Fracture — pr0t31n

How It Works

⚠️ Authorized Testing Only

This tool interacts with live systems and must only be used for testing that has been explicitly authorized by the asset owner. Unauthorized use of this tool to probe, scan, exploit, or otherwise interact with systems you do not have written permission to test is illegal under computer fraud and abuse laws (CFAA, CMA, and international equivalents). pr0t31n does not condone or recommend any unauthorized use. Always obtain a signed Rules of Engagement (RoE) or Statement of Work (SoW) before beginning any assessment.

Fracture is a web application penetration testing orchestrator that drives a comprehensive 22+ phase security assessment against a target URL. It combines built-in Python-based testing logic with external security tools (Nuclei, Nikto, OWASP ZAP, gobuster, sslscan, testssl.sh) to cover the full OWASP Top 10 2025 attack surface. Each phase targets a specific vulnerability class — from TLS misconfiguration and missing security headers through injection attacks, authentication bypass, and business logic flaws to advanced attacks like request smuggling and cross-user data leakage.

The assessment begins with reconnaissance (HTTP probing, technology fingerprinting, directory discovery) and progresses through unauthenticated testing phases (TLS analysis, header inspection, crawling, injection, traversal, SSRF) before moving into authenticated phases that require credentials (endpoint enumeration, IDOR/privilege escalation, session analysis, CSRF, cross-user leakage). Fracture supports multiple authentication methods — form-based login, HTTP Basic, Bearer tokens, API keys, custom headers, and cookie-based sessions — allowing it to test both the login mechanism itself and the application's behaviour under authenticated contexts.

Fracture features adaptive concurrency with a hardware-aware semaphore that scales parallelism based on real-time CPU and memory utilisation. A checkpoint/resume system (checkpoint.json) persists completed phases so interrupted scans can resume. All HTTP requests issued by built-in Python testing are captured as request/response/log triplets under evidence/ directories, and every third-party tool invocation produces a .log sibling transcript. Wildcard/catch-all detection prevents false positives by identifying servers that respond identically to all paths.

Output follows the pr0t31n universal directory structure with findings.json (schema v1.1), findings.csv, summary.json, timestamped audit logs, and per-phase evidence directories. When running under Crucible, Fracture emits __CRUCIBLE_LOG__, __CRUCIBLE_STATUS__, __CRUCIBLE_FINDING__, and __CRUCIBLE_ACTION_ITEM__ protocol tokens for real-time management and triage.

Phase Pipeline

Phase 0 — HTTP probe, fingerprinting, directory discovery
Phase 1 — TLS/SSL cipher and certificate analysis
Phase 2 — Security header inspection
Phase 3 — Crawl, form extraction, JS secret hunting
Phase 4 — SQLi, XSS, SSTI, CMDi, CRLF, XXE
Phase 5 — Path traversal / LFI
Phase 6 — Server-Side Request Forgery
Phase 7 — Authentication bypass / default creds
Phase 8 — Sensitive file exposure
Phase 9 — Nuclei + Nikto vulnerability scan
Phase 10 — GraphQL endpoint detection and introspection
Phase 11 — Authenticated endpoint enumeration (requires auth)
Phase 12 — IDOR / privilege escalation testing (requires auth)
Phase 13 — Session management analysis (requires auth)
Phase 14 — CSRF protection testing (requires auth)
Phase 15 — Cross-user data leakage (requires auth + auth2)
Phase 16 — Open redirect testing
Phase 17 — Insecure deserialization detection
Phase 18 — File upload endpoint detection (informational)
Phase 19 — Mass assignment / privilege escalation testing
Phase 20 — Multi-credential access matrix (BFLA / unauthenticated access)
Phase 21 — Broken Function Level Authorization — cross-role endpoint replay
Phase 22 — Logoff detection, session timeout, server-side invalidation (requires auth)

Security

Fracture is a CLI tool with no web interface. Security considerations:

Credential isolation: Auth credentials stored in the project settings JSON with restricted file permissions — never exposed in command-line arguments or logs
Browser-assisted auth: Selenium sessions use temporary browser profiles cleaned up after use. Supports Chrome, Firefox, and Edge with auto-detected or specified WebDriver paths
Subprocess safety: All external tool invocations use list-based subprocess calls. URL parameters are properly escaped
Evidence security: Per-request HTTP evidence files are stored with restricted permissions in the project output directory

Features

Advanced

Open Redirect Testing

Phase 16 — URL redirect parameter manipulation and redirect chain analysis.

