BASIC VULNERABILITY SCANNER — CLI

A beginner-friendly Python CLI project that performs basic, non-destructive security checks:

• Scans a list of common TCP ports
• Detects open TCP ports
• Checks common HTTP security headers
• Identifies missing security headers
• Displays exposed server information
• Provides basic suggestions for missing headers
• Includes a locally hosted Flask application for safe testing

Use only on systems you own or have explicit permission to test.

Project files

cli-vulnerability-scanner/
├── .gitignore
├── scanner.py
├── test_app.py
├── requirements.txt
└── README.md

1. How to set up this scanner

First download or clone the source code and follow these steps.

Windows (PowerShell)

Run these commands one by one:

1. cd cli-vulnerability-scanner
2. py -m venv .venv
3. .venv\Scripts\Activate.ps1
4. pip install -r requirements.txt

Linux / Kali

Run these commands one by one:

1. cd cli-vulnerability-scanner
2. python3 -m venv .venv
3. source .venv/bin/activate
4. pip install -r requirements.txt

2. Start the local test website

Open Terminal 1(Ctrl+ALt+T) and run:

"python3 test_app.py"

The test application should run at:http://127.0.0.1:5000

3. Run the scanner

Open Terminal 2 and run:

"python3 scanner.py"

The scanner will ask you to enter a website URL:

'Enter website URL: http://127.0.0.1:5000'

How it works

1. The user enters a website URL.
2. The scanner extracts the hostname from the URL.
3. It checks a predefined list of common TCP ports.
4. It sends an HTTP request to the target website.
5. It checks whether common security headers are present or missing.
6. It displays exposed server information when available.
7. It prints basic security suggestions in the terminal.

Security headers checked

The scanner currently checks:

• Content-Security-Policy
• X-Frame-Options
• X-Content-Type-Options
• Strict-Transport-Security
• Referrer-Policy

Common ports checked

The scanner currently checks these ports:

"21, 22, 23, 25, 53, 80, 443, 3306, 5000, 8080"

Limitations

This is a learning project and is not a replacement for professional tools such as Nmap, Nikto, Nessus, OpenVAS, or Burp Suite.

The current version:

• Does not perform SQL injection testing
• Does not perform XSS testing
• Does not attempt authentication bypass
• Does not exploit detected issues
• Does not perform CVE or software-version vulnerability lookups
• Does not save scan results as JSON
• Does not support custom port arguments from the command line

A clean result does not prove that a system is fully secure.

Author

Dev Saini