Home Network Security Scanner & Risk Assessment Tool
NetzSchild scans your local Wi-Fi network, identifies connected devices,
evaluates security risks, and estimates Time-to-Compromise (TTC) — all locally, with zero cloud dependency.
Dashboard — Real-time risk overview with animated gauge and risk breakdown
Devices — Per-device security assessment with interactive port info
Scan — Multiple scan modes with auto-detected network range
| Feature | Description |
|---|---|
| 🎯 Risk Score (0–100) | Weighted risk model based on 9 security factors |
| ⏱️ Time-to-Compromise | Estimated time an attacker would need: < 1 hour → > 7 days |
| 🔍 Network Scanner | Discovers devices via Ping, ARP, SSDP/UPnP, and optional nmap |
| 🌐 Web Dashboard | Apple-inspired UI with real-time scanning, device inventory, and risk breakdown |
| 💻 CLI Interface | Interactive terminal launcher with multilingual support (EN / DE / UA) |
| 🔒 100% Local | All data stays on your machine — zero cloud, zero telemetry |
| 📊 Reports | Auto-generated CSV & HTML reports with per-device security advice |
| 🛡️ Security CI/CD | Automated Bandit, Trivy, and Gitleaks scans on every push |
| 🇬🇧🇩🇪🇺🇦 Multilingual | Full i18n support for English, German, and Ukrainian |
┌──────────────────────────────────────────────────────────┐
│ NetzSchild │
├──────────────┬──────────────────┬────────────────────────┤
│ CLI Mode │ Web Dashboard │ Risk Engine │
│ │ (FastAPI) │ │
│ netzschild │ │ netzschild_risk.py │
│ _cli.py │ web/app.py │ factors.json │
│ │ web/templates/ │ │
├──────────────┴──────────────────┴────────────────────────┤
│ Network Scanner │
│ net_scan_agent.py · tr064_fritz.py │
│ Ping │ ARP │ SSDP/UPnP │ Port Scan │ nmap (optional) │
├──────────────────────────────────────────────────────────┤
│ Report Generator │
│ integrate_scan_and_risk.py │
│ CSV + HTML output │
└──────────────────────────────────────────────────────────┘
- Python 3.10+
- (Optional) nmap for deep scans
git clone https://github.com/orelsv/NetzSchild.git
cd NetzSchild
python3 -m venv .venv
source .venv/bin/activate # Windows: .venv\Scripts\activate
pip install -r requirements.txtpython -m uvicorn web.app:app --host 127.0.0.1 --port 8000Open http://127.0.0.1:8000 in your browser.
python netzschild_cli.pyFollow the interactive menu to scan your network and compute your Risk Score.
from netzschild_risk import calculate_risk_and_ttc
user_data = {
"password_strength": 0.3,
"encryption": "WPA2",
"open_ports": ["22", "80"],
"default_credentials": False,
"firmware_age": 0.5,
"iot_count": 3,
"guest_network": "enabled_isolated",
"remote_management": False,
"upnp": True
}
result = calculate_risk_and_ttc("factors.json", user_data)
print(f"Risk Score: {result['risk_score']}/100")
print(f"Time to Compromise: {result['ttc']}")NetzSchild uses a weighted-factor model defined in factors.json. Each factor contributes to the overall Risk Score (0–100):
| Factor | Weight | Description |
|---|---|---|
| WiFi Password Strength | 15% | Length and complexity of your Wi-Fi password |
| WiFi Encryption | 15% | WPA3 → WEP/None (protocol strength) |
| Open Ports & Services | 18% | Critical ports (Telnet, SMB, RDP) and high-risk services |
| Default Credentials | 12% | Whether factory login/password is still in use |
| Firmware Age | 12% | How outdated the router/device firmware is |
| IoT Device Exposure | 8% | Number of IoT devices on the network |
| Guest Network | 7% | Whether guest Wi-Fi is enabled with proper isolation |
| Remote Management | 8% | WAN admin access enabled on the router |
| UPnP | 5% | Whether UPnP allows auto-opening of ports |
| Risk Score | TTC Estimate | Severity |
|---|---|---|
| 0 – 20 | > 7 days | 🟢 Low |
| 21 – 40 | 1 – 7 days | 🟡 Medium-Low |
| 41 – 70 | 1 – 24 hours | 🟠 Medium-High |
| 71 – 100 | < 1 hour | 🔴 High |
NetzSchild/
├── netzschild_cli.py # Interactive CLI launcher (EN/DE/UA)
├── netzschild_risk.py # Risk Score & TTC calculation engine
├── net_scan_agent.py # Network scanner (ping, ARP, SSDP, ports, nmap)
├── integrate_scan_and_risk.py # Report generator (CSV + HTML)
├── tr064_fritz.py # FRITZ!Box TR-064 integration
├── factors.json # Risk model configuration (weights & rules)
├── requirements.txt # Python dependencies
│
├── web/ # 🌐 Web Dashboard (FastAPI)
│ ├── app.py # Main FastAPI application & routes
│ ├── scanner.py # Async scanner service
│ ├── risk_service.py # Risk computation for web UI
│ ├── security_kb.py # Security knowledge base (port explanations)
│ ├── templates/ # Jinja2 HTML templates
│ │ ├── base.html # Base layout with sidebar navigation
│ │ ├── dashboard.html # Risk gauge, stats, risk breakdown
│ │ ├── devices.html # Device inventory table
│ │ ├── scan.html # Scan configuration & progress
│ │ └── settings.html # Language & privacy settings
│ └── static/
│ ├── css/style.css # Apple-inspired design system
│ └── js/app.js # Client-side interactivity
│
├── .github/workflows/ # 🔒 CI/CD Security Pipelines
│ ├── bandit.yml # Python static security analysis
│ ├── trivy-deps.yml # Dependency vulnerability scanning
│ └── gitleaks.yml # Secret detection in git history
│
├── docs/screenshots/ # 📸 README screenshots
├── LICENSE # MIT License
├── CONTRIBUTING.md # Contribution guidelines
└── SECURITY.md # Security policy
- All computations run locally on your machine
- No data is sent to external servers or cloud services
- Scan results (IPs, MACs, device names) are stored only locally
- No telemetry is collected by default
- NetzSchild is a diagnostic tool — it never modifies your network settings
Every push triggers three automated security scans:
| Scanner | Purpose | Blocks on |
|---|---|---|
| Bandit | Python static security analysis | HIGH severity + HIGH confidence |
| Trivy | Dependency vulnerability scanning | CRITICAL vulnerabilities |
| Gitleaks | Secret detection in code & git history | Any detected secret |
- Backend: Python 3.10+, FastAPI, Uvicorn
- Frontend: Jinja2 templates, vanilla CSS (Apple-inspired design system), vanilla JS
- Scanning: ICMP ping, ARP, SSDP/UPnP, TCP port scan, nmap (optional)
- Router Integration: TR-064 protocol (FRITZ!Box)
- CI/CD: GitHub Actions (Bandit, Trivy, Gitleaks)
Contributions are welcome! Please see CONTRIBUTING.md for guidelines.
This project is licensed under the MIT License.
Made with 🛡️ by orelsv