Cerberus vulnerability assessment

A Python framework that chains reconnaissance, multi-threaded port scanning, service fingerprinting, live CVE lookups against the NIST NVD and web-application checks, driven from a CLI or a web GUI, and ending in a scored PDF report.

haadi@portfolio: ~

haadi@portfolio:~$ eog results.png

Cerberus web GUI results: severity totals, open ports and services with CVE counts, and report export

haadi@portfolio: ~

haadi@portfolio:~$ cat project.yml

technologies: Python, Flask, Socket.IO, React, NIST NVD API, ReportLab, Rich
role: Solo: design & development
year: 2026
status: Complete

How it wasbuilt

haadi@portfolio: ~

haadi@portfolio:~$ cat -n the-problem.txt

A basic assessment usually means stitching together separate tools, one for host discovery, one for ports, manual CVE research, another for web checks, and then writing the report by hand.

haadi@portfolio: ~

haadi@portfolio:~$ cat -n the-approach.txt

I built Cerberus as a modular pipeline where each phase is its own package and hands structured results to the next. The same engine sits behind two interfaces: a rich terminal CLI with scan profiles, and a web GUI with live progress over WebSockets.

recon: ICMP host discovery, forward and reverse DNS, TCP connectivity checks
ports: multi-threaded TCP enumeration and banner-based service fingerprinting
cve: automated NVD queries with semantic version comparison
web: security headers, admin panel discovery, XSS, SQLi and directory enumeration
reporting: PDF assessment reports; JSON output; activity audit log

haadi@portfolio: ~

haadi@portfolio:~$ cat -n implementation.txt

Port scanning runs across 50 worker threads. Detected service versions are matched against CVEs pulled in real time from the NVD, with the packaging library handling version comparison so ranges are evaluated correctly rather than by string match.
The web module checks for CSP, HSTS, X-Frame-Options, X-XSS-Protection and Referrer-Policy, runs 20+ reflected-XSS payload variations, tests error- and boolean-based SQL injection, and brute-forces directories from a wordlist with rate limiting.

haadi@portfolio: ~

haadi@portfolio:~$ cat -n cli.txt

python main.py --target example.com --profile quick
python main.py --target 192.168.1.1
cd gui && python backendAPI.py   # web GUI on :5000

What itproved

haadi@portfolio: ~

haadi@portfolio:~$ cat -n security-details.txt

Findings are classified Critical, High, Medium or Low and rolled into a 0 to 100 risk score. Scan profiles are labelled safe, moderate or aggressive so the operator knows how intrusive a run will be, and the tool includes built-in authorization checks and risk warnings.
It was demonstrated only against public hosts that exist to be scanned (such as testphp.vulnweb.com and scanme.nmap.org), never against systems without permission.

haadi@portfolio: ~

haadi@portfolio:~$ cat -n result.txt

A single command now produces what used to take several tools and an afternoon: an executive summary with a risk score, a vulnerability distribution chart, CVE detail with remediation steps and web findings with evidence.

Concurrent scanning threads: 50; Concurrent scanning threads
Reflected-XSS payload variations: 20+; Reflected-XSS payload variations
CVEs matched to one outdated Apache on a test host: 375; CVEs matched to one outdated Apache on a test host