The latest articles on DEV Community by aymenki (@aymenki). https://dev.to/aymenki https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4202226%2Ff09800a2-84e6-435e-ab01-b5c62c187bf7.png https://dev.to/aymenki en aymenki Fri, 23 Oct 2026 09:47:15 +0000 https://dev.to/aymenki/i-built-nmap-studio-a-local-browser-ui-for-the-nmap-suite-18a2 https://dev.to/aymenki/i-built-nmap-studio-a-local-browser-ui-for-the-nmap-suite-18a2 <p>I kept finding myself switching between the Nmap manual, terminal commands, and saved scan notes. I wanted one place where I could build a command, run it, and understand the result without hiding what Nmap is doing.</p> <p>So I built <strong>Nmap Studio</strong>, a local browser interface for Nmap and the other tools that come with it.</p> <p>GitHub: <a href="https://github.com/aymenki/nmap-studio" rel="noopener noreferrer">https://github.com/aymenki/nmap-studio</a></p> <h2> What it does </h2> <p>The interface currently supports <strong>Nmap, Ncat, Nping, and Ndiff</strong>.</p> <p>You can configure common scan options with normal form controls, watch output while a command is running, cancel a job, send input to Ncat, save scan profiles, and review recent output. There is also an XML report viewer and a searchable catalog of 612 NSE scripts.</p> <p>I did not try to replace every command-line option with a button. Less common options can still be added through the advanced argument editor.</p> <h2> Running it </h2> <p>You need Python 3.10 or newer and the official Nmap tools installed on your PATH. There are no extra Python packages to install.</p> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>python server.py </code></pre> </div> <p>On Windows, you can also run <code>start.cmd</code>. The interface opens at <code>http://127.0.0.1:8765</code>.</p> <h2> A note about security </h2> <p>This tool can launch real network commands, so I built it for local use. The server listens only on loopback, checks Host and Origin on requests that change state, uses a per-session token, and does not enable CORS. Commands are started as argument lists without passing them through a shell.</p> <p>It still runs with your user account's permissions. Keep the runner local, and only scan systems you own or are allowed to test.</p> <p>Nmap Studio is an independent project and is not affiliated with or endorsed by the Nmap project.</p> <h2> I would like your feedback </h2> <p>This is the first public version, so I am especially interested in feedback about:</p> <ul> <li>whether the scan builder is easy to understand</li> <li>anything missing from the Nmap, Ncat, Nping, or Ndiff workflows</li> <li>security issues in the local runner</li> <li>problems on Linux or macOS</li> </ul> <p>If you try it, please tell me what felt confusing or open an issue on GitHub.</p> cybersecurity opensource python nmap