Author: Santhosh L License: MIT
SecureNET Toolkit is an open-source cybersecurity toolkit built with Python. It provides eighteen independent security tools and a unified control panel dashboard: a file encryption system, a network intrusion detection system, an HTTP security header analyzer, a multi-threaded port scanner, a hash identifier & cracker, a real-time ARP spoof detector, a subdomain enumerator, a JWT security analyzer, an SSL/TLS security scanner, a hardcoded secret scanner, a DNS security auditor (DNSAudit), a log anomaly monitor (LogSentry), an OWASP API Security Top 10 tester (APIGuard), a template-based HTTP vulnerability scanner (Nuclei-style), a web content/path discovery tool (feroxbuster-style), a multi-cloud security posture checker (Prowler/ScoutSuite-style), a container/dependency CVE scanner (Trivy-style), and a web technology fingerprinter (WhatWeb/httpx-style).
All tools are lightweight, offline-first (except for target URL/header lookups), and designed for developers, security students, and penetration testers.
Encrypt and decrypt files with AES-256 symmetric encryption. Keys are derived from passwords using PBKDF2 (480,000 iterations). Every decryption verifies file integrity against a stored SHA-256 hash. Includes a Tkinter GUI.
Tech: Python, Tkinter, cryptography, hashlib
Capture live network packets, store them in SQLite, and detect intrusion patterns including port scans and packet floods. Includes a real-time Flask web dashboard with live stats and color-coded alerts.
Tech: Python, Scapy, Flask, SQLite
Analyze any website's HTTP response headers for security misconfigurations. Checks 10 critical headers, assigns risk levels (SAFE / WARNING / CRITICAL), computes an overall security score out of 100, and provides actionable fix recommendations. Works as both a CLI tool (with Rich tables) and a web dashboard.
Tech: Python, Flask, Requests, Rich
Scan any host for open ports using raw sockets — no Nmap dependency. Identifies running services on 60+ known ports, assigns risk levels (LOW / MEDIUM / HIGH), and provides actionable risk notes. Supports 4 scan profiles with multi-threaded scanning (100 workers). Works as both a CLI tool and a web dashboard with live polling.
Tech: Python, Sockets, Threading, Flask, Rich
Identify hash types from any string using length and pattern matching. Supports 17 hash formats with confidence scoring and algorithm category tagging. Optional wordlist-based cracking for weak hashes (MD5, SHA-1, etc.). Fully local processing.
Tech: Python, Flask, hashlib, Rich
Passively monitors local network for ARP spoofing and poisoning attacks. Tracks IP-to-MAC mappings against a trusted baseline with 4 detection rules (MAC mismatch, gratuitous ARP, flood, gateway spoof). Real-time alerts with severity levels and SQLite logging.
Tech: Python, Scapy, Flask, SQLite, Rich
Enumerate subdomains via wordlist brute-force, Certificate Transparency logs (crt.sh), and DNS record analysis. Resolves IPs, checks HTTP status, flags interesting results (200/403), and detects wildcard DNS.
Tech: Python, DNS, Requests, Flask, Rich
Decode and actively test JWT tokens for 8 vulnerability classes: alg:none confusion, weak secret brute-force, RS256→HS256 substitution, expiration issues, sensitive data exposure, kid injection, JKU/X5U abuse, and claim manipulation. Generates proof-of-concept forged tokens.
Tech: Python, Flask, PyJWT, Cryptography, Rich
Comprehensive SSL/TLS audit: protocol testing (SSLv2-TLS1.3), 200+ cipher enumeration, full certificate chain analysis, 10 CVE vulnerability checks (Heartbleed, POODLE, BEAST, etc.), and A+ to F grading. Fully offline, no SSL Labs dependency.
Tech: Python, Flask, SSL, Cryptography, Rich
Scan codebases, git history, and environment configs for 50+ types of hardcoded secrets. Integrates with pre-commit hooks and CI/CD pipelines via SARIF/JUnit output.
