🔍 Integrated Security Scanner

A professional integrated security scanner that combines network service discovery with vulnerability assessment using the NIST NVD API. Features smart caching, exploit verification, multiple report formats, notifications, web dashboard, and automated scheduling.

📋 Table of Contents

✨ Main Features
🏗️ Architecture
📁 Project Structure
🚀 Quick Installation
📖 User Guide
📝 Example Output
📊 Available Formats
🔔 Notifications
🌐 Web Interface
⏰ Automation (Scheduler)
🎯 Advanced Examples
📈 Performance Metrics
🛠️ Dependencies
🗺️ Roadmap
⚖️ License
⚠️ Disclaimer
🤝 Contributing
📬 Contact
📊 Project Statistics
🌐 Languages

📘 Technical Documentation

For detailed architecture, module functions, and API reference:

✨ Main Features

Module	Description	State
Network Discovery	Port scanning with nmap + banner grabbing + fingerprinting	✅
Vulnerability Scan	NIST NVD v2.0 API query with smart cache (95% efficiency)	✅
Exploit Checker	Verification of public exploits in Exploit-DB and CVE Details	✅
Smart Caching	95% reduction in API requests with configurable expiration	✅
Parallel Processing	Concurrent analysis with ThreadPoolExecutor (10 workers)	✅
Rate Limiting	Respect for API limits with configurable delays	✅
Múltiples Reportes	Professional JSON, CSV, Markdown, and PDF formats with statistics	✅
Base de Datos	SQLite with full history and comparison between scans	✅
Notificaciones	Email, Telegram, and Slack alerts with configurable thresholds	✅
Web Dashboard	Interactive interface with real-time graphics (Flask)	✅
Scheduler	Scheduled automatic scans (daily/weekly/monthly)	✅

Architecture

🏗️

┌─────────────────┐ ┌──────────────────┐ ┌─────────────────────┐
│ NetworkScanner │────▶│ Vulnerability │────▶│ Report Generator │
│ - nmap │ │ Scanner │ │ - JSON │
│ - banners │ │ - NIST API │ │ - CSV │
│ - services │ │ - Exploit-DB │ │ - Markdown │
│ - versions │ │ - Caché 95% │ │ - PDF │
└─────────────────┘ └──────────────────┘ └─────────────────────┘
│ │ │
▼ ▼ ▼
┌─────────────────┐ ┌──────────────────┐ ┌─────────────────────┐
│ ServiceInfo │ │ Database │ │ Notifications │
│ - IP:Port │ │ Manager │ │ - Email │
│ - Service │ │ - SQLite │ │ - Telegram │
│ - Version │ │ - Historical │ │ - Slack │
│ - Banner │ │ - Comparisons │ └─────────────────────┘
└─────────────────┘ └──────────────────┘ │
│ │ │
└────────────────────────┼───────────────────────────┘
▼
┌─────────────────────────────────────────┐
│ Web Interface (Flask) │
│ Dashboard 📊 │ Record 📋 │ Search 🔍 │
│ Graphics 📈 │ Export ⬇️ │
└─────────────────────────────────────────┘
▲
│
┌─────────────────────────────────────────┐
│ Scheduler (Automatic) │
│ ⏰ Daily │ 📅 Weekly │ 📆 Monthly │
└─────────────────────────────────────────┘

Project Structure

📁

integrated-security-scanner/
├── 📂 src/ # Main source code
│ ├── init.py
│ ├── network_scanner.py # Network discovery with nmap
│ ├── vulnerability_scanner.py # Vulnerability analysis via NIST API
│ ├── integrated_scanner.py # Main coordinator
│ ├── database_manager.py # SQLite database manager
│ ├── pdf_generator.py # Professional PDF reports
│ ├── notifications.py # Email/Telegram/Slack alerts
│ ├── exploit_checker.py # Exploit-DB verification
│ └── scheduler.py # Automated task scheduler
│
├── 📂 web/ # Flask web interface
│ ├── app.py # Main web application
│ ├── run.sh # Startup script
│ ├── 📂 templates/ # HTML templates
│ │ ├── index.html # Landing page
│ │ ├── dashboard.html # Analytics dashboard
│ │ └── history.html # Scan history viewer
│ └── 📂 static/ # Static assets
│ ├── css/ # Stylesheets
│ ├── js/ # JavaScript files
│ └── img/ # Images
│
├── 📂 data/ # Persistent data
│ ├── .gitkeep # Keep directory in repo
│ ├── scans.db # SQLite database (generated)
│ ├── vuln_cache.json # Vulnerability cache (generated)
│ └── exploit_cache.json # Exploit cache (generated)
│
├── 📂 reports/ # Generated reports (auto-created)
│ ├── json/ # JSON format reports
│ ├── csv/ # CSV format reports
│ ├── markdown/ # Markdown reports
│ └── pdf/ # PDF reports
│
├── 📂 docs/ # Documentation
│ ├── 📂 images/ # README screenshots
│ │ ├── dashboard.png # Web dashboard preview
│ │ ├── network_scan.png # Network discovery output
│ │ ├── pdf_report.png # PDF report preview
│ │ ├── telegram_alert.png # Telegram notification
│ │ └── vulns_table.png # Vulnerabilities table
│ └── 📂 examples/ # Usage examples
│
├── 📂 scripts/ # Utility scripts
│ ├── docker-run.sh # Docker helper
│ └── clean_cache.sh # Clean cache files
│
├── 🐳 Dockerfile # Docker image definition
├── 🐳 docker-compose.yml # Docker Compose configuration
├── 📜 .gitignore # Git ignore rules
├── 📜 LICENSE # MIT License
├── 📜 README.md # English documentation
├── 📜 README.es.md # Spanish documentation
├── 📜 requirements.txt # Python dependencies
└── 📜 scheduler_config.example.json # Scheduled tasks config (generated)

