Python · Security · released · 2025

VulnScanner CLI

Python CLI that runs a port scan, banner grabs, security-header checks, CVE lookups, tech detection and TLS checks in one pass.

Problem
Basic recon means juggling several tools for ports, headers, CVEs and TLS.
What I built
One modular Python CLI that runs port scans, banner grabs, header checks, CVE lookups, tech detection and TLS checks.
Outcome
Tagged v1.0.0 on GitHub, with a test workflow.
Role
Solo project

Tech: Python, Rich, CVE APIs, Multithreading

Repository

What it is

VulnScanner (vulnscan) is a command-line scanner written in Python. You point it at a host you're allowed to test and it runs a handful of basic recon checks in one go: open ports, service banners, HTTP security headers, known CVEs, technology fingerprinting and the TLS certificate.

I wrote it because first-pass recon usually means switching between several tools and stitching their output together by hand. I wanted one command that did the boring part and gave me a readable summary.

What it does

  • Port scan. A multithreaded TCP connect scan over a list of common ports, a list you give it, or a range.
  • Banner grabbing. Reads whatever the open services announce about themselves.
  • Security headers. Checks the response for the common hardening headers and flags missing or weak ones.
  • CVE lookup. Pulls a service name and version out of a banner and queries the public CIRCL CVE API.
  • Tech detection. Guesses the server, framework and CDN from headers and HTML.
  • TLS certificate. Shows the common name, issuer, validity window, alternative names and expiry.
  • Risk score. A rough Low, Medium or High bucket based on average CVSS, missing headers and how many ports are open.

Output is a Rich table by default. It can also print JSON or Markdown and save a timestamped report. It takes one target or a file of targets, and --dry-run prints the scan plan without touching anything.

How it's put together

Each check is its own module under scanner/. The CLI parsing and orchestration live in core/, and network helpers and output formatting live in utils/. A new check is one new module plus a call in the runner. Port scanning uses a thread pool, so a range scan doesn't crawl.

The project is at v1.0.0 on GitHub, and a GitHub Actions workflow runs the test suite on Python 3.10, 3.11 and 3.12 on every push.

Limits

The risk bucket is a rough indicator. A bare demo page like example.com lands on High only because it sends none of the hardening headers. CVE matching depends on the banner reporting a clean version string, which many services don't. The test suite is small and mostly covers the port-scanning code. This is a learning tool for quick recon. It doesn't replace Nmap or a proper vulnerability scanner.

Only scan hosts you own or have permission to test.

Links