I Built an Open-Source SOC Web Recon & Hardening Dashboard with FastAPI & Vanilla JS

As someone actively preparing for Security Operations Center (SOC) and Application Security (AppSec) roles, I wanted to build a practical tool that bridges the gap between passive reconnaissance and actionable infrastructure remediation.

I’m excited to share SOC Web Recon & Hardening Dashboard—a lightweight, developer-friendly web tool designed to audit HTTP security headers, inspect banner disclosures, run port recon, and auto-generate server hardening directives.

---

🛠️ Tech Stack & Architecture

I kept the stack minimal, fast, and simple to set up locally without complex build steps:

• Backend: Python 3.12, FastAPI, Uvicorn, Python-Nmap, Requests
• Frontend: Vanilla HTML5, CSS3 (Dark Mode + PDF Print Styles), Modern JS (ES6+)
• Engine: Local nmap engine integration

---

✨ Core Features

1. HTTP Security Header Audit: Instantly evaluates core protective headers like Content-Security-Policy, Strict-Transport-Security (HSTS), X-Frame-Options, and Permissions-Policy.
2. Server Banner Disclosure Detection: Pinpoints version leaks (Server, X-Powered-By) that attackers use during early-stage footprinting.
3. Nmap Network Recon: Performs local port scans targeting common web service ports (80/TCP, 443/TCP).
4. Automated Nginx Remediation Generator: Instead of just flagging missing headers, the dashboard dynamically generates copy-paste Nginx configuration directives to fix them immediately.
5. Exportable Telemetry: Export audit reports to raw JSON for ticketing systems or print clean PDF incident summaries directly from the browser.

---

🚀 Getting Started Locally

Prerequisites

Make sure nmap is installed on your machine:

# Linux (Ubuntu/Debian)
sudo apt update && sudo apt install nmap -y

# macOS
brew install nmap

# Windows
winget install Insecure.Nmap

Installation

# Clone the repository
git clone https://github.com/melodykellynwaogu/scanner.git
cd scanner

# Set up virtual environment
python3 -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install dependencies & run
pip install -r requirements.txt
uvicorn app:app --reload

Head over to [http://127.0.0.1:8000](http://127.0.0.1:8000) to analyze your target domain.

---

🤝 Open Source & Contributions Welcome!

The repository is open-sourced under the MIT License. I have configured formal contribution guidelines (CONTRIBUTING.md) and branch protection rules to ensure code quality and safety.

Whether you want to add sub-domain discovery, integrate additional port scanning flags, or refine the UI, PRs are welcome!

• GitHub Repository: github.com/melodykellynwaogu/scanner

I’d love to hear your feedback or ideas for new security checks in the comments!