🔍 Mini Vulnerability Scanner

A lightweight, educational vulnerability scanner written in pure Python 3 — no external dependencies required.

⚠️ Legal Warning: Only scan hosts you own or have explicit written permission to test. Unauthorized port scanning and vulnerability assessment is illegal in most jurisdictions (US CFAA, UK Computer Misuse Act, etc.). The authors accept no liability for misuse.

---

✨ Features

Module	What it does
Port Scanner	Concurrent TCP connect scan with banner grabbing
Banner Analysis	Matches service banners against 15+ known vulnerable versions
Dangerous Ports	Flags risky exposed services (Redis, MongoDB, Elasticsearch, VNC, RDP, etc.)
HTTP Headers	Checks for missing security headers (HSTS, CSP, X-Frame-Options, etc.)
SSL/TLS	Detects deprecated protocols (TLS 1.0/1.1, SSLv3) and certificate expiry
HTML Report	Generates a clean, color-coded vulnerability report
JSON Report	Machine-readable output for CI/CD pipelines

---

🚀 Quick Start

Requirements: Python 3.7+ — no pip installs needed (stdlib only)

git clone https://github.com/YOUR_USERNAME/vuln-scanner.git
cd vuln-scanner
python3 vuln_scanner.py localhost

---

📖 Usage

python3 vuln_scanner.py <target> [options]

Arguments:
  target              Hostname or IP address to scan

Options:
  --ports,  -p        Port range (default: 1-1024)
                      Examples: 80, 1-65535, 8000-9000
  --timeout,-t        Socket timeout in seconds (default: 1.5)
  --output, -o        Output file: report.html or report.json
  --workers,-w        Concurrent threads (default: 150)

Examples

# Scan localhost, common ports, auto-generate HTML report
python3 vuln_scanner.py localhost

# Full port scan with faster timeout
python3 vuln_scanner.py 192.168.1.1 --ports 1-65535 --timeout 1

# Specific ports, save JSON report
python3 vuln_scanner.py myserver.com --ports 80,443,22,3306 --output report.json

# Web app check only (HTTP/HTTPS)
python3 vuln_scanner.py example.com --ports 80-443 --output web_report.html

---

📊 Sample Output

════════════════════════════════════════════════════════════
  🔍  MINI VULNERABILITY SCANNER
════════════════════════════════════════════════════════════
  ⚠  For authorized testing only

  Target  : localhost  →  127.0.0.1
  Ports   : 1–1024

[1/4] Port scanning…
      Found 4 open port(s)

[2/4] Analyzing banners…
[3/4] Checking HTTP security headers…
[4/4] Checking SSL/TLS…

────────────────────────────────────────────────────────────
  SCAN RESULTS — localhost (127.0.0.1)
────────────────────────────────────────────────────────────

OPEN PORTS
     22/tcp  SSH             SSH-2.0-OpenSSH_7.4
     80/tcp  HTTP
    443/tcp  HTTPS
   3306/tcp  MySQL

FINDINGS

  [CRITICAL] Dangerous service exposed: MySQL (port 3306)
             MySQL exposed — ensure authentication is required
             Fix: Bind MySQL to 127.0.0.1; use strong passwords

  [HIGH    ] Outdated/vulnerable software on port 22
             OpenSSH < 7.7 — user enumeration (CVE-2018-15473)
             Fix: Upgrade to OpenSSH ≥ 8.0

  [MEDIUM  ] Missing security header: Content-Security-Policy
             Missing CSP — XSS risk not mitigated by server
             Fix: Define a CSP policy appropriate to your app

---

🏗️ Project Structure

vuln-scanner/
├── vuln_scanner.py     # Single-file scanner — all logic here
└── README.md

The code is split into clear sections:

• Data classes — OpenPort, Finding, ScanResult
• Port scanner — concurrent TCP with banner grabbing
• Analyzers — banner matching, dangerous ports, HTTP headers, SSL/TLS
• Report generators — HTML and JSON output
• CLI — argparse-based interface

---

🎯 Legal Practice Targets

Use these intentionally vulnerable environments to practice:

Platform	URL	Notes
DVWA	https://github.com/digininja/DVWA	Run locally via Docker
TryHackMe	https://tryhackme.com	Browser-based labs
HackTheBox	https://hackthebox.com	CTF-style machines
VulnHub	https://vulnhub.com	Downloadable VMs
Metasploitable	https://sourceforge.net/projects/metasploitable	Classic practice VM

---

🔬 How Scoring Works

Findings are classified into five severity levels:

Level	Color	Criteria
CRITICAL	🔴 Red	Remotely exploitable, no auth, known active exploits
HIGH	🟠 Orange	Significant risk, likely exploitable
MEDIUM	🟡 Yellow	Moderate risk, requires conditions to exploit
LOW	🔵 Blue	Defense-in-depth issues, information disclosure
INFO	⚫ Gray	Informational, no direct risk

---

📄 License

MIT — for educational use. You are solely responsible for ensuring you have authorization before scanning any system.