███╗   ██╗███████╗████████╗      ██████╗ ██████╗  ██████╗ ██████╗ ███████╗
████╗  ██║██╔════╝╚══██╔══╝      ██╔══██╗██╔══██╗██╔═══██╗██╔══██╗██╔════╝
██╔██╗ ██║█████╗     ██║   █████╗██████╔╝██████╔╝██║   ██║██████╔╝█████╗
██║╚██╗██║██╔══╝     ██║   ╚════╝██╔═══╝ ██╔══██╗██║   ██║██╔══██╗██╔══╝
██║ ╚████║███████╗   ██║         ██║     ██║  ██║╚██████╔╝██████╔╝███████╗
╚═╝  ╚═══╝╚══════╝   ╚═╝         ╚═╝     ╚═╝  ╚═╝ ╚═════╝ ╚═════╝ ╚══════╝

                  Modern Network Reconnaissance & Analysis Tool
                       Built for the Cloud Era | Python 3.9+

---

📦 Dependencies & How to Run

System Requirements

Requirement	Version	Notes
Python	3.9+	Required
pip	Latest	For installing packages
Root / sudo	Optional	Required for SYN, NULL, FIN, XMAS, UDP scans

Install Dependencies

pip install -r requirements.txt

Or install individual packages:

pip install aiohttp rich scapy cryptography dnspython

Kali Linux / Debian Quick Setup

# Step 1 — Update system and install system-level deps
sudo apt update && sudo apt install -y python3-pip python3-scapy git pipx python3-venv python3

# Step 2 — Clone the repository
git clone https://github.com/Hriday315/net-probe.git
cd net-probe

# Step 3 — Install Net-Probe
pipx install .

# Step 4 — Run it!
net-probe --help

Install from PyPI (when published)

pip install net-probe

How to Run

# Basic TCP scan (no root required)
net-probe -t 192.168.1.1

# SYN stealth scan with service & OS detection (requires root)
sudo net-probe -t 192.168.1.1 -sS -sV -O

# Full TLS audit with HTML report
net-probe -t google.com -p 443 --tls -oH report.html

# Vulnerability scan + WAF detection
net-probe -t target.com -sV --vuln --waf

# Scan entire subnet, export all formats
net-probe -t 192.168.1.0/24 -oA results

---

Table of Contents

• Why Net-Probe?
• Key Features
• CLI Switch Reference
• API Integrations
• Practical Examples
• Architecture
• Legal Disclaimer

---

Why Net-Probe?

Net-Probe is an async-first network reconnaissance utility designed to bridge the gaps in traditional tools like Nmap when operating in containerized overlays, multi-cloud platforms, and modern IPv6 address spaces.

Feature / Capability	Nmap	Net-Probe
Async Probe Engine	Thread-pool / C loops	Python asyncio native loop
TLS Deep Analysis	Basic scripts (limited)	Cert chains, cipher grading (A+ to F)
Cloud Environment Detection	No	Identifies AWS, GCP, Azure, DigitalOcean
Container & K8s Detection	No	Fingerprints Docker, Kubernetes namespaces
API Enrichment	Manual scripting	Built-in Shodan, VirusTotal, Censys support
Output Options	XML / Grepable	JSON, CSV, Interactive HTML Dashboard
Timing Adjustments	Fixed templates	Adaptive based on RTT & packet drops
Terminal Interface	Monochromatic CLI	Rich colors, live progress bars

---

Key Features

• ⚡ Async Scan Engine: Thousands of concurrent probes without blocking, using Python asyncio.
• 🔍 Multi-Technique Probing: TCP Connect, SYN Stealth, UDP, ACK, NULL, FIN, and XMAS scanning.
• 🔐 TLS Suite Analyzer: Certificate metadata, deprecated protocol checks, cipher grading (A+ to F), Heartbleed/POODLE/BEAST detection.
• ☁️ Cloud & Container Discovery: Detects AWS/GCP/Azure hosting, CDNs, Docker, and Kubernetes namespaces.
• 🕵️ Vulnerability Correlation: Matches open services against local CVE database and live NVD/CIRCL APIs.
• 🌐 DNS & Web Intelligence: Subdomain brute-forcing, zone transfer checks, WAF/CMS/technology fingerprinting.
• 📊 Polished Exporters: Pretty-printed JSON, clean spreadsheets (CSV), or an interactive dark-themed HTML report with built-in search.

