PHAROX SECURITY

During contemporary penetration testing and red-teaming engagements, ethical hackers and security researchers face four chronic bottlenecks:

• Severe Reconnaissance Latency: Traditional scanning scripts operate sequentially, resulting in hour-long delays across large /24 subnets.
• Disjointed Tooling Silos: Results from port scanners, web application fuzzers, and network scanners remain isolated in disparate XML or JSON files, requiring tedious manual correlation.
• Alert Fatigue & Flat CVSS Lists: Standard vulnerability scanners report flat lists of CVEs based solely on base scores, failing to convey whether a vulnerability is actually reachable from external ingress.
• Operational Production Risks: Unthrottled multi-threaded scans frequently trigger target firewall rate-limits or cause denial-of-service disruptions on client assets.

PHAROX Security functions as a modular offensive security ecosystem. An operator submits a target IP, CIDR block, or domain through the React/Tailwind frontend. The FastAPI backend validates scope and permissions, enqueues the engagement into background workers, and orchestrates the security pipeline.

Raw outputs from reconnaissance and vulnerability scans are ingested, normalized into a unified intermediate JSON schema, and persisted simultaneously into PostgreSQL (for transactional history) and Neo4j (for attack graph traversal). In parallel, the Scikit-learn Random Forest model scores each finding's true exploitability based on advisory text and runtime factors.

The client tier is built with React, Tailwind CSS, and Framer Motion. It provides a dark cyber visual theme engineered specifically for security practitioners:

• State Management & Streaming: Uses React hooks with debounced WebSocket listeners to ingest thousands of real-time socket events without UI frame drops.
• Chart.js Telemetry: Renders CVSS score distributions, port distribution radar charts, and temporal scan velocity graphs.
• Virtualized Scanners: High-density tables render thousands of open ports and CVE hits using virtual windowing.

The backend is built with FastAPI (Python 3.11+). FastAPI was selected for its native asynchronous event loop (uvloop), strict Pydantic request/response validation schemas, and automated OpenAPI 3.0 documentation.

Heavy network scans and vulnerability audits execute via asynchronous coroutines and non-blocking background workers, ensuring the API server remains responsive to telemetry requests even during massive CIDR sweeps.

PHAROX uses a dual-database pattern: PostgreSQL manages ACID transactional data, and Neo4j handles interconnected attack topology.

Traditional vulnerability scanners treat findings as flat disconnected records. In contrast, PHAROX represents the target environment as an attack graph in Neo4j. This allows security engineers to calculate the shortest path to critical crown jewels and evaluate lateral movement vectors.

1
2
3
4
5
6
7
8
9
10
11
// Identify multi-hop privilege escalation and lateral movement attack paths
MATCH path = (origin:Host {is_exposed: true})
             -[:RUNS_SERVICE]->(svc:Service)
             -[:HAS_VULNERABILITY]->(vuln:Vulnerability {severity: "CRITICAL"})
             -[:ALLOWS_ACCESS]->(priv:Credential)
             -[:PERMITS_LATERAL]->(target:Host {is_critical_asset: true})
WHERE vuln.cvss >= 9.0 AND vuln.has_public_exploit = true
RETURN path, 
       reduce(risk = 0.0, n IN nodes(path) | risk + coalesce(n.cvss, 1.0)) AS PathCumulativeRisk
ORDER BY PathCumulativeRisk DESC
LIMIT 5;

The API adheres to RESTful OpenAPI 3.0 conventions with asynchronous BackgroundTask dispatches. Security scans are initiated with HTTP 202 Accepted tokens, allowing clients to stream updates over WebSockets without holding HTTP connections open.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
from fastapi import APIRouter, Depends, HTTPException, BackgroundTasks, status
from pydantic import BaseModel, IPvAnyAddress
from typing import List
from core.auth import get_current_active_user, require_role
 
router = APIRouter(prefix="/scans", tags=["Scan Orchestration"])
 
class ScanRequest(BaseModel):
    target: str
    target_cidr: str | None = None
    profile: str = "comprehensive_recon"
    ports: List[int] = [21, 22, 25, 80, 443, 3306, 5432, 8080, 8443]
 
