[. It does **NOT** contain exploits, brute-forcing, password cracking, credential harvesting, malware, or destructive payloads.
- [🎨 Dynamic Multi-Theme System](#-dynamic-multi-theme-system)
- [Modular Architecture](#modular-architecture)
- [How Each Vulnerability is Detected](#how-each-vulnerability-is-detected)
- [Severity Scoring System](#severity-scoring-system)
- [Installation & Setup](#installation--setup)
- [Running the Application](#running-the-application)
- [Demo Mode (College/Internship Presentation)](#demo-mode)
- [Report Generation (HTML, JSON, PDF)](#report-generation)
- [API Endpoints Documentation](#api-endpoints-documentation)
- [Security Guardrails & Ethical Compliance](#security-guardrails--ethical-compliance)
- [Evaluation & Submission Guide](#evaluation--submission-guide)
Modern organizations require proactive security assessments to identify misconfigurations before adversaries exploit them. **Vulnerability Scanner** implements standard passive network reconnaissance, HTTP security header auditing, cookie attribute analysis, and server banner fingerprinting through a lightweight, modular Python/FastAPI engine and a responsive dark-theme cybersecurity dashboard with instant theme switching.
- Parses URLs, hostnames, and IP addresses.
- Restricts scanning strictly to loopback (`127.0.0.1`, `::1`) and RFC-1918 private subnets (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`).
- Sanitizes inputs to prevent command or header injection.
- Standard 3-way handshake connect probes using Python's native `socket` library.
- Non-destructive and respects strict timeouts (`0.5s`).
- Identifies services on common ports (SSH, Telnet, FTP, HTTP, HTTPS, MySQL, SMB, RDP, Redis, MongoDB, etc.).
3. **Web Application Security Header Inspection**:
- Evaluates 6 OWASP-recommended security headers:
- `X-Frame-Options` (Clickjacking defense)
- `X-Content-Type-Options` (MIME-sniffing defense)
- `Referrer-Policy` (Referrer leakage protection)
- `Permissions-Policy` (Browser hardware restriction)
- Detects missing headers and risky configurations (e.g. `unsafe-inline`, `max-age=0`).
4. **Cookie Security Attribute Analysis**:
- `HttpOnly`: Prevents client-side script token theft via XSS.
- `Secure`: Ensures cookies are never transmitted over unencrypted HTTP.
- `SameSite`: Guarantees protection against Cross-Site Request Forgery (CSRF).
5. **Outdated Software & Banner Detection**:
- Passively extracts version strings from `Server`, `X-Powered-By`, and public banners.
- Compares versions against a local vulnerability baseline (Apache, Nginx, PHP, OpenSSH, MySQL).
- Labels findings objectively as *"Potentially outdated"* with clear upgrade guidance rather than claiming speculative CVEs.
- Generates standalone, cyber-themed **HTML reports** with print-optimized styling (`@media print` for 1-click **Save to PDF**).
- Generates structured **JSON reports** for automated ingestion.
- Provides an executive summary, statistics grid, vulnerability breakdown, and remediation advice.
7. **Interactive Cybersecurity UI with 6 Theme Palettes**:
- Dark aesthetic with dynamic theme switcher in the top bar.
- Animated multi-step progress bar during scans.
- box, severity filter pills (`Critical`, `High`, `Medium`, `Low`, `Info`), and sorting.
- History drawer showing past assessments.
- Instant pre-configured scan results without needing an external vulnerable host running.
- Ideal for live demonstration during college vivas, lab evaluations, and internship mentor reviews.
The dashboard includes a real-time theme selector located in the top bar. Choose your preferred cybersecurity aesthetic:
| Theme Name | Color Accent | Description |
| 🟢 **Emerald (Default)** | `#10b981` (Matrix Green) | High-tech Matrix / Hacker green terminal aesthetic. |
| 🟣 **Violet** | `#a855f7` (Neon Purple) | Cyberpunk neon purple with vibrant pink glowing accents. |
| 🔴 **Crimson** | `#ef4444` (Threat Red) | Red Team / Threat Intelligence operational mode. |
| 🔵 **Cyber Blue** | `#0ea5e9` (Electric Blue) | Classic deep navy & electric cyan cybersecurity dashboard. |
| 🟡 **Amber** | `#f59e0b` (Cyber Gold) | Retro CRT amber terminal aesthetic with high contrast. |
| 🌑 **Obsidian** | `#64748b` (Charcoal) | Stealth dark mode with sleek monochrome slate accents. |
*Selected themes are automatically saved in `localStorage` and persist across page refreshes.*
- **FastAPI**: Modern, high-performance web framework for APIs.
- **Uvicorn**: Lightning-fast ASGI web server.
- **HTTPX**: Async HTTP client for non-blocking passive web audits.
- **Pydantic v2**: Type enforcement and data validation schemas.
