Vulnerability-CVE-Scanner 🔍🛡️

A modular, lightweight Python-based Vulnerability Scanner designed for authorized security assessments, learning environments, and cybersecurity internship projects (e.g., SyntexHub).

---

📌 Project Overview

Vulnerability-CVE-Scanner is an authorized security auditing tool written in Python. It scans target systems for open TCP ports, captures raw banners exposed by services, detects the exact software product and version using regular expressions, and queries the National Vulnerability Database (NVD) REST API v2 (with an offline fallback DB) to surface publicly known Common Vulnerabilities and Exposures (CVEs). Finally, it compiles all findings into a structured, readable security report.

---

✨ Features

• Authorized Target Warning: Built-in ethics disclaimer preventing accidental or unauthorized scanning.
• Multithreaded Port Scanner: Rapidly scans target TCP ports using Python's concurrent.futures.
• Intelligent Banner Grabbing: Captures raw response strings from TCP services and HTTP/HTTPS server headers (HEAD probing).
• Regex-based Service Detection: Parses service banners to identify exact software names and version numbers (e.g., OpenSSH 8.2p1, Apache 2.4.41, nginx 1.18.0).
• NVD API v2 Integration & Offline Fallback: Connects to NIST's NVD API for live CVE lookups and seamlessly falls back to an offline JSON database if internet or API access is limited.
• Structured Security Reporter: Generates comprehensive scan reports (reports/scan_report.txt) complete with severity metrics and actionable defense advice.
• Colorized CLI Output: Styled terminal feedback using colorama (when available).

---

🛠️ Technologies Used

• Python 3.14+
• Standard Python Libraries: socket, threading, concurrent.futures, json, argparse, re, datetime
• Third-party Libraries: requests (for NVD REST API), colorama (for terminal coloring)

---

📁 Project Structure

Vulnerability-CVE-Scanner/
│── scanner.py          # Main CLI scanner orchestrator & multi-threaded runner
│── banner_grabber.py    # Socket & HTTP request handling for banner retrieval
│── service_detector.py  # Regex engine mapping raw banners to Product & Version
│── cve_lookup.py        # NVD REST API v2 connector with offline DB fallback
│── reporter.py          # Formats and saves formatted text security reports
│── config.py            # Target ports, API URLs, and fallback CVE database
│── requirements.txt     # Dependencies list
│── README.md            # Comprehensive project documentation & interview prep
│── .gitignore          # Git ignore configuration
└── reports/
    └── sample_report.txt # Pre-generated sample scan report

---

⚙️ Installation & Usage

1. Clone or Download Project

git clone https://github.com/your-username/Vulnerability-CVE-Scanner.git
cd Vulnerability-CVE-Scanner

2. Install Dependencies

pip install -r requirements.txt

3. Run a Scan

Basic Scan against localhost:

python scanner.py 127.0.0.1

Scan custom ports with 15 threads and custom output path:

python scanner.py 127.0.0.1 -p 22,80,443,3306 -t 15 -o reports/my_custom_report.txt

CLI Command Flags:

• target: IP address or Hostname (Required).
• -p, --ports: Custom ports (e.g., -p 22,80 or -p 20-25). Default ports: 21, 22, 25, 53, 80, 110, 143, 443, 3306, 8080.
• -t, --threads: Thread pool size (Default: 10).
• -o, --output: Custom output filepath for report (Default: reports/scan_report.txt).

---

📄 Example Terminal Output

====================================================================
                       ETHICAL USE WARNING
  This tool is intended ONLY for authorized security testing, local
  learning environments, or systems you explicitly own/manage.
  Unauthorized scanning of networks/hosts is illegal and unethical.
====================================================================

[*] Starting Vulnerability CVE Scan against 127.0.0.1 (127.0.0.1)
[*] Ports to scan (10 total): [21, 22, 25, 53, 80, 110, 143, 443, 3306, 8080]
[*] Thread count: 10

[+] Port    22/TCP OPEN | Service: SSH | Product: OpenSSH (8.2p1) | CVEs: 2
[+] Port    80/TCP OPEN | Service: HTTP/HTTPS | Product: Apache (2.4.41) | CVEs: 1