Deserialization Detection

Phase 17 — Insecure deserialization vulnerability detection across common frameworks.

Mass Assignment Testing

Phase 19 — Parameter pollution, hidden field injection, and privilege escalation via mass assignment.

Authentication

Authentication Bypass

Phase 7 — Default credential testing, authentication bypass techniques, and login mechanism analysis.

Account Lockout Testing

Phase 7b — Brute-force protection verification and account lockout threshold detection.

Authorization

IDOR / Privilege Escalation

Phase 12 — Insecure Direct Object Reference testing and vertical/horizontal privilege escalation (requires authentication).

Multi-Credential Access Matrix

Phase 20 — Cross-role endpoint access testing, BFLA detection, and unauthenticated access verification.

BFLA Testing

Phase 21 — Broken Function Level Authorization testing across multiple credential sets.

Exposure

Sensitive File Detection

Phase 8 — Probes for exposed configuration files, backups, source code, and sensitive data files.

GraphQL Testing

Phase 10 — GraphQL endpoint detection, introspection query analysis, and schema extraction.

Logging & Monitoring Failures

Phase 10b — Actuator endpoint exposure, verbose error detection, and debug mode identification.

Injection

Injection Testing

Phase 4 — SQL injection, Cross-Site Scripting (XSS), Server-Side Template Injection (SSTI), Command Injection (CMDi), CRLF injection, and XML External Entity (XXE) testing.

Path Traversal / LFI

Phase 5 — Local file inclusion and directory traversal payload testing across discovered parameters.

Server-Side Request Forgery

Phase 6 — SSRF detection via URL parameters, redirects, and internal service probing.

Logic

Business Logic Testing

Phase 5b — Workflow bypass, race conditions, TOCTOU, and value tampering attacks against application logic.

Request Smuggling

Phase 17b — CL.0, TE.CL, and CL.TE HTTP request smuggling detection.

Performance

Adaptive Concurrency

Hardware-aware thread pool with real-time CPU/RAM monitoring that scales parallelism automatically.

Reconnaissance

HTTP Probing & Fingerprinting

Phase 0 — Technology detection, server header analysis, directory discovery via gobuster, and web framework identification.

TLS/SSL Analysis

Phase 1 — Cipher enumeration, certificate validation, protocol version checks, and vulnerability detection using sslscan and testssl.sh.

Subdomain Takeover Detection

Phase 1b — Dangling CNAME detection, AXFR zone transfer attempts, and subdomain takeover vulnerability identification.

Security Header Inspection

Phase 2 — Comprehensive check for missing or misconfigured security headers (CSP, HSTS, X-Frame-Options, etc.).

Crawl & JS Secret Hunting

Phase 3 — Web crawling, form extraction, and JavaScript analysis for hardcoded secrets, API keys, and internal URLs.

Resilience

Checkpoint / Resume

Completed phases persisted to checkpoint.json — interrupted scans resume from where they stopped.

Wildcard Detection

Detects catch-all/wildcard responses to prevent false-positive flood from directory brute-forcing and parameter fuzzing.

Session

Session Management Analysis

Phase 13 — Session token entropy, fixation, expiry, and cookie attribute analysis (requires authentication).

CSRF Protection Testing

Phase 14 — Cross-Site Request Forgery token validation, SameSite cookie enforcement, and state-changing request analysis.

Cross-User Data Leakage

Phase 15 — Tests whether one authenticated user can access another user's data through shared endpoints (requires two credential sets).

