AMPHIBIA

Professional VAPT & Bug-Bounty toolkit web app scanner, mobile (APK) static analyzer, AI-assisted triage, and tamper-evident reporting.

_{Powered by Owntechs}

_{Built by Dickson Massawe (archnexus) · archnexus707@gmail.com}

⚠ Authorized use only. AMPHIBIA is a dual-use offensive-security tool. Run it only against targets you own or have explicit written permission to test. Unauthorized scanning is illegal in most jurisdictions.

What it is

AMPHIBIA is a desktop-installed security testing toolkit aimed at the East-African pentesting market (Tanzania first). It runs as a local FastAPI service with a React web UI that opens automatically in your default browser, and ships as a signed binary for each major OS.

Two operating modes:

VAPT mode — formal vulnerability assessment for fintech, government, and enterprise customers. Produces a polished MASVS-aware report (HTML / PDF / JSON / CSV).
BOUNTY mode — hunter workflow with per-finding Markdown bundles ready to paste into HackerOne / Bugcrowd reports.

Web-app scanning + Android APK static analysis + AI-assisted triage live in the same binary — no per-module licensing.

Features

Web-app scanner

40+ vulnerability checks (SQLi, XSS, SSRF, SSTI, LFI, RCE, XXE, CRLF, IDOR, mass-assignment, auth-strip, HPP, JWT, GraphQL, NoSQLi, LDAPi, XPath, CORS, CSP, broken access, open redirect, subdomain takeover, and more)
Content discovery with extensible wordlists
Per-scan-type intelligent caps: quick=2k, stealth=5k, deep=25k, aggressive=50k tasks
Resumable scans (SQLite-backed task queue)
Live findings feed + live HTTP traffic panel over WebSocket
Selenium-based screenshot capture for visual evidence
Built-in Blind-XSS callback server + OOB SSRF correlation
HTTP-verb tampering, method-override bypass, HEAD-vs-GET auth-bypass detection
Nuclei template loader for community detection rules

Mobile (APK) static analyzer

Binary AndroidManifest.xml parser (proper chunk-walker, not heuristic)
Permission classification (NORMAL vs DANGEROUS with risk weighting)
Component surface analysis (Activities / Services / Receivers / Providers — exported flag)
v1 / v2 / v3 APK Signing Block detection (catches Janus CVE-2017-13156)
Native library + architecture enumeration
Framework detection (Flutter, React Native, Cordova, Xamarin, Unity, Ionic, Kotlin)
Popular SDK fingerprinting (Firebase, OkHttp, Crashlytics, OneSignal, etc.)
Hardcoded secret scan (AWS / Google / Stripe / Slack / Firebase / JWT / private keys)
Cleartext-HTTP URL detection across resources + DEX strings
Mobile-specific report with MASVS L1 compliance matrix + business-context inference

AI-assisted triage (optional, BYO API key)

Multi-provider: Claude / OpenAI / DeepSeek / Ollama
Per-finding triage, PoC drafting, remediation guidance
Per-provider Test Connection button in Settings
Bilingual (English + Swahili) report rendering

Reports

Black text, bold, high-contrast professional theme (no eye strain)
HTML / PDF / JSON / CSV — all four files share one timestamp
Tamper-evident: signed integrity manifest verified at runtime
Custom branding: ship reports under your own company name + logo

Engagement workflow

Engagement records + TZS invoice generation
Scheduled scans
Multi-target batch queue
Bounty submission tracker
Compliance pack auto-bundle (TDPA / BoT / PCI / ISO mappings)

Installation

Windows (.exe)

Download AMPHIBIA-Setup-v5.0.0.exe from the releases page.
Double-click the installer. Approve UAC when prompted (installer needs admin to write C:\Program Files\AMPHIBIA\).
Click through the evaluation-licence prompt.
Once installed, launch from the Start Menu or desktop icon. A console window will open showing startup progress, and your default browser will open to http://127.0.0.1:8888 once the backend is healthy (~5-10 sec).

Where things live on Windows:

What	Path
Install dir (read-only)	`C:\Program Files\AMPHIBIA\`
Reports	`%LOCALAPPDATA%\AMPHIBIA\reports\`
Config	`%LOCALAPPDATA%\AMPHIBIA\config.json`
Licence	`%LOCALAPPDATA%\AMPHIBIA\license.dat`
Crash log	`%LOCALAPPDATA%\AMPHIBIA\crash.log`
Scan history DB	`%LOCALAPPDATA%\AMPHIBIA\reports\scans.db`

Uninstall: Settings → Apps → AMPHIBIA → Uninstall. Your reports are preserved.

