Manual Mode

Prerequisites

Written authorization from client (mandatory — checked before any active scan)
Scan tools installed (Settings → Tools)
Target in approved scope list
No AI key required — all manual mode features work without Claude

1

Open Tool Runner

From the Home Screen, click any attack surface, then select Manual Mode in Wizard Step 2. Or navigate directly to Tools → Tool Runner from the left sidebar.

💡 Keyboard shortcut: Ctrl+T opens the Tool Runner from anywhere in the app.
2

Select a Tool from the Library

The Tool Runner shows all 60+ installed tools organized by category: Recon, Web, API, Network, Cloud, Mobile, RE, and Reporting. Click any tool to open its configuration panel.
3

Configure and Run

Each tool panel shows all available flags with descriptions. Fill in the target and any options, then click Run. Output streams live to the Results panel. You can run multiple tools simultaneously in separate tabs.
4

Log Findings Manually

When you find a vulnerability, click + Add Finding in the Findings panel (or press Ctrl+F). Enter the finding details — PhantomYerra calculates CVSS and EPS scores automatically from the severity inputs.
5

Attach Evidence

In the Finding Detail panel, click Attach Evidence to upload screenshots, HTTP request/response captures, or tool output files. All evidence is SHA-256 hashed and RFC 3161 timestamped for chain of custody.
6

Generate Report

When your manual testing is complete, go to Reports → Generate. In manual mode, reports use template-based generation (no AI required). Select Executive, Technical, or Compliance template and download the PDF.

⏱️ Duration: fully determined by the tester. Manual mode imposes no time constraints or auto-progression.

Common Manual Commands Reference

Recon & Asset Discovery

# Subdomain enumeration subfinder -d target.com -silent -o subs.txt httpx -l subs.txt -title -status-code -tech-detect # DNS enumeration dnsx -l subs.txt -a -cname -mx -resp # Web crawl katana -u https://target.com -d 5 -o crawl.txt

Web Application Testing

# Nuclei full scan nuclei -u https://target.com -t nuclei-templates/ -severity medium,high,critical # Directory brute-force ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirb/big.txt -mc 200,301,302 # SQL injection sqlmap -u "https://target.com/item?id=1" --dbs --batch --level=3 --risk=2 # XSS testing xsstrike -u "https://target.com/search?q=test" --crawl

Network Scanning

# Full port scan + service detection nmap -sV -sC -p- --min-rate 5000 192.168.1.0/24 -oA scan # SMB vulnerability check nmap --script smb-vuln-ms17-010,smb-vuln-ms08-067 192.168.1.0/24 # Fast initial sweep masscan 192.168.1.0/24 -p0-65535 --rate=10000 -oX masscan.xml

API Testing

# API route discovery kiterunner scan https://api.target.com -w routes-large.kite --output-file routes.txt # JWT analysis jwt_tool [token] -T # Tamper mode jwt_tool [token] -C -d /usr/share/wordlists/rockyou.txt # Crack secret # GraphQL introspection graphql-cop -t https://api.target.com/graphql

Mobile Testing

# APK static analysis apktool d app.apk -o app_decompiled/ grep -r "api_key\|password\|secret" app_decompiled/ # Dynamic analysis with Frida frida -U -f com.target.app -l ssl_pinning_bypass.js # MobSF automated analysis # Upload APK via PhantomYerra → Mobile → Upload APK → Analyze

Reverse Engineering

# String extraction strings -a binary | grep -E "(password|secret|key|token|api)" # radare2 quick analysis r2 -A binary # Then: afl (list functions), pdf @main (disassemble main) # Ghidra headless analyzeHeadless /tmp/ghidra_proj MyProject -import binary \ -postScript DecompileAll.py

Logging Findings Manually

1

Open Finding Editor

Press Ctrl+F or click + Add Finding in the Findings panel. The Finding Editor opens with all required fields.
2

Fill in Finding Details

Title : SQL Injection in /api/users?id= parameter Type : sql_injection Severity : Critical CVSS Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (PhantomYerra calculates score: 9.8 automatically) URL / Location : https://target.com/api/users?id=1 Parameter : id Evidence : Screenshot + HTTP request/response PoC Steps : 1. Send GET /api/users?id=1'-- ... (exact steps) Remediation : Use parameterized queries / prepared statements
3

Attach Evidence Files

Drag and drop evidence files into the Evidence section: screenshots (.png/.jpg), Burp Suite exports (.xml), tool output (.txt/.json), or video recordings (.mp4). Each file is automatically SHA-256 hashed and RFC 3161 timestamped.
4

Set Finding Status

Status options: Confirmed : Verified exploitable — include in report Suspected : Needs more testing to confirm Informational : Low risk, include as note False Positive: Mark as FP, exclude from report counts
5

Link to Attack Chain

In the Finding Detail, click Add to Attack Chain to link this finding to other related findings. The Attack Chain visualizer shows how findings combine into a full compromise path.

CVSS Scoring Reference

Attack Vector : Network(N) / Adjacent(A) / Local(L) / Physical(P) Attack Complexity : Low(L) / High(H) Privileges Req. : None(N) / Low(L) / High(H) User Interaction : None(N) / Required(R) Scope : Unchanged(U) / Changed(C) Confidentiality : None(N) / Low(L) / High(H) Integrity : None(N) / Low(L) / High(H) Availability : None(N) / Low(L) / High(H) PhantomYerra auto-calculates base score from these 8 vectors. EPS (Exploitability Priority Score) is calculated from CVSS + EPSS data.

Prerequisites

Open Tool Runner

Select a Tool from the Library

Configure and Run

Log Findings Manually

Attach Evidence

Generate Report

Common Manual Commands Reference

Recon & Asset Discovery

Web Application Testing

Network Scanning

API Testing

Mobile Testing

Reverse Engineering

Logging Findings Manually

Open Finding Editor

Fill in Finding Details

Attach Evidence Files

Set Finding Status

Link to Attack Chain

CVSS Scoring Reference

Common Issues

Related Topics