Tech: Python, Flask, Git, Regex, Entropy Analysis
Audit DNS configuration across 12 categories: email authentication (SPF/DKIM/DMARC), DNSSEC validation, zone-transfer exposure, subdomain takeover detection, DNS hijacking indicators, mail server config, nameserver health, CAA, DNS inventory, and DANE/TLSA. Grades domains A–F with prioritized remediation plans. Supports custom resolvers, bulk scanning, and JSON/PDF report export.
Tech: Python, dnspython, Flask, Requests, Rich
Ingest logs from 6 formats (Linux auth, Apache/Nginx access & error, Windows Event Logs, UFW/iptables, JSON/CSV), normalize them into a unified schema, run 15 detection rules mapped to MITRE ATT&CK, correlate events across sources, and generate incident reports — all offline. Real-time monitoring plus historical analysis modes, with ATT&CK Navigator JSON export and JSON/CSV/PDF reports.
Tech: Python, Flask, Rich, Watchdog, SQLite
Send templated HTTP requests to a target and evaluate matchers (status / word / regex) to surface misconfigurations, exposed files, and version disclosure. Checks are read-only and safe; new checks are added by dropping a .yaml template — no code changes.
Tech: Python, Flask, Requests, PyYAML, Rich
Discover hidden or forgotten web paths by brute-forcing a wordlist of common paths (admin panels, backups, configs, API roots). Multi-threaded, reports only "interesting" HTTP status codes. Read-only.
Tech: Python, Flask, Requests, Rich
Run read-only security posture checks across AWS, GCP, and Azure (S3 public access, IAM root MFA, root access keys, and more). Without credentials it reports INFO with guidance, so it never mutates cloud state.
Tech: Python, Flask, Rich
Find known vulnerabilities in requirements.txt (delegates to pip-audit when available, else a built-in offline rule set) and in image SBOMs (CycloneDX/SPDX JSON). Read-only and offline-first.
Tech: Python, Flask, Rich
Identify the technologies behind a web target by inspecting response headers, cookies, and body signatures. Detects servers, frameworks, CMS platforms, CDNs, analytics, JS libraries, and security headers. Fully read-only.
Tech: Python, Flask, Requests, Rich
Automated security testing for REST APIs against the OWASP API Security Top 10 (API1–API10) plus injection. Discovers endpoints from OpenAPI specs or a 545-entry built-in wordlist, authenticates via 6 modes (bearer, API key, basic, cookie, OAuth2, none), and runs targeted probes for BOLA, broken auth, excessive data exposure, mass assignment, rate-limit gaps, BFLA, SSRF, misconfigurations, and more. Read-only by default; destructive tests require the --unsafe flag. Maps findings to known CVEs and exports JSON/PDF reports.
Tech: Python, Flask, Requests, PyYAML, Rich
Unified web dashboard that orchestrates all 18 security tools. Launch, monitor, and manage every tool from a single interface with real-time health checks, unified alerts, and quick-scan capabilities.
# Clone the repository
git clone https://github.com/Santhosh595/SecureNET-Toolkit-.git
cd SecureNET-Toolkit-cd FileGuard-AES-SHA256
pip install -r requirements.txt
python main.pyRequires administrator/root privileges for packet capture.