Linux (.deb)

Built and tested on Ubuntu 22.04 / 24.04 (amd64). Should work on any Debian derivative with glibc >= 2.31.

sudo dpkg -i amphibia_5.0.0_amd64.deb
sudo apt -f install            # pull any missing deps

# Launch
amphibia                       # via /usr/bin symlink, or
/opt/amphibia/AMPHIBIA         # direct binary

Where things live on Linux:

What	Path
Install dir	`/opt/amphibia/`
Launcher symlink	`/usr/bin/amphibia`
Menu entry	`/usr/share/applications/amphibia.desktop`
Reports	`~/.local/share/AMPHIBIA/reports/`
Config	`~/.local/share/AMPHIBIA/config.json`
Licence	`~/.local/share/AMPHIBIA/license.dat`

Uninstall: sudo apt remove amphibia. Reports under ~/.local/share/AMPHIBIA/ are preserved.

macOS (.app / .dmg)

Build from source on a Mac (no pre-built .dmg is published yet — request via email if you need one signed for distribution).

# Prereqs: Python 3.11+, Xcode Command-Line Tools, optionally Homebrew create-dmg
brew install python create-dmg

git clone https://github.com/archnexus707/amphibia.git
cd amphibia
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt PyInstaller cython

bash packaging/build_macos.sh

# Output:
#   packaging/dist/AMPHIBIA/AMPHIBIA.app
#   packaging/installer-output/AMPHIBIA-5.0.0.dmg  (if create-dmg is installed)

# Run
open packaging/dist/AMPHIBIA/AMPHIBIA.app

Where things live on macOS:

What	Path
`.app` bundle	`/Applications/AMPHIBIA.app` (after drag-install from .dmg)
Reports	`~/Library/Application Support/AMPHIBIA/reports/`
Config	`~/Library/Application Support/AMPHIBIA/config.json`
Licence	`~/Library/Application Support/AMPHIBIA/license.dat`

On first launch macOS Gatekeeper may complain (unidentified developer). Right-click → Open → Open. Notarised .dmg release is on the roadmap.

Running under dev (from source)

You'll want this if you're contributing code or want the fastest iteration loop.

Prereqs

Stack	Version	Notes
Python	3.11+	3.13 is what CI builds use
Node.js	18+	For the React frontend
npm	9+	Ships with Node
Git	any	For cloning
Chrome / Chromium	latest	For Selenium screenshots (auto-found via webdriver-manager)

Setup

git clone https://github.com/archnexus707/amphibia.git
cd amphibia

# Python deps
python -m venv venv
# Windows:
venv\Scripts\activate
# Linux/macOS:
source venv/bin/activate
pip install -r requirements.txt

# Optional: frontend dev (only if you want to edit React)
cd web/frontend
npm install
npm run build           # builds into web/backend/static/ for the launcher
cd ../..

Running

There are THREE ways to run AMPHIBIA in dev mode.

Option A — Customer mode (mimic the .exe / .deb / .app)

Boots the FastAPI backend + auto-opens the browser to the React UI. Exactly the same path a packaged install takes.

python launcher.py

Watch the console — it will print the URL with a one-time API token in the URL fragment, e.g.

http://127.0.0.1:8888/#token=mWDRo-_zcxorIahLFWI-us8ZZI3rK8ImmOF7QmUFwSQ

The frontend strips the fragment, persists the token to localStorage, and you land on the activation / mode-select screen.

Option B — Backend + frontend hot-reload (fastest iteration)

In one terminal:

# Just the FastAPI backend
uvicorn web.backend.app:app --host 127.0.0.1 --port 8888

In a second terminal:

cd web/frontend
npm run dev            # Vite dev server, usually http://localhost:5173

The dev server proxies /api/* and /ws/* to the backend so React saves hot-reload while keeping the running scans alive. Read the token from ~/.local/share/AMPHIBIA/api_token.txt (or %LOCALAPPDATA%\AMPHIBIA\ on Windows) and paste it into the Activate page.

Option C — CLI mode (no browser)

python main.py --help
python main.py scan https://target.com --type quick --mode vapt

The CLI shares the same scanner core but skips the FastAPI / React layer. Useful for headless servers, cron jobs, CI integration.

