Vulnerability Scanner
Port scanning + live CVE cross-referencing + structured PDF reporting — built from raw sockets up.
Overview
Most port scanners stop at "port is open." This scanner takes the next step — it fingerprints the service running on each open port, queries the NIST NVD (National Vulnerability Database) API for known CVEs affecting that software version, and produces a structured PDF report organized by CVSS severity tier.
The goal was to build something that produces output useful for an actual vulnerability assessment — not just a list of open ports, but a prioritized list of what to look at first based on real CVE data.
How It Works
Port Scanning
Raw socket connections to target ports with configurable timeout. Threaded scanning for speed — 1000 common ports in under 5 seconds on a LAN target.
def scan_port(host, port, timeout=1):
with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
s.settimeout(timeout)
return s.connect_ex((host, port)) == 0Service Fingerprinting
Banner grabbing on open ports — sends probe bytes and reads the service response. Maps common banners to software names and versions (Apache, nginx, OpenSSH, MySQL, etc.).
CVE Lookup
Queries NIST NVD API v2 with the identified software + version. Returns matching CVEs with CVSS scores, severity levels, and descriptions. Rate-limited to respect API constraints.
url = f"https://services.nvd.nist.gov/rest/json/cves/2.0"
params = {"keywordSearch": f"{software} {version}", "resultsPerPage": 20}
response = requests.get(url, params=params)
cves = response.json()["vulnerabilities"]PDF Report Generation
FPDF2 generates a structured report with executive summary, findings table sorted by CVSS score (Critical → High → Medium → Low → Informational), and per-finding detail pages with remediation guidance.