Quick Installation

Quick start 🚀

Prerequisites

Install nmap (required)

sudo apt-get install nmap # Debian/Ubuntu/Kali

or

brew install nmap # macOS

Installation

Clone the repository

git clone https://github.com/augustozarate/integrated-security-scanner.git

cd integrated-security-scanner

Install Python dependencies

pip install -r requirements.txt

Docker (Optional)

Build image

./scripts/docker-run.sh build

Run scan

./scripts/docker-run.sh scan 192.168.1.1`

📖 User Guide

Basic Scan

Scan single host (default ports: 1-1000)

python -m src.integrated_scanner 192.168.1.1

Scan network range

python -m src.integrated_scanner 192.168.1.0/24 -p 1-1000

Scan specific ports

python -m src.integrated_scanner 192.168.1.1 -p 22,80,443

Get help

python -m src.integrated_scanner --help

Advanced Filters

Only critical vulnerabilities (CVSS >= 9.0)

python -m src.integrated_scanner 192.168.1.1 --min-cvss 9.0

Exclude older CVEs (only from 2020 onwards)

python -m src.integrated_scanner 192.168.1.1 --exclude-year-before 2020

Combine filters

python -m src.integrated_scanner 192.168.1.1 --min-cvss 7.0 --exclude-year-before 2018

Exploit Verification

Check which vulnerabilities have public exploits

python -m src.integrated_scanner 192.168.1.1 --check-exploits

It automatically prioritizes those that have an available exploit.

Export of Results

Export to all formats

python -m src.integrated_scanner 192.168.1.1 --csv --pdf --save-db

The files are saved in reports/{csv,json,markdown,pdf}/

📝 Example Output

Network Discovery Phase

╭─────────────────────────────╮
│ Integrated Security Scanner │
│ Target: 192.168.1.0/24      │
│ Ports: 1-1000               │
╰─────────────────────────────╯

Phase 1: Network Service Discovery
┏━━━━━━━━━━━━━━━━━┳━━━━━━┳━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ IP              ┃ Port ┃ Service     ┃ Version                    ┃
┡━━━━━━━━━━━━━━━━━╇━━━━━━╇━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
│ 192.168.1.1     │ 80   │ http        │ Apache 2.4.7               │
│ 192.168.1.1     │ 22   │ ssh         │ OpenSSH 6.6.1p1            │
│ 192.168.1.1     │ 21   │ ftp         │ ProFTPD 1.3.5              │
└─────────────────┴──────┴─────────────┴────────────────────────────┘
Vulnerability Assessment Phase

Phase 2: Vulnerability Assessment
┏━━━━━━━━━━━━━━━┳━━━━━━━━━━┳━━━━━━┳━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ CVE ID        ┃ Severity ┃ CVSS ┃ Service ┃ Host:Port         ┃ Exploit ┃ Description                ┃
┡━━━━━━━━━━━━━━━╇━━━━━━━━━━╇━━━━━━╇━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
│ CVE-1999-0082 │ CRITICAL │ 10.0 │ ftp     │ 192.168.1.1:21    │    ✓    │ CWD ~root command allows   │
│ CVE-2021-1234 │ HIGH     │ 8.5  │ ssh     │ 192.168.1.1:22    │    ✗    │ Buffer overflow in SSH     │
└───────────────┴──────────┴──────┴─────────┴───────────────────┴─────────┴────────────────────────────┘

Vulnerability Statistics:
  • Total vulnerabilities: 1,416
  • Critical: 259 | High: 484 | Medium: 623
  • With public exploits: 1,354 (95.6%)
  • Critical with exploits: 251 | High with exploits: 460

Available Formats

Format	Location	Use
JSON	`reports/json/`	Automatic processing
CSV	`reports/csv/`	Analysis in Excel/Sheets
Markdown	`reports/markdown/`	Legible documentation
PDF	`reports/pdf/`	Professional reports

🔔 Notifications

Interactive Configuration

Setup Wizard

python -m src.integrated_scanner --setup-notifications

Supported Channels

Channel	Configuration	Example
Email	SMTP + App Password	admin@empresa.com
Telegram	Bot Token + Chat ID	Instant messaging
Slack	Webhook URL	#security-alerts

Configurable Thresholds

{
  "min_cvss": 7.0,
  "notify_on_critical": true,
  "notify_on_high": true,
  "notify_on_medium": false
}