- **Jinja2**: Templating engine for high-fidelity HTML reports.
- **HTML5 & CSS3**: Custom modern cybersecurity dashboard with dynamic theme switching.
- **Vanilla JavaScript (ES6+)**: Zero bulky frontend dependencies, fast and maintainable.
- **Google Fonts**: `JetBrains Mono` and `Inter`.
d:/Nikhil Mathew/PROJECTS/VULNERABILITY SCANNER/
│ ├── main.py # FastAPI routes, static mounting, API handlers
│ ├── config.py # Port definitions, timeouts, allowed subnets
│ │ └── schemas.py # Pydantic schemas for requests, findings, reports
│ │ ├── validator.py # Target IP/URL validation & RFC-1918 enforcement
│ │ ├── port_scanner.py # Threaded TCP connect scanner with socket
│ │ ├── web_scanner.py # Passive HTTP/HTTPS, SSL check, OPTIONS method check
│ │ ├── header_checker.py # OWASP security headers analyzer
│ │ ├── cookie_checker.py # HttpOnly, Secure, SameSite inspector
│ │ ├── version_detector.py # Safe banner extraction & outdated software detection
│ │ ├── severity.py # Severity weighting & summary calculator
│ │ └── demo_data.py # Predefined sample assessment dataset
│ ├── report_generator.py # JSON serialization & Jinja2 HTML rendering
│ └── report_template.html# Standalone, print-to-PDF ready HTML report
│ ├── index.html # Cyber dashboard layout with Theme Switcher
│ ├── style.css # Custom responsive CSS with 6 theme palettes
│ └── app.js # Client logic, progress polling, filter/sort/themes
├── reports/ # Persistent directory storing generated scans (.json & .html)
│ └── test_scanner.py # Automated unit tests for all scanner modules
├── requirements.txt # Python package dependencies
├── run.py # One-click launcher script
└── README.md # Complete documentation & viva guide
| Vulnerability Type | Detection Technique | Risk Rationale |
| **Insecure Telnet (Port 23)** | TCP connect to port 23 succeeds. | Transmits credentials and sessions in unencrypted cleartext. |
| **Plaintext FTP (Port 21)** | TCP connect to port 21 succeeds. | Transmits usernames and passwords across the network unencrypted. |
| **Exposed Database (3306, 5432)** | TCP connect to standard DB ports succeeds. | Databases should not be exposed to untrusted networks; susceptible to credential stuffing. |
| **Exposed SMB/RDP (445, 3389)** | TCP connect to Windows service ports succeeds. | High-value targets for lateral movement and ransomware. |
| **Missing CSP** | Response headers lack `Content-Security-Policy`. | Absence increases risk of Cross-Site Scripting (XSS) and malicious script injection. |
| **Missing X-Frame-Options** | Response headers lack `X-Frame-Options` and CSP `frame-ancestors`. | Site can be framed inside an ``, enabling Clickjacking attacks. |
| **Missing nosniff** | Response headers lack `X-Content-Type-Options: nosniff`. | Browsers may MIME-sniff non-executable files into executable scripts. |
| **Missing HSTS** | HTTPS response lacks `Strict-Transport-Security`. | Vulnerable to SSL-stripping and man-in-the-middle downgrade attacks. |
| **Cookie without HttpOnly** | Parsed `Set-Cookie` header lacks `HttpOnly` flag. | Attackers can steal session tokens using `document.cookie` if XSS occurs. |
| **Cookie without Secure** | Parsed `Set-Cookie` header lacks `Secure` flag. | Browser can transmit cookie over unencrypted HTTP. |
| **Cookie without SameSite** | `Set-Cookie` lacks `SameSite=Lax` or `SameSite=Strict`. | Susceptible to Cross-Site Request Forgery (CSRF). |
| **Server Version Disclosure** | `Server` or `X-Powered-By` discloses numbers (e.g. `Apache/2.4.49`). | Provides reconnaissance data to attackers to craft targeted exploits. |
| **Potentially Outdated Software**| Banner version parsed and evaluated against minimum baseline. | Unpatched software may have known public security advisories. |
| **Insecure HTTP TRACE** | `OPTIONS` request returns `TRACE` or `TRACK` in `Allow`. | Allows Cross-Site Tracing (XST) to bypass HttpOnly cookie protections. |
Findings are classified into 5 distinct severity tiers:
1. **Critical**: Direct severe risks (e.g. unauthenticated critical service exposure).
2. **High**: Serious security gaps (e.g. Telnet open, exposed database, outdated unpatched server software).
3. **Medium**: Significant defensive deficiencies (e.g. Missing CSP, Missing X-Frame-Options, plain HTTP, insecure session cookies).
4. **Low**: Hardening weaknesses (e.g. Missing X-Content-Type-Options, Referrer-Policy, banner version disclosures).
