Network security · Personal project
NetSleuth
An educational TCP reconnaissance tool built with the Python standard library. It scans hosts and networks, identifies common services, collects banners and exports structured results.
- Status
- Educational tool
- Source
- View repository
NetSleuth is intentionally inspectable. It uses the Python standard library and full TCP connections so that target expansion, concurrency, socket behavior and service identification remain visible in the code.
“I built it to understand what happens behind a network scanner instead of treating existing tools as black boxes.”
Terminal output
Project media coming soonHow it works
Scanning flow
Targets are expanded from a hostname, address, comma-separated list, CIDR range or file. A discovery pass can identify reachable hosts before worker threads perform TCP connect scans against the selected ports.
- Configurable connection and discovery timeouts
- Port lists and ranges
- Worker-thread concurrency with sorted results
- Open, closed, filtered and error states
Enrichment and reporting
Open services can be enriched with collected banners and regex-based fingerprints. Optional local data then adds CVE matches and ATT&CK context without claiming comprehensive vulnerability coverage.
- SSH, HTTP, SMTP and FTP fingerprinting
- Local JSON CVE database matching
- MITRE ATT&CK mappings for reconnaissance operations
- Human-readable, JSON and NDJSON output
Scope and trade-offs
TCP connect scanning works without elevated privileges and completes the full handshake. It is reliable but visible in service logs. NetSleuth is an educational reconnaissance tool, not a stealth scanner, a complete vulnerability scanner or a replacement for Nmap.
Source code