Example of a Telegram Alert

🔴 SECURITY ALERT

Target: 192.168.1.1
Critical: 259 | High: 484

Top Exploits:
• CVE-1999-0082 (CVSS 10.0)
• CVE-1999-1119 (CVSS 10.0)
• CVE-1999-0080 (CVSS 10.0)

🌐 Web Interface

Start Server

Start web dashboard

python web/app.py

Access in browser

http://localhost:5000

Dashboard Features

Section	Description
Dashboard	Real-time statistics with graphs
History	Full list of previous scans
Search	Search for specific CVEs in historical data
Export	Download results in JSON/CSV
Quick Scan	Start scans from the web

Screenshots

📊 Dashboard: Trend and distribution charts. 📋 History: Interactive scan table 🔍 Search: Real-time results

⏰ Automation (Scheduler)

Task Management

Add daily task

python -m src.scheduler add \
  --name "Daily Scan" \
  --target 192.168.1.0/24 \
  --schedule daily \
  --min-cvss 7.0

List scheduled tasks

python -m src.scheduler list

Run task immediately

python -m src.scheduler run 1

Enable/Disable task

python -m src.scheduler enable 1

python -m src.scheduler disable 1

Delete task

python -m src.scheduler remove 1

Daemon Mode (Continuous Execution)

Run scheduler in background

python -m src.scheduler daemon --interval 60

View statistics

python -m src.scheduler stats

Example of Scheduled Tasks

┏━━━━┳━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━┳━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━┳━━━━━━━━┳━━━━━━┓
┃ ID ┃ Name       ┃ Target         ┃ Schedule ┃ Next Run         ┃ Status ┃ Runs ┃
┡━━━━╇━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━╇━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━╇━━━━━━━━╇━━━━━━┩
│ 1  │ Daily Scan │ 192.168.1.0/24 │ daily    │ 2024-03-20 02:00 │ Active │   12 │
│ 2  │ Weekly     │ 10.0.0.0/8     │ weekly   │ 2024-03-25 03:00 │ Active │    3 │
└────┴────────────┴────────────────┴──────────┴──────────────────┴────────┴──────┘

🎯 Advanced Examples

Full Scan with All Features

python -m src.integrated_scanner 192.168.1.0/24 \

-p 1-1000 \

--min-cvss 7.0 \

--exclude-year-before 2018 \

--check-exploits \

--csv --pdf --save-db \

--notify

Database Analysis

View recent scans

python -m src.integrated_scanner --list-scans

View specific scan details

python -m src.integrated_scanner --show-scan 1

Compare two scans

python -m src.integrated_scanner --compare-scans 1 2

Search for CVE in historical data

python -m src.integrated_scanner --search-cve CVE-1999-0082

Global statistics

python -m src.integrated_scanner --db-stats

Cache Cleaning

Clean temporary files

./scripts/clean_cache.sh

📈 Performance Metrics

Metric	Value	Description
Cache Efficiency	95%+	Reduction in API requests
Concurrent Workers	10	Simultaneous analyses
Default Rate Limit	0.5s	Delay between requests
Scan Time (10 services)	~30s	Local network
Exploit Check Cache	30 días	Expiration
Max Vulnerabilities	Ilimitado	According to API NIST

🛠️ Dependencies

requests>=2.31.0          # API calls
python-nmap>=0.7.1        # Network scanning
rich>=13.0.0              # Terminal formatting
flask>=2.3.0              # Web interface
flask-cors>=4.0.0         # CORS support
reportlab>=4.0.0          # PDF generation

🗺️ Roadmap

Version 1.0 (Current) ✅

Network scanning with nmap
NIST API vulnerability analysis
Intelligent caching system (95% efficiency)
Multiple report formats (JSON, CSV, MD, PDF)
SQLite database with historical data
Email and Telegram notifications
Exploit verification (Exploit-DB)
Web interface with dashboard
Scheduled scanning (scheduler)

Version 2.0 (Coming Soon) 🚀

Integration with Shodan/Censys
Plugin system for custom scanners
Proprietary REST API
Multi-user authentication
Web vulnerability scanning (OWASP Top 10)
Jira integration for ticket management
Clustering mode for enterprise networks

⚖️ License

This project is licensed under the MIT License - see the LICENSE file for details.

⚠️ Disclaimer

This tool is for authorized security testing and educational purposes only. Always obtain proper authorization before scanning any network. The author is not responsible for any misuse or damage caused by this program.

🤝 Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

📬 Contact

Augusto Zarate

Project Link: https://github.com/augustozarate/integrated-security-scanner

⭐ If you find this project useful, please give it a star on GitHub!

Name		Name	Last commit message	Last commit date
Latest commit History 14 Commits
data		data
docs		docs
scripts		scripts
src		src
web		web
.gitignore		.gitignore
Dockerfile		Dockerfile
LICENSE		LICENSE
README.es.md		README.es.md
README.md		README.md
docker-compose.yml		docker-compose.yml
requirements.txt		requirements.txt
scheduler_config.example.json		scheduler_config.example.json

Folders and files

Latest commit

History

Repository files navigation