=3.9` | ✅ | Async HTTP client + server, WebSocket, LLM API calls |
| `PyYAML` | ✅ | Config parsing |
| `jinja2` | ✅ | HTML report templates |
| `beautifulsoup4` | ✅ | HTML parsing |
| `rich>=13.0` | ✅ | Terminal UI: spinners, panels, tables, themes |
| `dnspython` | ❌ | Advanced DNS queries (installed by default) |
| `scapy` | ❌ | SYN scan (raw packets) |
| `cryptography` | ❌ | C2 channel encryption |
| `pycryptodome` | ❌ | Credential cracking tools |

### External Tools (auto-detected at runtime)

Install any for enhanced capability:
- **nmap** — Advanced port scanning with OS detection and NSE scripts
- **masscan** — Ultra-fast port scanning (millions of packets/sec)
- **ffuf** — Web directory fuzzing
- **httpx** — HTTP probing and tech detection
- **subfinder** — Passive subdomain discovery
- **sslscan** — TLS cipher/protocol assessment
- **gau** — Archive URL discovery
- **nikto** — Web server vulnerability scanner
- **wpscan** — WordPress vulnerability scanner
- **enum4linux-ng** — SMB/RPC enumeration
- **gowitness** — Web screenshots
- **hydra** — Online brute-force attacks
- **hashcat** — Offline password cracking

### Development Install

```bash
git clone https://github.com/AridsWolfgang/Asta.git && cd Asta
python -m venv .venv
.venv\Scripts\activate     # Windows
source .venv/bin/activate   # Linux/macOS
pip install -e .[full]

# Or install minimal (core only)
pip install -e .

# Optional extras
pip install cryptography    # C2 encryption
pip install scapy           # SYN scan
```

---

## ⚡ Performance

Asta's architecture is built for speed. Each phase maximizes concurrency while respecting dependency chains:

```
PHASE 1 (Passive)         PHASE 2 (Active)           PHASE 3 (Enumeration)
────────────────────     ──────────────────────      ─────────────────────
┌─ DNS ─┐                Port Scan (serial)          Cloud Assets
├─ WHOIS┤                ╲                            Vuln Checks
├─ Subdo├─ asyncio.gather ╲  ┌─ SYN Scan ─┐           Attack Surface
├─ OSINT┤                ╱  ├─ Nmap ──────┤           Nikto + WPScan +
├─ Dork ├─ 7 modules    ╱   ├─ Masscan ───┤           Enum4linux + GoWit
├─ Email│               ╱   ├─ UDP Scan ──┤─ gather   ness + Hydra (opt)
└─ Social┘              ╱   ├─ Srv Detect─┤           Plugin tasks gather
↓ sequential after     ╱    ├─ Subfinder ─┤
  gather (zone xfer,  ╱     ├─ SSLScan ───┤
  email_harvest on   ╱      ├─ Gau ───────┤
  whois results)   ╱        └─ Proxy Test─┘
                  ╱         ↓
                 ╱        Web Enumeration + chain
                ╱         (tech_fp → httpx → ffuf →
               ╱           js_extract → cve_match → waf)
              ╱
            Plugin tasks gather

                                    PHASE 4 (Post-Scan)
                                    ┌─────────────────┐
                                    │ AI Analysis      │
                                    │ ┌─ CVE Explain ─┤
                                    │ ├─ Summary ─────┤
                                    │ ├─ Remediation ─┤
                                    │ └─ Query REPL ──┤
                                    └─────────────────┘
```

