Project 31: Vulnerability Scanner in Python

Module: Module 4: Vulnerability Scanning & Web Exploitation Defense  |  Level: Intermediate  | 
Primary tool: Python + sockets/requests  |  Estimated time: 75–120 minutes

Objective: Build a minimal scanner yourself to understand what commercial scanners automate.

Free lab environment

Metasploitable2 (free vulnerable VM) + Greenbone/OpenVAS Community Edition — https://sourceforge.net/projects/metasploitable/ and https://www.greenbone.net/en/community-edition/

Metasploitable2 is a free, intentionally vulnerable Linux VM published by Rapid7 specifically for this kind of training; download it, run it in NAT-less/host-only mode in VirtualBox so it is not exposed to your real network, and treat it as your scan target. Greenbone’s Community Edition of OpenVAS is free and open-source.

Lab workflow

1. Stand up your target (Metasploitable2 (host-only VM)) in an isolated host-only VM network.
2. Run Python + sockets/requests with the specific goal of learning to build a minimal scanner yourself to understand what commercial scanners automate.
3. Before writing anything, sort your raw findings by severity so your report reflects real priority, not the order the tool happened to list them in.
4. For your top 3 findings, write: what it is, how you confirmed it, the real-world risk, and the fix.
5. If time allows, apply at least one fix and re-scan to confirm it’s resolved.
6. Assemble your findings into the deliverable format described below.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• your script’s source code
• its console output enumerating open ports/services on the Metasploitable2 VM

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.