Vulnerability Scanning

Nuclei + Nikto Scanning

Phase 9 — Template-based vulnerability scanning with Nuclei and legacy web vulnerability scanning with Nikto.

OWASP ZAP Integration

Phase 9b — Automated vulnerability scanning using OWASP ZAP's active scanner.

Use Cases

Full OWASP Top 10 Web Application Assessment

Run all 22+ phases against a web application to systematically test for every OWASP Top 10 2025 vulnerability category with evidence-backed findings.

Authenticated Application Testing

Provide multiple credential sets to test IDOR, privilege escalation, cross-user data leakage, CSRF, and broken access control under real user contexts.

Pre-Production Security Gate

Integrate Fracture into a CI/CD pipeline to gate deployments on the absence of CRITICAL/HIGH findings before release to production.

Compliance-Driven Web App Audit

Generate findings mapped to OWASP, NIST 800-53, PCI DSS 4.0, and ISO 27001 frameworks for compliance reporting and remediation prioritisation.

GraphQL API Security Assessment

Detect exposed GraphQL endpoints, test introspection controls, and identify query depth/complexity vulnerabilities.

CLI Reference

Command Examples

Run with Settings

python3 fracture.py --settings settings.json

Run a full 22-phase assessment with a settings file specifying target URL, auth, and phase configuration.

Generate Template Settings

python3 fracture.py --init-settings

Create a template settings.json for customization.

Resume After Interruption

python3 fracture.py --settings settings.json --resume

Resume from the last completed phase checkpoint.

Third-Party Tool Invocations

Commands and flags used when this tool invokes third-party dependencies during operation.

nuclei

Template-based vulnerability scanning for CVEs, misconfigurations, and web exposures

nuclei -u <url> -t cves/

nuclei -u <url> -severity critical,high,medium

nikto

Legacy web server vulnerability scanning and misconfiguration detection

nikto -h <url> -Format json

sslscan

SSL/TLS cipher suite enumeration and protocol vulnerability detection

sslscan --no-colour <host>:<port>

testssl.sh

Comprehensive TLS analysis including cipher grading and known vulnerability checks

testssl.sh --ip one <host>:<port>

gobuster

Directory and file brute-forcing for content discovery

gobuster dir -u <url> -w <wordlist> -t 50

whatweb

Web technology fingerprinting and framework identification

whatweb -a 3 <url>

shcheck

HTTP security header analysis

shcheck.py <url>

OWASP ZAP

Automated web vulnerability scanning (Phase 9b)

zap-cli active-scan <url>

feroxbuster

Recursive content discovery

feroxbuster -u <url> -w <wordlist> -o <out> --silent

tlsx

TLS certificate and cipher enumeration

tlsx -host <host:port> -json

dig

DNS record lookup for subdomain validation

dig +short <domain>

webanalyze

Technology stack detection (Wappalyzer rules)

webanalyze -host <url> -output json

ffuf

Fuzzing for hidden parameters and endpoints

ffuf -u <url>/FUZZ -w <wordlist> -o <out> -of json -mc all -fc 404

sqlmap

SQL injection detection and exploitation

sqlmap -u <url> --batch --output-dir=<dir> --forms

dalfox

Reflected/Stored XSS detection

dalfox url <url> -o <out> --format json

SSTImap

Server-side template injection testing

sstimap -u <url>

commix

OS command injection testing

commix -u <url> --batch

toxicache

Web cache poisoning detection

toxicache -u <url>

arjun

HTTP parameter discovery

arjun -u <url> -oJ <out>

jwt_tool

JWT token analysis and attack

jwt_tool <token> -M at

AuthProbe

Authentication method detection and session building

authprobe --url <url> --build-session

mitmdump

HTTP/S traffic interception proxy

mitmdump -p <port> --set upstream_cert=false

Finding Nomenclature

Fracture findings use the FR- prefix in the findings catalogue (e.g., FR-001, FR-002). Each finding includes:

