Problem
Simulated reconnaissance tool that sweeps a target host, fingerprints open services and versions, and flags risky exposed ports the way Nmap would in a live engagement.
Network SecurityNmapService FingerprintingReconPythonCase study / interactive demo
Case study
From problem to working system
My role
Security engineer and full-stack developer
Solution
Simulated reconnaissance tool that sweeps a target host, fingerprints open services and versions, and flags risky exposed ports the way Nmap would in a live engagement.
Architecture
The implementation combines the following technologies and system concerns.
Network SecurityNmapService FingerprintingReconPython
How it was built
- Modelled scan timing and rate control, because an unthrottled sweep is both noisy and unreliable in a real engagement.
Security decisions
- Flagged high-risk exposures such as management interfaces, database ports, and legacy protocols reachable from an untrusted network.
- Ordered findings by exploitability so the report leads with the port that actually gets an attacker somewhere.
Major challenges
- Simulated a reconnaissance sweep across a target host, reporting open, closed, and filtered states rather than a binary up or down.
- Fingerprinted services and versions from banner and response behaviour, since the version is what determines exploitability.
- Flagged high-risk exposures such as management interfaces, database ports, and legacy protocols reachable from an untrusted network.
Verified evidence
Results and measurable impact
- Flagged high-risk exposures such as management interfaces, database ports, and legacy protocols reachable from an untrusted network.
- Ordered findings by exploitability so the report leads with the port that actually gets an attacker somewhere.
- Modelled scan timing and rate control, because an unthrottled sweep is both noisy and unreliable in a real engagement.
- Framed output as an engagement artefact with evidence per finding, matching what a client receives after a test.
No separate numeric outcome is documented, so this section shows shipped technical evidence without inventing metrics.
Screenshots and access
Product view
Interactive Demo
A scoped, fully functional recreation of this project's core feature runs below, live in your browser. Reset it, resize it, or expand it to full screen.
portsentry.zainkhalilkhan.com
PortSentry
Security platform
Sandbox telemetry
PortSentryWorkspace4 updates
PortSentry · Recon
idlePick a target host and a scan profile, then run a simulated sweep. PortSentry fingerprints each open service and flags risky exposures the way an Nmap engagement would. Aggressive mode adds version detection and an OS guess, quick scans reveal less.
target host
scan type
version detection, OS guess, everything
nmap -A 10.4.12.20| Port | State | Service | Version | Risk |
|---|---|---|---|---|
| Press Scan to enumerate web-prod-01 (10.4.12.20) | ||||
Simulated recon. No live hosts are contacted, all findings and versions are illustrative.
Zain Khalil Khan
Client-side sandbox. State is in memory and nothing is sent to a server.