@router.post("/dispatch", status_code=status.HTTP_202_ACCEPTED)
async def dispatch_security_scan(
    payload: ScanRequest,
    background_tasks: BackgroundTasks,
    user = Depends(require_role(["Lead_Tester", "Security_Admin"]))
):
    """Enqueues multi-stage security pipeline: Recon -> OpenVAS -> ZAP -> Graph Ingest."""
    scan_id = generate_cryptographic_uuid()
    background_tasks.add_task(
        execute_orchestration_pipeline,
        scan_id=scan_id,
        target=payload.target,
        profile=payload.profile,
        operator_id=user.id
    )
    return {
        "scan_id": scan_id,
        "status": "QUEUED",
        "message": "Scan pipeline safely dispatched with non-intrusive rate limits."
    }

The PHAROX scanning lifecycle operates through five distinct phases to maintain operational security, prevent target disruption, and guarantee verifiable findings:

Reconnaissance combines passive DNS resolution, reverse PTR lookups, and an asynchronous TCP banner grabber. Using Python's asyncio.open_connection with an adaptive semaphore, it probes target ports without incurring process fork overhead.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
import asyncio
import socket
from typing import Dict, Any, List
 
class AsyncPortScanner:
    """Non-blocking TCP banner enumerator with concurrency rate-limiting."""
    def __init__(self, max_concurrency: int = 1024, timeout: float = 1.2):
        self.semaphore = asyncio.Semaphore(max_concurrency)
        self.timeout = timeout
 
    async def scan_port(self, target_ip: str, port: int) -> Dict[str, Any]:
        async with self.semaphore:
            conn = asyncio.open_connection(target_ip, port)
            try:
                reader, writer = await asyncio.wait_for(conn, timeout=self.timeout)
                banner = b""
                try:
                    # Attempt safe banner capture
                    banner = await asyncio.wait_for(reader.read(512), timeout=0.6)
                except asyncio.TimeoutError:
                    pass
                writer.close()
                await writer.wait_closed()
                return {
                    "port": port,
                    "state": "open",
                    "protocol": "tcp",
                    "banner": banner.decode("utf-8", errors="ignore").strip()
                }
            except (asyncio.TimeoutError, ConnectionRefusedError, OSError):
                return {"port": port, "state": "closed", "banner": ""}
 
    async def run_scan(self, target_ip: str, ports: List[int]) -> List[Dict[str, Any]]:
        tasks = [self.scan_port(target_ip, p) for p in ports]
        results = await asyncio.gather(*tasks)
        return [r for r in results if r["state"] == "open"]

PHAROX computes full CVSS v3.1 qualitative equations rather than relying merely on static third-party ratings:

• Base Metrics: Attack Vector (Network, Adjacent, Local, Physical), Attack Complexity, Privileges Required, User Interaction, Scope, and Confidentiality / Integrity / Availability impacts.
• Temporal Metrics: Dynamically adjusted using Exploit Code Maturity (E:U, E:P, E:F, E:H) from active CISA KEV and Exploit-DB feeds.
• Environmental Overrides: Adjusted based on network segmentation and crown-jewel asset criticality defined in the target scope.

Traditional CVSS ratings are purely static: a vulnerability discovered on an isolated internal development machine receives the exact same score as one exposed directly to the public internet.

PHAROX introduces an AI-assisted vulnerability triage model that combines textual analysis of vulnerability disclosures with runtime topological parameters (exposure state, service criticality, and port accessibility) to score actionable risk.

PHAROX aggregates real-time intelligence feeds to contextualize whether discovered vulnerabilities are being actively exploited in the wild:

• NVD JSON 2.0 API: Continuous ingestion of official NIST National Vulnerability Database CVE records and CVSS vectors.
• CISA KEV Catalog: Live correlation against the Cybersecurity and Infrastructure Security Agency Known Exploited Vulnerabilities catalog.
• EPSS (Exploit Prediction Scoring System): Real-time probability ratings indicating the likelihood of active exploitation within 30 days.

Manual reporting consumes hours of consultant time. PHAROX generates standardized reports formatted for both executive and engineering audiences:

1. Graph context beats flat vulnerability lists: Security teams do not need 500 disconnected CVSS warnings; they need to know which three hops allow an external attacker to pivot to database credentials.

2. AI must be bounded by deterministic validation: In offensive security, unconstrained LLM hallucinations can cause false reports. Using bounded Scikit-learn pipelines with TF-IDF provides auditable, deterministic probability distributions.

3. Rate-limiting is an offensive security discipline: An aggressive, unthrottled scan is a failed assessment. Respecting client network stability through intelligent pacing is paramount.