Sangamesh.Dandin
Résumé
All projects

Case 08 / 09Web security toolingCompleted

VULNXPLOIT SCANNER.

A small web front end for nmap service scans.

A Flask app with a vanilla-JavaScript front end. It runs nmap against 12 common ports, looks each detected service up in a small built-in table of known CVEs (SSH, HTTP and MySQL), shows a proof-of-concept template for those entries and exports results as a PDF or CSV. It's deliberately simple: the CVE table is built in, and the proof-of-concept templates are text, not exploits.

Problem
Quick service checks
Built with
Python, Flask, nmap
Result
PDF and CSV scan reports
  • Python
  • Flask
  • nmap
  • ReportLab
  • Bootstrap

▶Demo

See it work.

An animated walkthrough of the interface, not a screen recording. The target and results shown are example values. The video uses the app's own title, VulnScan Pro.

01Architecture

How it's built.

Drawn from the project's source code, not its README: what each part actually does and how a request moves through it.

VulnXploit request map A browser built with vanilla JavaScript and Bootstrap holds all state and calls four independent, stateless Flask routes: a scan route that runs nmap on twelve fixed ports and looks the service name up in a hard-coded three-row table, a PoC route that returns static template text with placeholders filled in, and two export routes that build a PDF and CSV from results the browser posts back; a ledger lists what the code does not do, including validation, exploitation, verification and storage. BROWSER · HOLDS ALL STATE FLASK · app.py · 4 INDEPENDENT STATELESS ROUTES WHAT EACH ROUTE USES POST SCAN POST POC POST EXPORT JSON TEXT FILE 12 PORTS PROBE SERVICE NAME POC_TYPE RESULTS Operator browser static/script.js vanilla JS + Bootstrap (both from a CDN) target text box, no format check beyond “non-empty” holds every result in memory; nothing persists calls the 4 routes itself — no server-side orchestration renders the results table counters (scans, vulns, PoCs) start at 0 in JS 1 · POST /api/scan 2 · POST /api/generate-poc 3 · POST /api/export/pdf 4 · POST /api/export/csv no login · no history no scan queue · synchronous serves from Flask, port 5000 debug=True ROUTE L1 /api/scan nmap PortScanner 12 fixed ports (22, 80, 443, 3306, 5432, …) → results[] with cves[] ROUTE L3 /api/generate-poc picks 1 of 3 templates by poc_type fills [TARGET_IP] / [TARGET_PORT] → text ROUTE /api/export/pdf · /csv ReportLab canvas · pandas built from posted results returns a file download nmap python-nmap · must be installed on the host Target host whatever string the operator typed IN-CODE L2 CVE_DATABASE dict of 3 services: ssh · http · mysql IN-CODE POC_TEMPLATES 3 static code strings, placeholder values only PDF · CSV file downloads only no server-side copy kept generated per request Detection matches the service name, not the version — only ssh, http and mysql can match. “PoC generation” returns template text. No exploit is run and no finding is verified as exploitable. WHAT THE CODE DOES NOT DO · FOUND BY READING THE SOURCE L1 No validation, authorisation or scope control. /api/scan accepts any target string and scans it. No private-range block, no auth, no rate limit; debug=True. L2 No real CVE lookup. Matching is a hard-coded 3-row dict keyed by nmap’s service name. The version field is read but never used in the match. L3 No exploitation or verification. The PoC route returns static template text with placeholders filled in; nothing is executed and no result is confirmed. L4 No storage, history or tests. package-lock.json lists React + axios, but the UI is vanilla JS + Bootstrap and there is no Node server; node_modules is unused. LEGEND Person Flask route In-code data Tool / file Active probe of target Request (HTTP) Response Internal call L1 Limit (see ledger)

Read from the code at commit a7f2c5f · Open full size ↗

02Under the hood

How it works.

  1. 01

    Scan

    nmap on 12 common ports

  2. 02

    Match

    A built-in CVE table for SSH, HTTP and MySQL

  3. 03

    Template

    Proof-of-concept templates, as text

  4. 04

    Export

    A PDF or CSV report of the results

→Up next · 09 / 09

Next project.

TriageAI — LLM-assisted SOC alert triage with MITRE ATT&CK mapping.

Back to all projects