### Optimizations

| Optimization | Before | After |
|-------------|--------|-------|
| **Inline imports** | ~50 `from ..submodule import x` inside functions | Zero — all hoisted to module top |
| **Passive phase** | 7 modules in strict sequence | 7 modules via `asyncio.gather` |
| **Active phase** | 15+ modules in strict sequence | Port scan → 11 modules in parallel via `asyncio.gather` |
| **Phase plugins** | Sequential `for` loop | `asyncio.gather` with `return_exceptions=True` |
| **Rate limiter** | Shared `deque` with `time.time` (race condition) | Token bucket with `asyncio.Lock` + `loop.time()` |
| **Database inserts** | Row-by-row `for`+`execute` | `executemany` batch inserts |
| **Report generation** | Sync file I/O, sequential formats | Async I/O via `aiofiles`, formats in parallel |
| **Config defaults** | Rebuilt on every access | Cached after first build, `copy.deepcopy` thereafter |
| **Plugin discovery** | Re-scanned on every access | Cached after first call |
| **Nmap integration** | `subprocess.run` (blocking) | `create_subprocess_exec` + `tempfile.mkstemp` |
| **LLM analysis** | None | Async API calls via `asyncio.gather` with 45s timeout |

---

## 📁 Project Structure

```
├── config.example.yaml           # Configuration template (copy to config.yaml)
├── pyproject.toml                # Package metadata & dependencies
└── asta/
    ├── cli.py                    # Argument parsing + dispatch + query REPL
    ├── config.py                 # YAML loader with deep merge
    ├── core/
    │   └── orchestrator.py       # 5-phase pipeline controller + LLM analysis
    ├── phases/
    │   ├── passive/              # DNS, WHOIS, subdomains, OSINT, dorking, email, social
    │   ├── active/               # Port scan, SYN, nmap, masscan, UDP, OS detect,
    │   │                         # service detect, web enum, tech FP, JS extract,
    │   │                         # httpx, ffuf, subfinder, sslscan, gau
    │   ├── enumeration/          # Cloud assets, CVE matcher, WAF detect, vuln checks,
    │   │                         # nikto, wpscan, enum4linux, gowitness, hydra
    │   ├── exploit/              # Vuln scanner, web attacks, WAF bypass, bruteforce,
    │   │                         # exploit engine, payload gen, msf integration
    │   ├── cracking/             # Hashcat wrapper, wordlist manager
    │   └── post_exploit/         # Reverse shell, privesc, pivot, cred dump,
    │                             # bloodhound, kerberos, mimikatz, lateral move
    ├── infrastructure/
    │   ├── llm/                  # AI/LLM client (multi-provider) + analysis functions
    │   ├── stealth/              # Proxy rotation, user-agent rotation
    │   ├── storage/              # SQLite database (scans, findings, targets)
    │   └── utils/                # Terminal UI, logging, rate limiter, webhooks
    ├── c2/                       # C2 server, encryption, Go implant, profiles
    ├── reporting/                # JSON, HTML, CSV, Nmap/Nessus/Burp XML exporters
    ├── interfaces/web/           # Unified SPA: dashboard + scans + C2 + results + reports
    └── plugins/                  # Plugin loader + hook system
```

---

## 📊 Database

Location: `data/asta.db` (auto-created)

```sql
-- Latest scan for a target
SELECT * FROM scans WHERE target = 'example.com' ORDER BY scan_date DESC LIMIT 1;

-- All findings for a scan phase
SELECT * FROM findings WHERE category LIKE 'active%' LIMIT 50;

-- Cross-scan diff
SELECT * FROM findings WHERE scan_id IN (1, 2) AND category = 'open_port';

-- Compare current vs last scan
asta --diff -t example.com
```

---

## 🔐 Security Notes

- **API keys** — `config.yaml` is gitignored. Use `config.example.yaml` as template.
- **Exploitation** — Requires explicit `--exploit --yes` flag. Never runs automatically.
- **Rate limiting** — Default 10 req/s with jitter. Adjust for stealth.
- **Proxy support** — HTTP proxy rotation, Tor SOCKS5 routing.
- **Random User-Agent** — Enabled by default to evade basic fingerprinting.

---

## ⚖️ Legal

Only use this tool on systems you own or have **explicit written authorization** to test. Unauthorized access is illegal in most jurisdictions.

**Authorized use cases:** Penetration tests (signed ROE), bug bounty hunting (in-scope), CTF competitions, security research on your own infrastructure.

---

<div align="center">

**MIT License** · Built for the offensive security community

[Report Bug](https://github.com/AridsWolfgang/Asta/issues) · [Request Feature](https://github.com/AridsWolfgang/Asta/issues)

</div>