---

CLI Switch Reference

Target Specification

• -t, --target — Target host IP, CIDR subnet (e.g. 10.0.0.0/24), range (192.168.1.1-50), or domain names
• -tL, --target-list — Path to file containing target specifications
• -x, --exclude — Comma-separated list of IPs to exclude
• -xL, --exclude-list — Path to file containing exclusions
• -6, --ipv6 — Enable IPv6 routing mode

Scan Techniques

• -sT, --tcp-connect — Standard TCP Connect scan (Default, no root needed)
• -sS, --syn-scan — TCP SYN stealth scan (requires root/sudo)
• -sU, --udp-scan — UDP scan using payload-aware triggers (requires root)
• -sA, --ack-scan — TCP ACK scan for firewall rule detection
• -sN, --null-scan — TCP NULL scan (no flags set) (requires root)
• -sF, --fin-scan — TCP FIN scan (requires root)
• -sX, --xmas-scan — TCP XMAS scan (FIN, PSH, URG flags) (requires root)
• -sP, --ping-scan — Discovery ping sweep only (no port scans)

Port Specification

• -p, --ports — Port list (e.g., 80, 1-1024, 80,443,8080)
• -pT, --top-ports — Scan top N most common ports
• -pA, --all-ports — Scan all 65535 ports
• -pS, --service-ports — Scan known application service ports only

Detection & Analysis

• -sV, --service-version — Banner grabbing for service versions
• -O, --os-detect — Passive & active OS fingerprinting (TTL + TCP window)
• --tls — Deep TLS certificate chain & cipher suite grading
• --vuln — Correlate services to known CVEs and default credential lists
• --dns — DNS record enumeration & zone transfer check
• --waf — Identify Web Application Firewall (WAF) protections
• --web — Map CMS (WordPress, Drupal) and web framework fingerprinting
• --cloud — Check hosting environments (AWS, GCP, Azure, Docker, Kubernetes)
• --traceroute — Traceroute hop path mapping with geo info

Performance & Timing

• -T — Timing templates (0 to 5, Paranoid to Insane). Default: 3
• -c, --concurrency — Maximum concurrent tasks. Default: 500
• --timeout — Connection timeout in seconds. Default: 3.0
• --retries — Connection retry limit. Default: 2
• --rate-limit — Limit packet-rate per second. Default: 0 (unlimited)
• --adaptive — Adjust rates dynamically based on packet drops

Output Options

• -oJ <file> — Export JSON output file
• -oC <file> — Export CSV output spreadsheet
• -oH <file> — Export HTML audit dashboard report
• -oX <file> — Export XML report (Nmap integration compatible)
• -oA <prefix> — Save to all formats with this prefix
• -v — Verbose output (use -vv, -vvv for debug details)
• -q, --quiet — Quiet mode; suppresses console logs
• --no-color — Disable colored console styling

Stealth & Evasion

• --spoof-mac — Spoof interface MAC address
• --decoy — Send decoys from mock source addresses
• --randomize — Randomize target scan order
• --frag — Fragment packets to bypass IDS/IPS
• --ttl — Specify custom IP TTL value
• --source-port — Spoof source port number

API Integrations

• --shodan-key <KEY> — Shodan API key (inline, no config file needed)
• --vt-key <KEY> — VirusTotal API key
• --censys-id <ID> — Censys API ID
• --censys-secret <SECRET> — Censys API Secret
• --securitytrails-key <KEY> — SecurityTrails API key

Miscellaneous

• -V, --version — Print version details
• --update — Update vulnerability databases
• --resume <file> — Resume interrupted scan state from JSON file
• --open — Filter and display only open ports

---

API Integrations

Net-Probe supports optional external intelligence APIs to enrich your results. You do not need an API key to use the core scanning features — they are fully optional.

Passing Keys via CLI (Recommended)

You can pass API keys directly in the command line — no config file or source code editing needed:

# With Shodan key for enriched host data
net-probe -t 192.168.1.1 --shodan-key YOUR_SHODAN_KEY

# With VirusTotal for malware/reputation checks
net-probe -t target.com -sV --vuln --vt-key YOUR_VT_KEY

# With Censys for banner + cert correlation
net-probe -t 10.0.0.0/24 --censys-id YOUR_ID --censys-secret YOUR_SECRET

# Full enrichment with all APIs
net-probe -t target.com -sV --vuln --tls --web \
  --shodan-key YOUR_SHODAN_KEY \
  --vt-key YOUR_VT_KEY \
  --censys-id YOUR_ID \
  --censys-secret YOUR_SECRET \
  --securitytrails-key YOUR_ST_KEY

Passing Keys via Environment Variables

export NETPROBE_SHODAN_KEY="your_shodan_key"
export NETPROBE_VT_KEY="your_virustotal_key"
export NETPROBE_CENSYS_ID="your_censys_id"
export NETPROBE_CENSYS_SECRET="your_censys_secret"
export NETPROBE_SECURITYTRAILS_KEY="your_st_key"

net-probe -t 192.168.1.1

Passing Keys via Config File

Create ~/.config/net-probe/config.json:

{
  "shodan_api_key": "your_shodan_key",
  "virustotal_api_key": "your_virustotal_key",
  "censys_api_id": "your_censys_id",
  "censys_api_secret": "your_censys_secret",
  "securitytrails_api_key": "your_st_key"
}

Supported Integrations

Service	Purpose	Free Tier	Get Key
Shodan	Host intel, open ports, banners	100 results/query	shodan.io
VirusTotal	Malware/reputation checks	4 requests/min	virustotal.com
Censys	Certificate + banner search	250 results/query	censys.io
SecurityTrails	DNS history, subdomain data	50 API calls/month	securitytrails.com
NVD API	CVE correlation	Unlimited (free)	No key required
CIRCL CVE	CVE lookup	Unlimited (free)	No key required
ip-api.com	Geolocation in traceroute	Unlimited (free)	No key required

---

Practical Examples

1. Scan subnet and save in all formats:

net-probe -t 192.168.1.0/24 -oA subnet_scan

2. SYN stealth scan on top 100 ports:

sudo net-probe -t 10.0.0.1 -sS -pT 100

3. Audit HTTPS server for SSL vulnerabilities:

net-probe -t mysecureserver.com -p 443 --tls -oH tls_audit.html

4. Vulnerability check, WAF detection, and web stack fingerprinting:

net-probe -t target.com -sV --vuln --waf --web

5. Scan container orchestration endpoints:

net-probe -t 10.10.10.15 -p 10250,2375,2376 --cloud

6. Full DNS enumeration and subdomain discovery:

net-probe -t example.com --dns

7. Shodan-enriched reconnaissance with Censys backup:

net-probe -t 203.0.113.0/28 -sV -O --cloud \
  --shodan-key $SHODAN_KEY \
  --censys-id $CENSYS_ID --censys-secret $CENSYS_SECRET \
  -oH recon_report.html

8. Paranoid-speed stealth scan with packet fragmentation:

sudo net-probe -t 192.168.5.1 -sS -sV -T 0 --frag --randomize

---

Architecture

net-probe/
├── net_probe/
│   ├── core/                 # Async port scan & discovery engines
│   │   ├── scanner.py        # Main async orchestrator
│   │   ├── tcp_scanner.py    # TCP Connect, SYN, ACK, NULL, FIN, XMAS
│   │   ├── udp_scanner.py    # UDP scanning
│   │   ├── host_discovery.py # ARP, ICMP, TCP ping discovery
│   │   ├── port_strategy.py  # Port range parsing & top-port lists
│   │   └── rate_limiter.py   # Adaptive rate limiting
│   ├── modules/              # Analysis modules (run after scan)
│   │   ├── service_detect.py # Banner grabbing & service fingerprinting
│   │   ├── os_detect.py      # OS fingerprinting (TTL + TCP window)
│   │   ├── tls_analyzer.py   # TLS/SSL deep analysis & grading
│   │   ├── vuln_scanner.py   # CVE correlation + default creds check
│   │   ├── dns_enum.py       # DNS records + subdomain brute force
│   │   ├── web_detect.py     # WAF, CMS, web tech fingerprinting
│   │   ├── traceroute.py     # Network path tracing
│   │   └── cloud_detect.py   # Cloud/CDN/container detection
│   ├── output/               # Export engines
│   │   ├── formatter.py      # Output dispatch engine
│   │   ├── json_output.py    # JSON exporter
│   │   ├── csv_output.py     # CSV exporter
│   │   ├── html_report.py    # Interactive HTML dashboard
│   │   └── console_output.py # Rich terminal UI
│   ├── utils/                # Utility helpers
│   │   ├── network.py        # IP/CIDR parsing helpers
│   │   ├── colors.py         # Terminal styling
│   │   └── validators.py     # Input validation
│   ├── config.py             # Configuration & API key management
│   ├── models.py             # Shared data models
│   └── cli.py                # CLI argument parser
├── requirements.txt
├── setup.py
└── README.md

---

Legal Disclaimer

Net-Probe is intended for ethical security research, authorized penetration testing, and network auditing purposes only.

Unauthorized port scanning of systems without explicit permission may violate local, national, or international laws including the Computer Fraud and Abuse Act (CFAA) and similar regulations.

The authors assume no liability for misuse or damage caused by this tool. Users are solely responsible for ensuring authorization before scanning any target network or host.

---

License

Licensed under the MIT License.

---

Built with ❤️ for the security community  |  Star ⭐ if you find it useful