Quick start

After installation:

Activate the licence — paste your licence.lic content on the Activate page (commercial customers) or click "Continue evaluation" for the 30-day trial.
Pick a mode — VAPT (formal report) or BOUNTY (hunter workflow).
Settings → AI engine — enter your AI provider key (DeepSeek recommended: sk-...) and click Test on that provider's tile to verify connectivity.
Hunt → Quick Scan — paste a target URL. For first-time use, pick quick scan-type (~2-3 minutes on a typical site).
Reports — once the scan finishes, HTML / PDF / JSON / CSV land in your reports directory and the dashboard shows the live finding count + severity breakdown.
APK Scan (mobile) — drag an .apk file onto the APK Scan page. Static analysis runs in seconds; a mobile-specific report is generated separately from the web-app report.

Configuration

config.json lives in your platform-specific data dir (see install tables above). All keys are optional — defaults are sensible.

{
  "ai": {
    "enabled": true,
    "active_provider": "deepseek",
    "providers": {
      "deepseek":  { "api_key": "sk-...", "model": "deepseek-chat", "host": "" },
      "openai":    { "api_key": "",      "model": "gpt-4o-mini",   "host": "" },
      "anthropic": { "api_key": "",      "model": "claude-haiku-4-5-20251001", "host": "" },
      "ollama":    { "api_key": "",      "model": "llama3.1",      "host": "http://localhost:11434" }
    }
  },
  "notifications": {
    "enabled": false,
    "webhooks": []
  },
  "security": {
    "strict": false
  },
  "max_total_tasks": 2000,
  "threads": 10,
  "rate_limit": 100,
  "timeout": 10
}

Notable keys:

Key	Default	Effect
`security.strict`	`false`	If `true`, the launcher EXITS on any tamper / debugger / VM signal instead of just logging a warning. Recommended for shipped customer installs.
`max_total_tasks`	per-scan-type	Hard cap on queued tasks. Set to `0` to disable.
`ai.enabled`	`false`	Master switch for the AI layer.
`ai.active_provider`	`deepseek`	Which provider gets used for triage / PoC / chat.

Build pipeline

For maintainers shipping releases. End-users do NOT need to read this.

# Windows
packaging\build_windows.bat          # hardened (Cython + integrity sign + PyInstaller + Inno)
packaging\build_windows.bat --fast   # dev build (skip Cython)

# Linux
bash packaging/build_linux.sh        # produces .deb in packaging/installer-output/

# macOS
bash packaging/build_macos.sh        # produces .app, optionally .dmg

The hardened pipeline:

Snapshot the repo into build-snapshot/
Cythonize ~40 core modules into compiled .pyd/.so (raises RE bar significantly)
PyInstaller bundles the snapshot into packaging/dist/AMPHIBIA/
Sign integrity manifest using keys/private.key (Ed25519)
Per-OS packaging:
- Windows → Inno Setup → .exe installer
- Linux → dpkg-deb → .deb
- macOS → optional create-dmg → .dmg

See BUILD.md for the deep-dive (Cython caveats, hidden imports, why PyInstaller runs from packaging/, code-signing notes).

Security mechanisms

AMPHIBIA ships with several layered anti-tamper / anti-RE defences:

Layer	What it does
Cython compilation	All security-critical Python (~40 modules incl. scanner, licence, report, AI client) compiles to native `.pyd`/`.so`. Defeats trivial `pyinstxtractor` + decompile attacks.
HWID-bound licences	Each `licence.lic` is signed against the customer's machine fingerprint (CPU + MAC + hostname + BIOS UUID). Sharing the file across machines won't work.
Ed25519 signed integrity manifest	`_internal/integrity.manifest` lists SHA-256 of every critical binary. Launcher verifies the manifest's signature using the same public key embedded for licence verification. Tampering with any covered file is detected at boot.
Anti-debugger probe	Native debugger detection on boot — Win: `IsDebuggerPresent` + `CheckRemoteDebuggerPresent`; Linux: `/proc/self/status` TracerPid; macOS: sysctl `P_TRACED`.
Anti-VM probe	Multi-signal VM detection (CPUID hypervisor bit + WMI manufacturer + filesystem artefacts). Requires 2+ signals to fire (no false positive on legitimate Hyper-V users).
Strict mode	Set `config.security.strict = true` to make any tamper / debugger / VM signal exit the launcher cleanly. Default is advisory (log + continue) so a probe bug never bricks a customer install.