cd network-sniffer
pip install -r requirements.txt
# Terminal 1: Start the sniffer
python sniffer_alert2.py
# Terminal 2: Start the dashboard
python app.py
# Open http://127.0.0.1:5000cd HeaderScan
pip install -r requirements.txt
# CLI scan
python main.py https://example.com
# JSON output
python main.py https://example.com --json
# Web dashboard
python dashboard.py
# Open http://127.0.0.1:5100cd PortMap
pip install -r requirements.txt
# Quick scan
python main.py 192.168.1.1
# Web dashboard
python dashboard.py
# Open http://127.0.0.1:5200cd HashDetect
pip install -r requirements.txt
# Identify a hash
python main.py 5f4dcc3b5aa765d61d8327deb882cf99
# Identify + crack
python main.py 5f4dcc3b5aa765d61d8327deb882cf99 --crack
# Web dashboard
python dashboard.py
# Open http://127.0.0.1:5300cd ARPWatch
pip install -r requirements.txt
# Start monitoring (requires root)
sudo python main.py
# Web dashboard
python dashboard.py
# Open http://127.0.0.1:5400cd SubProbe
pip install -r requirements.txt
# Full enumeration
python main.py example.com
# Web dashboard
python dashboard.py
# Open http://127.0.0.1:5500cd JWTInspect
pip install -r requirements.txt
# Analyze a token
python main.py eyJhbG...NiIs...
# With secret cracking
python main.py <token> --crack
# Web dashboard
python dashboard.py
# Open http://127.0.0.1:5600cd TLScan
pip install -r requirements.txt
# Basic scan
python main.py example.com
# Custom port
python main.py example.com --port 8443
# Web dashboard
python dashboard.py
# Open http://127.0.0.1:5700cd SecretSniff
pip install -r requirements.txt
# Scan a directory
python main.py scan --path ./myproject
# Scan git history
python main.py scan --repo ./myrepo --history
# Export SARIF for GitHub Code Scanning
python main.py scan --path . --output results.sarif
# Install pre-commit hook
python main.py install-hookcd VulnProbe
pip install -r requirements.txt
# Scan a target (HIGH/CRITICAL only)
python main.py https://example.com --severity high,critical
# Web dashboard
python dashboard.py
# Open http://127.0.0.1:5013cd PathProbe
pip install -r requirements.txt
# Discover paths with the built-in common wordlist
python main.py https://example.com --wordlist common
# Web dashboard
python dashboard.py
# Open http://127.0.0.1:5014cd CloudSentry
pip install -r requirements.txt
# INFO mode (no credentials required) — lists all 60 checks (25 AWS / 20 GCP / 15 Azure)
python main.py --info
# Live audit of one provider (uses detected credentials)
python main.py --provider aws --profile default
# Web dashboard
python dashboard.py
# Open http://127.0.0.1:5015cd ImgScan
pip install -r requirements.txt
# Scan a project's dependencies
python main.py --requirements requirements.txt
# Scan an image SBOM (CycloneDX/SPDX JSON)
python main.py --sbom sbom.json
# Web dashboard
python dashboard.py
# Open http://127.0.0.1:5016cd TechFinger
pip install -r requirements.txt
# Fingerprint a target
python main.py https://example.com
# Web dashboard
python dashboard.py
# Open http://127.0.0.1:5017cd DNSAudit
pip install -r requirements.txt
# Basic audit
python main.py example.com
# Specific categories only
python main.py example.com --categories "SPF,DKIM,DMARC"
# Bulk scan
python main.py bulk --file domains.txt --output results.json
# Web dashboard
python main.py dashboard
# Open http://127.0.0.1:5900cd LogSentry
pip install -r requirements.txt