[*] Generating final security report...
[+] Report successfully generated and saved to: reports/scan_report.txt

---

🔍 How CVE Matching Works

1. Port Scan: The scanner tests connection state using non-blocking TCP socket connect logic.
2. Banner Grab: When a port opens, banner_grabber.py reads initial server responses or sends an HTTP HEAD request.
3. Service Detection: service_detector.py uses regular expression patterns to isolate software names and version strings.
4. API Query: cve_lookup.py passes "{product} {version}" to the official NVD API endpoint (https://services.nvd.nist.gov/rest/json/cves/2.0).
5. Fallback: If API limits or connection errors occur, the module queries LOCAL_CVE_DB inside config.py.

---

🎯 SyntexHub Internship Interview Preparation

Key Concepts

1. What is a CVE?

CVE (Common Vulnerabilities and Exposures) is a dictionary of publicly disclosed cybersecurity vulnerabilities. Each CVE is assigned a unique identifier (e.g., CVE-2021-41773) maintained by MITRE and NIST, allowing security professionals to standardize vulnerability management worldwide.

2. What is Banner Grabbing?

Banner Grabbing is a reconnaissance technique used to retrieve text strings transmitted by network services upon initial socket connection. Banners often expose service names, version numbers, operating system details, and build numbers.

3. Why is Service & Version Detection Important?

Simply knowing a port is open isn't enough for risk assessment. Service detection identifies what software is listening on that port and what version is running. This enables security auditors to evaluate whether specific vulnerabilities (CVEs) exist on that specific build.

4. How the Scanner Works Step-by-Step

1. User provides target hostname/IP. Hostname is resolved via socket.gethostbyname().
2. A multithreaded ThreadPoolExecutor checks each target port concurrently.
3. Open ports trigger grab_banner() to read initial banner bytes or server HTTP response headers.
4. detect_service() uses regex to parse software names and version strings.
5. lookup_cves() queries the NVD API v2 with local offline JSON fallback.
6. generate_report() outputs findings, severity metrics, and remediation strategies to reports/scan_report.txt.

---

Common Cybersecurity Interview Q&A

Q1: What is the difference between active reconnaissance and passive reconnaissance?

Answer: Passive reconnaissance gathers target info without directly sending traffic to the target (e.g. OSINT, WHOIS lookups, Shodan database queries). Active reconnaissance directly sends packets/traffic to target systems to probe for open ports, banners, and responses (e.g. port scanning with Nmap or this Python scanner).

Q2: Why use multithreading (ThreadPoolExecutor) in network scanners?

Answer: Socket connections are I/O-bound operations that spend significant time waiting for network responses or timeouts. Multithreading allows multiple connection requests to run concurrently, dramatically reducing overall scan execution time.

Q3: How would you prevent banner grabbing on a production server?

Answer: Banner obfuscation or suppression can be configured in server daemons. For instance, in Apache, set ServerTokens Prod and ServerSignature Off. In Nginx, set server_tokens off;. In SSH, banner strings can be customized or suppressed in sshd_config.

---

🚀 How to Upload this Project to GitHub

# 1. Initialize git repository
git init

# 2. Add all project files
git add .

# 3. Commit changes
git commit -m "Initial commit of Vulnerability-CVE-Scanner project"

# 4. Create a main branch
git branch -M main

# 5. Add remote GitHub repository URL
git remote add origin https://github.com/your-username/Vulnerability-CVE-Scanner.git

# 6. Push code to GitHub
git push -u origin main

---

⚠️ Ethical Disclaimer

This project is created strictly for educational, academic, and authorized auditing purposes. Users are responsible for complying with all applicable local, national, and international laws. The author assumes no liability for misuse or damage caused by this software.

---

🔮 Future Scope

• Support for UDP port scanning.
• Export options for JSON, HTML, and CSV report formats.
• Integration of CVSS score filters and CPE match string querying.
• GUI interface using PyQt or Web Interface via Flask/FastAPI.