None of these prevent a determined attacker — the goal is to raise the cost above what a typical cracker is willing to spend. For our target market (commercial tool at $200-500/seat) this is sufficient.

Licensing

AMPHIBIA is commercial software with a 30-day evaluation period.

Trial: 30 days from first launch, full feature parity.
Commercial: single (1 machine) or team (N machines via max_machines field in the licence). Licences are issued via keys/private.key on the dev machine and emailed as a signed .lic file.
Contact: archnexus707@gmail.com for pricing / activation.

The keys/ directory in this repo holds the Ed25519 signing keys. The PRIVATE key (keys/private.key) MUST stay on the build machine and is never shipped in any bundle.

See LICENSE.txt for the full licence terms.

Troubleshooting

"Unknown Publisher" SmartScreen on Windows — expected until we ship a code-signed binary. Click More info → Run anyway. Code-signing cert is on the roadmap.

Browser doesn't auto-open — the launcher prints the URL with a one-time token. Copy it from the console and paste into your browser.

Port 8888 in use — the launcher auto-tries 8889, 8890, 8891, 8892. If all are in use it errors out cleanly; close whatever's using them.

Scan hangs at "discovery" — the crawler is enumerating the URL graph. Quick scans against large sites can take 1-3 minutes before the queue starts draining. Watch the console for progress.

Report opens but text looks washed out — should not happen post-5.0.0. If it does, your installed bundle is from before the readability fix; reinstall the latest .exe / .deb / .app.

Cython compilation fails on hardened build — install a C compiler (MSVC on Win, gcc on Linux, Xcode CLT on macOS) then retry.

APK manifest shows nonsense fields — should not happen post-5.0.0 (the AXML parser was rewritten with a proper chunk-walker). If you hit it, file an issue with the APK SHA-256.

Crash log is empty / not present — crash.log is truncated on every launch (faulthandler is reinstalled fresh). It only fills if a real native crash occurs.

Support

Channel	When to use it
Email — `archnexus707@gmail.com`	Licensing, sales, custom development
GitHub Issues	Bug reports, feature requests (public)
In-app `Help → Diagnostics`	Generates a `diagnostics_report.txt` you can attach to a support email — captures bundle hash, config, last crash log, scanner counters

Roadmap

Short-term (this quarter):

Code-signing certificate for Windows + macOS notarisation
Floating-licence server for enterprise multi-seat
Real implementations for the remaining stub vuln types (websocket, grpc, serverless, cloud_metadata, prototype_pollution)
Per-provider AI key validation in CI

Mid-term:

Built-in Frida hook generation for mobile dynamic analysis
Native DEX decompilation for deeper APK secret scan
Linux ARM64 build target
Swahili UI localization (currently only Swahili report localization)

Built in Tanzania · Powered by Owntechs

Name		Name	Last commit message	Last commit date
Latest commit History 23 Commits
assets		assets
AMPHIBIA.png		AMPHIBIA.png
AMPHIBIA2.png		AMPHIBIA2.png
LICENSE.txt		LICENSE.txt
README.md		README.md
USAGE.md		USAGE.md

Navigation Menu

Repository files navigation

AMPHIBIA

Table of Contents

What it is

Features

Installation

Windows (.exe)

Linux (.deb)

macOS (.app / .dmg)

Running under dev (from source)

Prereqs

Setup

Running

Option A — Customer mode (mimic the .exe / .deb / .app)

Option B — Backend + frontend hot-reload (fastest iteration)

Option C — CLI mode (no browser)

Quick start

Configuration

Build pipeline

Security mechanisms

Licensing

Troubleshooting

Support

Roadmap

About

Releases

Packages

Contributors

Folders and files

Latest commit

History

Repository files navigation

AMPHIBIA

Table of Contents

What it is

Features

Installation

Windows (.exe)

Linux (.deb)

macOS (.app / .dmg)

Running under dev (from source)

Prereqs

Setup

Running

Option A — Customer mode (mimic the .exe / .deb / .app)

Option B — Backend + frontend hot-reload (fastest iteration)

Option C — CLI mode (no browser)

Quick start

Configuration

Build pipeline

Security mechanisms

Licensing

Troubleshooting

Support

Roadmap

About

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors