DEV Community: Saif Ali

Python Network Service Enumeration Tool | Security Project

Saif Ali — Wed, 12 Aug 2026 18:03:56 +0000

Introduction

I built a Python-based Network Service Enumeration Tool to practice network reconnaissance, TCP port scanning, service identification, and basic security assessment.

The tool was developed and tested in a Kali Linux environment using Python socket programming and multithreading.

Project Overview

The main goal of this project was to understand how network services can be discovered by scanning TCP ports and identifying services running on open ports.

The tool performs a focused scan of commonly used ports and provides useful information about discovered services.

Key Features

• Scan TCP ports
• Identify open ports
• Map ports to common services
• Perform banner grabbing
• Use multithreading for faster scanning
• Display scan results
• Save results to a text report
• Accept a target through the command line

Technologies Used

• Python
• Socket Programming
• Threading
• Kali Linux
• Linux Networking
• Git
• GitHub

How It Works

The basic workflow is:

Target Host
↓
TCP Port Scanner
↓
Check Port Availability
↓
Identify Service
↓
Banner Grabbing
↓
Display Results
↓
Save Report

The tool uses Python's socket library to establish TCP connections and determine whether specific ports are accessible.

Port Scanning

The scanner checks a predefined list of commonly used TCP ports, including:

• 21 — FTP
• 22 — SSH
• 23 — Telnet
• 25 — SMTP
• 53 — DNS
• 80 — HTTP
• 110 — POP3
• 139 — NetBIOS
• 143 — IMAP
• 443 — HTTPS
• 445 — SMB
• 3389 — RDP
• 8000 — HTTP-Alt

The project focuses on controlled scanning of systems where authorization has been provided.

Multithreading

To improve scanning speed, the tool uses Python threading.

Instead of checking every port sequentially, multiple port checks can be performed concurrently.

This helped me understand how threading can be applied to network security tools.

Banner Grabbing

When an open service is discovered, the tool attempts to retrieve service information through banner grabbing.

For example, during testing the tool identified:

Port: 8000
Service: HTTP-Alt
Banner: HTTP/1.0 200 OK
Server: SimpleHTTP/0.6 Python/3.13.12

Banner information can help identify the type of service and, when available, the software or server version.

Example Scan

The tool can be executed with:

python3 scanner.py -t 127.0.0.1

Example result:

Target: 127.0.0.1

Scanned Ports: 14
Open Ports: 1

Port: 8000
Service: HTTP-Alt
Banner: HTTP/1.0 200 OK
Server: SimpleHTTP/0.6 Python/3.13.12

The results are also saved to:

results.txt

Security Use Case

Service enumeration is an important part of network security assessment.

Identifying open ports and exposed services can help security teams understand the attack surface of a system.

For example, unnecessary services or legacy protocols can be identified for further security review.

This tool is designed for educational purposes and authorized security testing only.

What I Learned

Through this project, I gained practical experience in:

• TCP port scanning
• Socket programming
• Network service enumeration
• Banner grabbing
• Python threading
• Command-line interfaces
• Linux networking
• Kali Linux
• Basic security assessment
• Security automation

Future Improvements

Possible future improvements include:

• UDP scanning
• More advanced service detection
• Operating system detection
• Configurable port ranges
• JSON report generation
• HTML reporting
• Risk-based service classification
• Better timeout handling
• Network scan history
• Integration with vulnerability assessment tools

GitHub Repository

The complete source code is available in my GitHub portfolio:

https://github.com/Saif2246/CyberSecurity-Portfolio

Conclusion

This project helped me strengthen my understanding of network reconnaissance and Python-based security automation.

It also gave me practical experience with sockets, TCP connections, threading, service enumeration, and banner grabbing.

This is the second project in my practical Cloud Security and GRC learning portfolio.

python #security #networksecurity #linux

Nmap XML Parser v1.1 with MariaDB | Python Security Project

Saif Ali — Wed, 12 Aug 2026 17:58:21 +0000

Nmap XML Parser v1.1 with MariaDB | Python Security Project

Introduction

I built a Python-based Nmap XML Parser to automate the extraction and storage of network scan results.

The project reads an Nmap XML scan report, extracts important information such as IP addresses, open ports, services, and port states, and stores the results in a MariaDB database.

Project Overview

The main goal of this project was to practice network security automation, XML parsing, and database integration.

Instead of manually reviewing Nmap XML output, the parser automatically processes the scan results and organizes them into structured database records.

What the Tool Does

The parser:

Reads Nmap XML scan reports
Extracts IP addresses
Identifies open ports
Extracts service information
Extracts port states
Stores scan results in MariaDB
Organizes data into relational database tables

Technologies Used

Python
Nmap
XML
MariaDB
MySQL Connector
Kali Linux
Git
GitHub

How It Works

The workflow is:

Nmap Scan
↓
XML Scan Report
↓
Python XML Parser
↓
Extract Network Information
↓
MariaDB Database
↓
Structured Security Data

For example, an Nmap XML report can contain information about a scanned host and its available ports.

The parser processes this XML data and extracts the relevant security information automatically.

MariaDB Integration

I integrated the Python parser with MariaDB using MySQL Connector.

The extracted information is stored in separate database tables, including:

Scanned_Devices
Open_Ports

This makes the scan results easier to query, analyze, and manage.

Example Result

A sample scan identified:

IP Address: 127.0.0.1
Port: 8000
State: open
Service: http-alt

The parser then stores this information in the database.

Why This Project Matters

Nmap is commonly used for network discovery and security assessment.

Automating the processing of Nmap results can help reduce manual work and provide a structured way to store network information for further analysis.

This project demonstrates how Python can be used to connect network security tools with database systems.

Learning Outcomes

Through this project, I gained practical experience in:

Nmap network scanning
XML parsing
Python automation
MariaDB database integration
SQL database management
Network security analysis
Linux/Kali Linux
Git and GitHub

Future Improvements

Possible future improvements include:

Automated scheduled scanning
More detailed service analysis
Vulnerability information integration
Web-based security dashboard
Historical scan comparison
Automated security reports
Risk-based findings

GitHub Repository

The complete project source code is available on my GitHub portfolio:

https://github.com/Saif2246/CyberSecurity-Portfolio

Conclusion

This project helped me strengthen my practical understanding of network reconnaissance, Python automation, XML processing, and database integration.

It is the first project in my practical Cloud Security and GRC learning portfolio, where I am focusing on building security tools and documenting my learning journey.

python #security #networksecurity #linux

Firewall & ACL Auditor — Python Security Tool #security #python #linux #networksecurity

Saif Ali — Wed, 12 Aug 2026 16:11:23 +0000

Introduction

I built an Automated Firewall & ACL Rule Auditor using Python as my third practical cybersecurity project.

The goal of this project is to automate the initial security review of firewall and ACL rules and identify common configuration weaknesses that may increase security risk.

The project also includes an interactive Tkinter GUI dashboard to make audit results easier to review and understand.

Project Objective

Firewall and ACL rules control which network traffic is allowed or denied. Poorly configured rules can create unnecessary security risks.

Manually reviewing these rules can be time-consuming, especially when dealing with multiple configurations.

This project automates the initial review process by analyzing firewall and ACL rules and identifying potentially risky configurations.

Technologies Used

Python
Tkinter
Firewall & ACL concepts
Security Auditing
Risk Assessment
Security Automation
Git & GitHub

How It Works

The basic workflow is:

Firewall/ACL Rules → Rule Analysis → Security Checks → Findings → Risk Assessment → Report

The auditor examines the configured rules and checks them against predefined security conditions.

When a potentially insecure configuration is detected, the tool records the finding and assigns an appropriate severity or risk level.

Security Checks

The auditor focuses on common firewall and ACL configuration weaknesses, including:

Overly permissive rules
Insecure services
Unnecessary access
Broad source or destination definitions
Potentially risky configurations
Rule-level security findings

The results help identify which rules should receive further security review.

Risk Assessment

A key improvement in this version is the addition of risk assessment.

Instead of only identifying a problematic rule, the auditor provides a risk-oriented view of the findings.

The audit results can include:

Finding
Severity
Risk level
Rule information
Security recommendation

This makes it easier to prioritize findings based on their potential security impact.

GUI Dashboard

I developed an interactive Tkinter-based GUI dashboard to present the audit results visually.

The dashboard provides information such as:

Total firewall rules audited
Security findings
Severity levels
Compliance status
Risk score
Overall risk
Firewall rule statistics

This makes the results easier to understand than reviewing raw output alone.

GUI Dashboard

Why Security Automation?

Security teams may need to review a large number of firewall and ACL rules.

Automation can reduce repetitive manual work and provide a consistent initial security review.

This tool is not intended to replace a complete professional firewall audit. Instead, it demonstrates how Python can automate repetitive security assessment tasks and highlight configurations that require further investigation.

What I Learned

While building this project, I improved my practical understanding of:

Firewall rule evaluation
ACL security concepts
Security auditing
Risk assessment
Python automation
Tkinter GUI development
Security findings and severity classification
Defensive security workflows

The project also helped me understand how security automation can support security operations and GRC-oriented processes.

Project Progression

This is my third practical cybersecurity project.

My current project progression is:

Project 1: Nmap XML Parser v1.1 with MariaDB Integration

Project 2: Network Scanner & Service Enumeration Tool

Project 3: Automated Firewall & ACL Rule Auditor

The projects demonstrate a progression from network reconnaissance and service enumeration toward automated security auditing.

Conclusion

The Automated Firewall & ACL Rule Auditor demonstrates how Python can be used to automate the initial review of firewall and ACL configurations.

By combining rule analysis, security findings, risk assessment, and a GUI dashboard, the project provides a practical approach to identifying potentially risky configurations.

I am continuing to build practical projects focused on Cloud Security, Security Automation, Network Security, and GRC.

Connect with Me

GitHub: https://github.com/Saif2246/CyberSecurity-Portfolio

LinkedIn: https://www.linkedin.com/in/saif-ali-a22230409/

Thanks for reading!

Firewall & ACL Auditor — Python Security Tool #security #python #linux #networksecurity

Saif Ali — Wed, 12 Aug 2026 16:05:23 +0000

Hi! I'm Saif, an IT student exploring Cloud Security, GRC & Python. Excited to learn and share! #security #python #linux #career

Saif Ali — Wed, 12 Aug 2026 15:59:53 +0000