CyberVault Suite

A single Flask application combining three defensive cybersecurity tools into one "operations console" style UI:

1. Password Strength Analyzer — live entropy calculation, breach-list matching, keyboard-pattern / repeat / sequential-run detection, crack-time estimate.
2. Secure Login System — salted PBKDF2-HMAC-SHA256 password hashing (260,000 iterations), brute-force lockout after 5 failed attempts, hardened session cookies, and a full login audit trail.
3. Vulnerability Scanner — concurrent TCP port scan of 24 commonly exploited ports, HTTP security-header audit (HSTS, CSP, X-Frame-Options, etc.), and a TLS certificate / protocol-version check.

⚠️ Legal / ethical use

Only scan hosts, domains, and IP addresses you own or are explicitly authorized to test. Port scanning third-party systems without permission may violate laws such as the U.S. Computer Fraud and Abuse Act or equivalent legislation elsewhere. This project is for learning, portfolio, and authorized security-assessment use.

Project structure

cyber_security_suite/
├── app.py                # Flask routes, auth, DB wiring
├── security_utils.py     # PasswordAnalyzer, PasswordHasher, RateLimiter
├── scanner.py             # VulnerabilityScanner (ports / headers / TLS)
├── requirements.txt
├── templates/
│   ├── base.html
│   ├── index.html         # Landing page + live password analyzer
│   ├── register.html
│   ├── login.html
│   └── dashboard.html      # Authenticated scanner console + activity logs
└── static/
    ├── css/style.css       # "Signal Ops" dark console theme
    └── js/app.js           # Live meter + scanner AJAX

Setup

cd cyber_security_suite
python -m venv venv
source venv/bin/activate        # Windows: venv\Scripts\activate
pip install -r requirements.txt
python app.py

Open https://cybersecurevault-nf78.onrender.com/ in your browser. The SQLite database (cybervault.db) is created automatically on first run.

How each module works

1. Password Analyzer (security_utils.PasswordAnalyzer)

• Computes Shannon-style entropy from character-set size × length.
• Scores across 10 weighted checks (length, character classes, breach-list membership, keyboard-walk patterns, repeats, sequential runs).
• Estimates crack time assuming a 10-billion-guesses/second offline attacker.
• Exposed live at /api/analyze-password and used on the landing page and registration form — nothing is stored server-side from this endpoint.

2. Secure Login System (app.py + security_utils.PasswordHasher / RateLimiter)

• Registration enforces a minimum password-strength score of 45/100.
• Passwords are hashed with PBKDF2-HMAC-SHA256, 260,000 iterations, unique 16-byte salt per user — plaintext is never persisted.
• RateLimiter locks a username:ip pair out for 60 seconds after 5 failed attempts within a rolling 5-minute window.
• Every attempt (success or failure) is written to login_events and shown on the dashboard.
• Session cookies are HttpOnly + SameSite=Lax with a 30-minute lifetime.

3. Vulnerability Scanner (scanner.VulnerabilityScanner)

• scan_ports(host) — threads 24 socket connect() probes against common ports (FTP, SSH, RDP, SMB, databases, etc.) and flags high-risk exposures.
• scan_headers(url) — fetches the URL and diffs its response headers against 6 recommended security headers, and flags Server / X-Powered-By information disclosure.
• scan_tls(host) — opens a TLS connection, reports negotiated protocol version, and warns if the certificate expires within 30 days or a deprecated protocol (SSLv3/TLSv1/TLSv1.1) is in use.
• All three are wired to /api/scan/* behind login, and every scan is logged to scan_history.

Customization ideas

• Swap the in-memory RateLimiter for Redis if you deploy with multiple workers.
• Add TOTP-based two-factor authentication (e.g. with pyotp) to the login flow.
• Replace the bundled common-password list with a live HaveIBeenPwned k-anonymity API check for production use.
• Add PDF/CSV export of scan history for reporting.