Catalogue ID — Unique identifier from findings_catalogue.json mapped to a specific vulnerability type
Phase Attribution — The phase number and name where the finding was detected (e.g., Phase 4: Injection)
Risk Level — CRITICAL, HIGH, MEDIUM, LOW, or INFO (always uppercase)
OWASP Mapping — The corresponding OWASP Top 10 2025 category and URL
Evidence Files — Request/response pairs and .log transcripts in evidence/<phase>/ directories
Remediation — Specific fix guidance with effort rating and component classification

Common finding categories span the full OWASP Top 10: injection flaws (SQLi, XSS, SSTI, CMDi), broken access control (IDOR, BFLA, privilege escalation), cryptographic failures (weak TLS, missing HSTS), security misconfiguration (verbose errors, default credentials), and server-side request forgery.

Action Items

Fracture generates action items during the assessment that require manual follow-up or operator decision. These are emitted as __CRUCIBLE_ACTION_ITEM__ protocol tokens and displayed in the Crucible management console's Action Items tab. Action items are generated when:

A potential vulnerability requires manual verification to confirm exploitability (e.g., blind SQL injection candidates that need out-of-band confirmation)
An authentication or authorization test reveals anomalous behaviour that warrants deeper investigation
A business logic flaw is detected that requires domain knowledge to assess impact
Cross-user data leakage testing identifies shared endpoints where data segregation needs human review
File upload endpoints are discovered that need manual testing for content-type bypass and storage path traversal

Each action item includes the affected URL, the phase that generated it, a description of what was observed, and a suggested manual verification procedure.

Output Files

File	Format	Description
`meta.json`	JSON	Tool identity and engagement metadata
`findings.json`	JSON	Universal findings array v1.1
`findings.csv`	CSV	CSV mirror of findings
`summary.json`	JSON	Aggregated statistics
`scan.log`	TXT	Human-readable timestamped log
`scan.log.json`	JSONL	Machine-readable JSON log events
`errors.log`	TXT	ERROR-level entries only
`findings_catalogue.json`	JSON	Findings catalogue
`checkpoint.json`	JSON	Resumable scan checkpoint

Invocation Methods

Method	Usage
CLI — Direct	`cd /opt/pr0t31n/Fracture && python3 fracture.py [OPTIONS]` Run directly with command-line arguments.
Crucible-Managed	Launched and managed by Crucible (port 5100). Crucible handles start/stop/pause, log streaming, findings aggregation, and status tracking.

Integration

Depends On

AuthProbe (auth detection)
Scattershot3 (target discovery)

Used By

Crucible (manages)
Prometheus (reports)

Third-Party Dependencies & Credits

Tool / Library	Developer	Type	Link
gobuster	OJ Reeves	system	https://github.com/OJ/gobuster
sqlmap	Bernardo Damele / Miroslav Stampar	system	https://github.com/sqlmapproject/sqlmap
Nuclei	ProjectDiscovery	system	https://github.com/projectdiscovery/nuclei
Dalfox	hahwul (Kim Hwan)	system	https://github.com/hahwul/dalfox
wpscan	WPScan Team / Automattic	system	https://github.com/wpscanteam/wpscan
sslscan	rbsec (originally Ian Ventura-Whiting)	system	https://github.com/rbsec/sslscan
testssl.sh	Dirk Wetter	system	https://github.com/drwetter/testssl.sh
nikto	Chris Sullo / David Lodge / CIRT	system	https://github.com/sullo/nikto
ffuf	joohoi (Joona Hoikkala)	system	https://github.com/ffuf/ffuf
mitmproxy / mitmdump	mitmproxy team	system	https://github.com/mitmproxy/mitmproxy
Selenium / geckodriver	Mozilla / SeleniumHQ	system	https://github.com/mozilla/geckodriver
shcheck	meliot / santoru	system	https://github.com/santoru/shcheck

Metadata

Name	Fracture
Category	Exploitation
Version	2.69.0
Install Path	`/opt/pr0t31n/Fracture`
Main File	`fracture.py`
GitHub	https://github.com/pr0t31n/Fracture.git