# Historical analysis of a log file
python main.py analyze --file /var/log/auth.log
# Real-time monitoring
python main.py monitor --file /var/log/auth.log
# Cross-source correlation
python main.py correlate --files auth.log access.log --type auth,web
# Web dashboard
python main.py dashboard
# Open http://127.0.0.1:5000cd APIGuard
pip install -r requirements.txt
# Scan an API with bearer authentication (read-only)
python main.py https://api.example.com/v2 --auth "bearer TOKEN"
# Filter by OWASP category
python main.py https://api.example.com --auth "bearer TOKEN" --category api1,api2
# Web dashboard
python dashboard.py
# Open http://127.0.0.1:5018# FileGuard tests (15 tests)
cd FileGuard-AES-SHA256
python -m pytest test_main.py -v
# Network Sniffer tests (11 tests)
cd network-sniffer
python -m pytest test_sniffer.py -vSecureNET-Toolkit-/
├── .gitignore
├── LICENSE
├── README.md
├── FileGuard-AES-SHA256/
│ ├── main.py # GUI application (Tkinter)
│ ├── test_main.py # Unit tests (15 tests)
│ ├── requirements.txt # cryptography
│ ├── LICENSE.txt # MIT License
│ ├── README.md # Tool documentation
│ └── sample_files/ # Sample test files
├── network-sniffer/
│ ├── sniffer_alert2.py # Main packet capture orchestrator
│ ├── app.py # Flask dashboard server
│ ├── db.py # SQLite database layer
│ ├── detector2.py # Intrusion detection rules
│ ├── test_sniffer.py # Unit tests (11 tests)
│ ├── requirements.txt # flask, scapy
│ ├── templates/
│ │ └── index.html # Dashboard UI
│ └── README.md # Tool documentation
├── HeaderScan/
│ ├── main.py # CLI entry point (Rich tables)
│ ├── analyzer.py # Core header analysis engine
│ ├── dashboard.py # Flask web dashboard
│ ├── requirements.txt # requests, rich, flask
│ ├── templates/
│ │ └── index.html # Dashboard UI
│ └── README.md # Tool documentation
├── PortMap/
│ ├── main.py # CLI entry point (Rich progress bar)
│ ├── scanner.py # Core scanning engine (raw sockets)
│ ├── dashboard.py # Flask web dashboard
│ ├── requirements.txt # rich, flask
│ ├── templates/
│ │ └── index.html # Dashboard UI
│ └── README.md # Tool documentation
├── HashDetect/
│ ├── main.py # CLI entry point (Rich tables)
│ ├── detector.py # Hash identification logic
│ ├── cracker.py # Wordlist cracking engine
│ ├── wordlists/
│ │ └── common.txt # Built-in wordlist (1000 passwords)
│ ├── dashboard.py # Flask web dashboard
│ ├── templates/
│ │ └── index.html # Dashboard UI
│ └── README.md # Tool documentation
├── SubProbe/
│ ├── main.py # CLI entry point (Rich tables)
│ ├── enumerator.py # Core enumeration engine
│ ├── resolver.py # DNS resolution + HTTP status checks
│ ├── ctlogs.py # crt.sh API integration
│ ├── database.py # SQLite operations
│ ├── dashboard.py # Flask web dashboard
│ ├── wordlists/
│ │ └── subdomains.txt # Built-in 500 subdomain wordlist
│ ├── templates/
│ │ └── index.html # Dashboard UI
│ └── README.md # Tool documentation
├── ARPWatch/
│ ├── main.py # CLI entry point (Rich live display)
│ ├── sniffer.py # Scapy ARP packet capture
│ ├── detector.py # Detection rules (4 rules)
│ ├── baseline.py # Baseline management
│ ├── database.py # SQLite operations
│ ├── dashboard.py # Flask web dashboard
│ ├── baseline.json # Auto-generated baseline
│ ├── templates/
│ │ └── index.html # Dashboard UI
│ └── README.md # Tool documentation
├── JWTInspect/
│ ├── main.py # CLI entry point (Rich panels)
│ ├── parser.py # JWT decode + claims extraction
│ ├── tests/
│ │ └── __init__.py # 8 security test modules
