Vulnerability scanner
Simulates a port scan and turns the open ports into prioritised findings, with severity and mitigation.
Security · Python · Browsable demo
The problem
You cannot protect what you do not know is exposed. Vulnerability management starts with the inventory — which ports are open and what runs on them — and continues with what almost nobody delivers: the order in which to fix it.
What it does
- Sweeps a set of common ports and returns the open ones with their service.
- Maps each open port to its known risk: cleartext credentials on FTP, unencrypted remote access on Telnet, HTTP without HTTPS, exposed administration.
- Exports a structured JSON report with the findings and the recommended mitigation for each.
- The scan is simulated: it generates no network traffic, so it can be run anywhere without touching third-party systems.
What was decided while building it
- The scan is a simulation, and it says so on the first line
- Not a single packet leaves the machine: a port is declared open by drawing from a fixed-seed generator. It is stated in the code, in the manual and on the screen itself, because showing a report of open ports without saying it is fictional would be an entirely different thing.
- The rules are a table, not a chain of conditions
- Each rule declares which ports must be open and which closed for it to fire. Adding a service is therefore adding a row, and the report cannot drift from the catalogue. With a chain of conditions, the new rule gets forgotten in the report and nobody notices.
- The summary names the actual worst finding
- The executive summary always named the same service as the main risk, even on runs where that port came back closed. It now comes from the finding that actually tops the list. A report naming a risk the scan did not find is worse than no report: it is the one line an operations team reads.
- A closed port is published too
- The report lists all eight catalogue ports with their verdict, not just the open ones. Without the closed ones you only see half of what was checked, and the reader cannot tell a port that is fine from a port nobody looked at.
How far it goes
- It scans nothing. Each port's result is drawn from a fixed seed and the target address is private and fictional: it is a teaching piece about how a finding is prioritised and communicated, not an auditing tool.
- There is no vulnerability database and no standard scoring. The four severities are labels written by hand on each rule, ordered against each other.
- It does not identify services or versions. If port twenty-two comes back open, the report says remote access because that is what the table calls it, not because anything was queried.
- The catalogue is closed: eight ports and six rules. There is no host discovery, no ranges and no connectionless protocol.
Built with
- Python