Phalanx

Phalanx is the pr0t31n toolkit's central operations center — a Flask/SocketIO web application that aggregates every tool in the suite under a single management interface. It runs on port 5000 and provides client management, project lifecycle tracking, scope-based tool orchestration, and cross-tool intelligence correlation.

At project creation, operators define one or more assessment scopes (internal network, external network, OSINT, web application, API, database, wireless, Bluetooth, UWB, ZigBee, hardware, or firewall). Each scope automatically maps to the appropriate pr0t31n tools — for example, an internal network scope dispatches Scattershot3 and optionally Nessus, while an API scope dispatches Siphon with optional Burp and Postman integration. Phalanx tracks which tools have run, which scopes are complete, and which findings have been produced across the entire engagement.

Phalanx maintains a SQLite database that stores client records, project metadata, scope configurations, tool execution status, and cross-tool findings. It communicates with each tool's Flask management app (Vantage, Crucible, Gauntlet, Spectre) via their respective API ports to launch scans, monitor progress, and collect results. Compliance tracking maps findings against frameworks such as NIST SP 800-171, PCI DSS, and others, producing gap analyses that show which controls have been tested and which remain unverified.

The real-time dashboard uses Socket.IO to push live status updates from all active tools to the operator's browser. Findings from different tools targeting the same host or service are correlated automatically, providing a unified view of the target's security posture rather than isolated per-tool reports.

Phalanx uses the shared _auth.py authentication module common to all pr0t31n Flask applications. On first launch, _auth.init_auth() generates a unique secret key and prompts the operator to set credentials. All sessions are protected with secure, HTTP-only cookies with a 30-minute expiration. Security headers (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Strict-Transport-Security) are applied to every response.

Access is restricted to authenticated operators only. The application is designed to run on the operator's local machine or a secured jump host — it is not intended for exposure to untrusted networks. All inter-tool communication occurs over localhost or a trusted management network.

Phalanx does not generate its own findings — it aggregates and correlates findings from all other pr0t31n tools. Each tool's findings retain their original nomenclature (e.g., SS-nnn from Scattershot3, FR-nnn from Fracture, SI-nnn from Siphon). Phalanx adds a correlation layer that groups related findings by target host, service, or compliance control.

The cross-tool correlation view presents findings organized by: target (IP/hostname), scope (internal network, web app, etc.), compliance control (NIST, PCI DSS requirement), and risk level (CRITICAL through INFO). This multi-dimensional view enables operators to see the complete security posture of each target across all assessment methodologies.

Phalanx aggregates action items from all tools across all appliances in the engagement. The centralized view shows action items by priority, target, and source tool.