ravichandran3/cxploit-framework

Purpose and Entry Points

CXploit is a Python 3.10+ modular framework for authorized security assessment workflows: reconnaissance, vulnerability assessment, controlled exploitation modules, payload/session handling, post-assessment collection, reporting, and optional remote control. The primary launcher is main.py, which initializes the central framework and starts the interactive CLI; it can also enable the Flask API. Primary user-facing surfaces are exploit_framework/cli/console.py, exploit_framework/api/server.py, and exploit_framework/api/dashboard.py.

Core Orchestration

Framework is the central, thread-safe application coordinator: it initializes configuration, persistence, events, module discovery, sessions, and shutdown behavior. Dynamic discovery makes category modules and custom plugins available through a common module interface (MODULE_INFO, options, run, and check).

• exploit_framework/core/framework.py

• exploit_framework/core/module_loader.py

• exploit_framework/exploits/base.py

Control Plane: CLI, API, and Plugins

The CLI parses Metasploit-style commands, selects modules, applies option values, launches foreground/background work, and exposes sessions, reports, and attack-chain commands. The API presents analogous framework state and module-execution capabilities over HTTP. Plugins extend the same loader-driven module ecosystem and are a boundary for third-party code.

• exploit_framework/cli/commands.py

• exploit_framework/api/server.py

• exploit_framework/plugins/plugin_manager.py

Persistent State, Events, and Sessions

SQLite/SQLAlchemy persistence is the system-of-record boundary for targets, discovered services/vulnerabilities, credentials, events, and sessions. The event subsystem distributes operational logging/events; session management represents active connections and their lifecycle. Configuration is JSON-backed and governs runtime defaults, safety settings, concurrency, and output locations.

• exploit_framework/core/database.py

• exploit_framework/core/events.py

• exploit_framework/core/session.py

• exploit_framework/core/config.py

Assessment and AutoPwn Pipeline

Reconnaissance modules produce host, port, service, OS, web, and vulnerability findings. The AutoPwn coordinator composes scan/service results with offline CVE matching and selected exploitation modules; this is the major automated control flow and should remain gated by authorization and emergency-stop/rate-limit controls in the framework layer.

• exploit_framework/core/autopwn.py

• exploit_framework/recon/port_scanner.py

• exploit_framework/recon/vuln_scanner.py

• exploit_framework/recon/cve_db.py

Execution Stages and Module Families

Loaded modules are organized as independently selectable stages: exploits act on identified targets; payload generators/handlers establish or manage connections; post modules operate through sessions; evasion modules transform payloads or traffic; auxiliary modules provide scanning and credential/testing support. These modules depend on shared framework state rather than owning persistence directly.

• exploit_framework/exploits/web/sqli.py

• exploit_framework/payloads/generator.py

• exploit_framework/post/sys_enum.py

• exploit_framework/evasion/waf_bypass.py

• exploit_framework/auxiliary/cred_sprayer.py

C2, Reporting, and Runtime Dependencies

C2 is a distinct network boundary: a server and generated agent use encrypted TCP/HTTP channels. Reporting reads persisted assessment data to create HTML, JSON, PDF, and compliance outputs. Material dependencies include Flask (API/dashboard), SQLAlchemy with SQLite, Scapy and python-nmap for network operations, Paramiko for SSH, Requests/aiohttp for HTTP, PyCryptodome for cryptography, and Jinja2/ReportLab for reports.

• exploit_framework/c2/c2_server.py

• exploit_framework/c2/c2_agent.py

• exploit_framework/reporting/report_gen.py

• exploit_framework/reporting/compliance_report.py