A console application that models penetration-testing data — asset inventory, port scans, and CVSS-scored vulnerabilities — written from scratch in plain Java.
I built this to consolidate core object-oriented programming after finishing a Java course: instead of leaving the concepts as "watched the lecture," I forced every one of them into a single connected codebase. The security theme fits my focus (offensive security / penetration testing), but the real goal of the project is the Java.
⚠️ This tool does not perform real scanning or attacks. Port scanning is simulated (values are generated by a hand-written pseudo-random generator); no network packets are ever sent. It is an educational Java exercise, not a security tool.
The name reflects what it is: a ledger — a record of what a red team gathers during an engagement, not a tool that performs the engagement.
- Maintains an inventory of network assets (servers, workstations, network devices)
- Tracks open ports and service banners per server
- Records vulnerabilities with CVSS scores and derives a severity level
- Groups findings into a scan tied to a target, with a running event log
- Computes a weighted risk score across an asset's findings
- Includes small crypto/util helpers (prime check, string hash, XOR, PRNG)
No external libraries — everything is built on the standard library only.
| Class | Responsibility | OOP concept it exercises |
|---|---|---|
Asset |
Base network asset + IP validation | encapsulation, constructor chaining |
Server |
Asset with manually-grown port arrays | inheritance, array growth (how ArrayList works internally) |
Workstation |
Asset whose risk depends on admin state | inheritance, method overriding |
NetworkDevice |
Asset that parses firmware versions | inheritance, string parsing |
Vulnerability |
A CVSS finding with severity mapping | value clamping, switch |
Crypto |
Static utility helpers | static methods, LCG PRNG, XOR |
Scan |
Findings for one target | composition, ArrayList, Iterator, LinkedList |
Main |
Demo driver | polymorphism over Asset[] |
The central idea is polymorphism: assets of every subtype are held in a
single Asset[] and their type() / riskWeight() resolve correctly at
runtime without any instanceof branching. Scan uses composition
(has-a target) rather than inheritance, and removes findings safely through an
Iterator instead of mutating a list mid-iteration.
- JDK 17 or newer (the code uses arrow-form
switchexpressions)
# from the repository root
javac src/*.java -d bin
java -cp bin Main=== RedLedger Console (demo) ===
--- Inventory ---
Server risk=3 Server | 10.0.0.5 (web01) - Ubuntu 22.04 [UP] ports=3
Workstation risk=4 Workstation | 192.168.1.51 (pc02) - Windows 11 [UP] user=admin (admin)
NetworkDevice risk=5 NetworkDevice | 10.0.0.1 (gw01) - RouterOS [UP] vendor=MikroTik fw=6.44.5
--- Scan: web01 ---
Scan[10.0.0.5] vulns=3 risk=51.9
[Critical] CVE-2024-3400 (9.8) - PAN-OS Command Injection
[Medium] CVE-2021-1234 (5.4) - Reflected XSS
[Low] CVE-2020-0001 (2.1) - Information Disclosure
Removing findings below CVSS 4.0...
Scan[10.0.0.5] vulns=2 risk=45.6
Concepts I plan to fold in next, as I keep learning:
- 2D array network map (subnet grid)
- Overloaded,
printf-formatted report generation - Interactive
Scanner-driven menu (do-while+switch) - Exception handling to replace the current manual input validation
MIT — see LICENSE.