│ ├── wordlists/
│ │ └── secrets.txt # Built-in 1000 JWT secrets
│ ├── reporter.py # Report generation
│ ├── dashboard.py # Flask web dashboard
│ ├── templates/
│ │ └── index.html # Dashboard UI
│ └── README.md # Tool documentation
├── TLScan/
│ ├── main.py # CLI entry point (Rich panels)
│ ├── connector.py # SSL connection + certificate extraction
│ ├── protocol_tester.py # Protocol version testing
│ ├── cipher_enumerator.py # Cipher suite enumeration
│ ├── vuln_checks/
│ │ └── __init__.py # 10 vulnerability checks
│ ├── grader.py # SSL Labs-style grading
│ ├── database.py # SQLite operations
│ ├── dashboard.py # Flask web dashboard
│ ├── templates/
│ │ └── index.html # Dashboard UI
│ └── README.md # Tool documentation
├── SecretSniff/
│ ├── main.py # CLI entry point (Rich output)
│ ├── scanner/
│ │ ├── file_scanner.py # File/directory scanning
│ │ ├── git_scanner.py # Git repo + history scanning
│ │ ├── env_scanner.py # Env file targeting
│ │ └── entropy.py # Shannon entropy calculator
│ ├── patterns/
│ │ └── rules.py # 50+ regex patterns
│ ├── allowlist.py # Allowlist management
│ ├── baseline.py # Baseline comparison
│ ├── output/
│ │ ├── sarif.py # SARIF format export
│ │ ├── junit.py # JUnit XML export
│ │ └── reporter.py # PDF report generation
│ ├── database.py # SQLite operations
│ ├── dashboard/
│ │ ├── app.py # Flask web dashboard
│ │ └── templates/
│ │ └── index.html # Dashboard UI
│ └── README.md # Tool documentation
├── VulnProbe/
│ ├── main.py # CLI entry point (Rich output)
│ ├── engine/ # Template matching engine
│ ├── templates/ # YAML check templates + dashboard UI
│ ├── dashboard.py # Flask web dashboard
│ └── README.md # Tool documentation
├── PathProbe/
│ ├── main.py # CLI entry point (Rich output)
│ ├── wordlists/ # Common path wordlists
│ ├── dashboard.py # Flask web dashboard
│ ├── templates/
│ │ └── index.html # Dashboard UI
│ └── README.md # Tool documentation
├── CloudSentry/
│ ├── main.py # CLI entry point (Rich output)
│ ├── providers/ # AWS / GCP / Azure check modules
│ ├── catalog.py # Check registry
│ ├── dashboard.py # Flask web dashboard
│ ├── templates/
│ │ └── index.html # Dashboard UI
│ └── README.md # Tool documentation
├── ImgScan/
│ ├── main.py # CLI entry point (Rich output)
│ ├── dashboard.py # Flask web dashboard
│ ├── templates/
│ │ └── index.html # Dashboard UI
│ └── README.md # Tool documentation
├── TechFinger/
│ ├── main.py # CLI entry point (Rich output)
│ ├── dashboard.py # Flask web dashboard
│ ├── templates/
│ │ └── index.html # Dashboard UI
│ └── README.md # Tool documentation
├── DNSAudit/
│ ├── main.py # CLI entry point (Rich tables)
│ ├── resolver.py # DNS resolution engine
│ ├── scorer.py # A–F grading logic
│ ├── reporter.py # JSON/PDF report generation
│ ├── dashboard/ # Flask web dashboard
│ └── README.md # Tool documentation
├── LogSentry/
│ ├── main.py # CLI entry point (analyze/monitor/correlate)
│ ├── ingester/ # Log format parsers
│ ├── normalizer.py # Unified schema normalization
│ ├── rules/ # 15 detection rules
│ ├── mitre/ # ATT&CK mappings
│ ├── dashboard/ # Flask web dashboard (port 5000)
│ └── README.md # Tool documentation
├── APIGuard/
│ ├── main.py # CLI entry point (Rich output)
│ ├── analyzer/ # OWASP API Top 10 probes
│ ├── discovery/ # Endpoint discovery (OpenAPI + wordlist)
│ ├── auth/ # 6 authentication modes
│ ├── dashboard.py # Flask web dashboard (port 5018)