5. **Informational**: Audit items and recognized services (e.g. SSH port open, unknown open port, HTTPS certificate status).
Overall posture risk is determined by calculating an aggregate score based on the highest finding tier and total distribution.
- Python 3.10, 3.11, or 3.12 installed on your system.
### Option 1: Standard Virtual Environment (Recommended)
1. Open your terminal or PowerShell in the project directory:
cd "d:\Nikhil Mathew\PROJECTS\VULNERABILITY SCANNER"
uvicorn backend.main:app --reload --host 127.0.0.1 --port 8000
Once started, open your web browser and navigate to:
To view interactive Swagger API documentation, visit:
Run the automated Pytest suite to verify all modules and safeguards:
*All 11 unit tests will run and pass, validating target restrictions, header checks, cookie inspections, and report generation.*
1. **Open Dashboard**: Go to `
2. **Choose Theme**: Click any color button in the navbar (Emerald, Violet, Crimson, Blue, Amber, Obsidian).
- Use the preset buttons (`127.0.0.1`, `localhost`, ` or enter a local IP/URL.
- **Run Full Scan**: Executes both TCP port scanning and HTTP web application checks.
- **Web Scan Only**: Audits headers, cookies, SSL, and server version.
- **Port Scan Only**: Scans common TCP ports (1-1024 / curated services).
- **Demo Scan**: Loads realistic sample assessment data instantly.
- Review executive summary and count cards.
- Filter by severity using the colored pills (`Critical`, `High`, `Medium`, `Low`, `Info`).
- across titles, descriptions, and recommendations.
- Switch tabs to inspect Open Ports, Security Headers, Cookies, or Raw JSON.
- Click **Download HTML** for an executive, styled report.
- Click **Download JSON** for programmatic data.
- Click **Print / PDF** to print or save as PDF via your browser's print dialog.
## 🎓 Demo Mode (For College / Internship Evaluation)
When presenting to a professor or internship mentor:
1. Click the cyan **🧪 Demo Scan (Sample Data)** button (or preset `Demo Target`).
2. The scanner will run through simulated progress steps and render a complete assessment.
- High-severity warnings for outdated Apache 2.4.49 and PHP 7.4.3.
- Medium-severity missing CSP, X-Frame-Options, and plain HTTP.
- Insecure cookie flags (`session_token` missing `HttpOnly` and `Secure`).
| `GET` | `/` | Serves the main cybersecurity dashboard UI. |
| `GET` | `/api/health` | Service health status check. |
| `POST`| `/api/scan/full` | Runs both port scan and web application audit. |
| `POST`| `/api/scan/web` | Runs web application security scan on target URL. |
| `POST`| `/api/scan/ports`| Runs safe TCP port scan on target IP. |
| `POST`| `/api/scan/demo` | Generates instant demo scan report. |
| `GET` | `/api/reports` | Returns list of past saved reports. |
| `GET` | `/api/reports/{id}` | Retrieves full JSON for a specific report. |
| `GET` | `/api/reports/{id}/download?format=html\|json` | Downloads standalone HTML or JSON report. |
## 🔒 Security Guardrails & Ethical Compliance
- **No Exploitation**: The scanner only checks if a port accepts TCP handshakes or reads response headers. It never sends exploits, shellcode, or malicious payloads.
- **Private Subnet Enforcement**: Automatically blocks public IP scans by default (`ALLOW_PUBLIC_SCANS = False` in `backend/config.py`).
- **No Ingestion of Secrets**: Never requests or stores passwords, private keys, or credentials.
- **Timeout Protection**: Strict socket and HTTP timeouts prevent connection hangs or local resource exhaustion.
## 📸 Recommended Screenshots for Submission
When submitting your project report or portfolio:
1. **Dashboard **: Showing the target input, theme selector, presets, and safety banner.
2. **Scan in Progress**: Showing the animated progress bar and multi-step trail.
3. **Results Overview**: Showing the summary cards (Total Issues, Critical, High, Medium, Low) and Executive Summary.
4. **Vulnerabilities Tab**: Filtered findings showing badges, descriptions, and recommendations.
5. **Open Ports Tab**: Clean table showing port, protocol, service, and risk level.
6. **Security Headers Tab**: Table showing missing and present OWASP headers.
7. **Downloaded HTML Report**: Full-page view of the generated report.
8. **Automated Test Results**: Terminal screenshot showing `pytest tests/test_scanner.py -v` (11 passed).
- Add asynchronous UDP port probe support for selected DNS/SNMP services.
- Add TLS cipher suite security assessment (checking for TLS 1.0/1.1 deprecation).
- Add automated scheduled scanning via cron jobs.
- Add email report distribution via SMTP.
*Author: **Malathi S** | Cybersecurity Developer*
*Project: Defensive Vulnerability Scanner Mini Project*
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
