# Mantis: Automating Security Discovery, Reconnaissance, and Vulnerability Scanning

This repository profile is provided by osrepos.com, an open source repository discovery platform.

Source: osrepos.com
Repository profile: https://osrepos.com/repo/phonepe-mantis
Generated for open source discovery and AI-assisted research.

Mantis is a powerful command-line security framework developed by PhonePe, designed to automate the entire workflow of asset discovery, reconnaissance, and vulnerability scanning. It efficiently processes top-level domains to uncover subdomains and certificates, conducts in-depth reconnaissance on active assets, and performs comprehensive scans for vulnerabilities, secrets, and misconfigurations. This robust tool integrates open-source and custom solutions, streamlining security assessments for organizations.

GitHub: https://github.com/PhonePe/mantis
OSRepos URL: https://osrepos.com/repo/phonepe-mantis

## Summary

Mantis is a powerful command-line security framework developed by PhonePe, designed to automate the entire workflow of asset discovery, reconnaissance, and vulnerability scanning. It efficiently processes top-level domains to uncover subdomains and certificates, conducts in-depth reconnaissance on active assets, and performs comprehensive scans for vulnerabilities, secrets, and misconfigurations. This robust tool integrates open-source and custom solutions, streamlining security assessments for organizations.

## Topics

- application-security
- attack-surface-management
- bugbounty
- pentesting
- reconnaissance
- security-tools
- python
- cybersecurity-automation

## Repository Information

Last analyzed by OSRepos: Fri Nov 14 2025 12:03:38 GMT+0000 (Western European Standard Time)
Detail views: 2
GitHub clicks: 2

## Safety Notice

OSRepos shares public repositories for knowledge and discovery only. Review source code, dependencies, licenses, and security implications before running or installing anything.

## Content

## Introduction

Mantis, developed by PhonePe, is a robust command-line security framework designed to automate the entire workflow of asset discovery, reconnaissance, and vulnerability scanning. Written in Python, it streamlines the process of identifying digital assets, gathering intelligence, and detecting security flaws across an organization's attack surface. Mantis takes top-level domains as input and systematically progresses through discovering subdomains and certificates, performing reconnaissance on active assets, and concluding with comprehensive scans for vulnerabilities, secrets, misconfigurations, and phishing domains. Key features include automated discovery, recon, and scanning, distributed scanning capabilities, easy scan customization, dashboard support for vulnerability management, advanced alerting, and seamless integration of new security tools.

## Installation

Mantis supports multiple installation types, with Docker being a recommended starting point for ease of setup. Before proceeding, ensure your system meets the minimum requirements: Ubuntu or macOS, 4GB RAM, 2 Cores, and 16GB Storage. The framework is CPU intensive, so running it on a dedicated VM is advised.

To install Mantis via Docker:

1.  Clone the Mantis repository:
    bash
    git clone https://github.com/PhonePe/mantis.git
    

2.  Navigate into the Docker setup directory:
    bash
    cd mantis/setup/docker
    

3.  Run the appropriate Docker setup script for your operating system:
    bash
    ./docker-setup-macos.sh
    # or
    ./docker-setup-ubuntu.sh
    

For uninstallation, run the following command in the same directory:
bash
docker compose down


A setup video is also available for guidance.

## Examples

Mantis offers intuitive command-line options for onboarding new targets and performing scans.

**Onboarding a new target (first-time scan):**

*   **Using a Top-Level Domain (TLD):**
    bash
    mantis onboard -o org_name -t example.in
    

*   **Using an IP address:**
    bash
    mantis onboard -o org_name -t 10.123.123.12
    

*   **Using an IP Range:**
    bash
    mantis onboard -o org_name -t 203.0.113.0-10
    

*   **Using an IP CIDR:**
    bash
    mantis onboard -o org_name -t 203.0.113.0/24
    

*   **Onboarding known assets from a file:**
    bash
    mantis onboard -o org_name -f input.txt
    

*   **Adding a new subdomain to an existing organization:**
    bash
    mantis onboard -o org_name -t subdomain.example.in --sub
    

**Performing subsequent scans:**

*   **Scan all assets belonging to an organization:**
    bash
    mantis scan -o org_name
    

*   **Scan all assets belonging to an organization and a specific application:**
    bash
    mantis scan -o org_name -a app_name
    

*   **Scan an existing subdomain for an organization:
    bash
    mantis scan -o org_name --sub subdomain.example.in
    

## Why Use Mantis

Mantis stands out as an invaluable tool for security professionals and organizations due to its comprehensive automation capabilities. It significantly reduces manual effort by integrating discovery, reconnaissance, and scanning into a single, streamlined workflow. The framework's support for distributed scanning enhances scalability, allowing assessments of large and complex attack surfaces. With its customizable scan workflows, dashboard support for vulnerability management, and advanced alerting features, Mantis provides deep visibility and control over security posture. Its ability to easily integrate new and custom tools makes it a flexible and adaptable solution for evolving security needs.

## Links

*   **GitHub Repository:** [https://github.com/PhonePe/mantis](https://github.com/PhonePe/mantis)
*   **Official Documentation:** [https://phonepe.github.io/mantis/](https://phonepe.github.io/mantis/)
*   **Join Discord:** [https://discord.gg/uJV8Y3uSGu](https://discord.gg/uJV8Y3uSGu)