│ ├── tests/ # Unit tests
│ └── README.md # Tool documentation
├── SecureNET-Control-Panel/
│ ├── hub.py # Main Flask app (control panel)
│ ├── start_all.py # Master launcher script
│ ├── stop_all.py # Graceful shutdown script
│ ├── process_manager.py # Subprocess management
│ ├── health_monitor.py # Background health checker
│ ├── alert_aggregator.py # Pulls alerts from all tools
│ ├── quick_scan.py # Quick scan orchestration
│ ├── proxy.py # Tool dashboard proxy
│ ├── database.py # SQLite for hub data
│ ├── securenet.yaml # Master configuration
│ ├── static/
│ │ ├── css/
│ │ │ ├── main.css # Design system + layout
│ │ │ └── components.css
│ │ └── js/
│ │ └── main.js # Core app logic
│ ├── templates/
│ │ ├── base.html # Base layout + nav
│ │ ├── command_center.html
│ │ ├── analytics.html
│ │ ├── alerts.html
│ │ ├── history.html
│ │ ├── tools_manager.html
│ │ └── docs.html
│ ├── logs/
│ └── requirements.txt
└── landing-page/
├── index.html # Static landing page
├── styles.css # Stylesheet
└── script.js # Scroll animations
| Tool | Python | Flask | Requests | Scapy | Tkinter | Sockets | cryptography | Rich | hashlib | SQLite | Cloud SDK |
|---|---|---|---|---|---|---|---|---|---|---|---|
| FileGuard | Yes | — | — | — | Yes | — | Yes | — | — | — | — |
| Network Sniffer | Yes | Yes | — | Yes | — | — | — | — | — | — | — |
| HeaderScan | Yes | Yes | Yes | — | — | — | — | Yes | — | — | — |
| PortMap | Yes | Yes | — | — | — | Yes | — | Yes | — | — | — |
| HashDetect | Yes | Yes | — | — | — | — | — | Yes | Yes | — | — |
| ARPWatch | Yes | Yes | — | Yes | — | — | — | Yes | — | Yes | — |
| SubProbe | Yes | Yes | — | — | — | — | — | Yes | — | — | — |
| JWTInspect | Yes | Yes | — | — | — | — | — | Yes | — | — | — |
| TLScan | Yes | Yes | — | — | — | — | — | Yes | — | — | — |
| LogSentry | Yes | — | — | — | — | — | — | Yes | — | Yes | — |
| SecretSniff | Yes | — | — | — | — | — | — | Yes | — | Yes | — |
| DNSAudit | Yes | — | — | — | — | — | — | Yes | — | Yes | — |
| VulnProbe | Yes | Yes | Yes | — | — | — | — | Yes | — | Yes | — |
| PathProbe | Yes | Yes | Yes | — | — | — | — | Yes | — | Yes | — |
| CloudSentry | Yes | Yes | — | — | — | — | — | Yes | — | Yes | boto3 / GCP / Azure |
| ImgScan | Yes | Yes | — | — | — | — | — | Yes | — | Yes | — |
| TechFinger | Yes | Yes | Yes | — | — | — | — | Yes | — | — | — |
| APIGuard | Yes | Yes | Yes | — | — | — | — | Yes | — | Yes | — |
| Control Panel | Yes | Yes | Yes | — | — | — | — | Yes | — | Yes | — |
HeaderScan uses a weighted scoring system out of 100:
| Header | Weight |
|---|---|
| Strict-Transport-Security | 20 |
| Content-Security-Policy | 20 |
| X-Frame-Options | 15 |
| X-Content-Type-Options | 10 |
| Referrer-Policy | 8 |
| Permissions-Policy | 7 |
| X-XSS-Protection | 5 |
| Cache-Control | 5 |
| Set-Cookie | 5 |
| Server / X-Powered-By | 5 |
- SAFE = full points, WARNING = half points, CRITICAL = 0 points
- Grade: A (90-100), B (75-89), C (50-74), F (below 50)
A static landing page showcasing all tools is available in landing-page/. Open index.html in a browser to view it. Features dark theme, scroll animations, responsive layout, and tool cards with feature lists.
MIT License — free for personal, educational, and commercial use.
This toolkit is intended for educational purposes and authorized security testing only. Always obtain proper authorization before scanning networks or systems you do not own.