Security Analysis Toolkit

A CLI-based security tool combining Phishing Email Analysis and Network Vulnerability Scanning into one unified interface. Built as a hands-on portfolio project to demonstrate practical security and infrastructure skills.

---

Features

Phishing Email Analyzer

• Parses raw .eml email files
• Extracts IPs, URLs, and domains from headers
• Performs VirusTotal API lookups on all extracted IOCs
• Flags malicious and suspicious indicators with clear output

Network Vulnerability Scanner

• Accepts single IP or CIDR range (e.g. 192.168.1.0/24)
• Runs Nmap service version detection on common ports
• Flags high-risk ports (RDP, SMB, Telnet, Redis, MongoDB, etc.) with context
• Generates a styled HTML report saved locally with timestamp

---

Tech Stack

Component	Tools
Language	Python 3
Email Parsing	re (regex), standard library
IOC Lookup	VirusTotal API v3
Network Scanning	python-nmap, Nmap
Packet Crafting	scapy
Reporting	HTML (auto-generated)

---

Setup

1. Clone the repo

git clone https://github.com/vijay94988/security-toolkit.git
cd security-toolkit

2. Install dependencies

pip install -r requirements.txt

3. Add your VirusTotal API key

Open phishing.py and replace:

VT_API_KEY = "YOUR_VT_API_KEY_HERE"

Get a free key at virustotal.com → Sign Up → Profile → API Key

4. Run

python main.py

---

Usage

╔══════════════════════════════════════════╗
║     Security Analysis Toolkit v1.0       ║
║   Phishing Analyzer + Network Scanner    ║
╚══════════════════════════════════════════╝

  [1] Phishing Email Analyzer
  [2] Network Vulnerability Scanner
  [3] Exit

Phishing Analyzer

Path to .eml file: /path/to/email.eml

[+] IPs found:     ['185.220.101.45']
[+] URLs found:    ['http://evil-phishing-site.com/login']
[+] Domains found: ['evil-domain.com']

[*] Checking VirusTotal...

IOC                                           Malicious   Suspicious
----------------------------------------------------------------------
185.220.101.45                                        8            2  ⚠ ALERT
evil-phishing-site.com                                5            1  ⚠ ALERT

Network Scanner

Target IP or range: 192.168.1.0/24

[+] Host: 192.168.1.10

[⚠ RISK] Port 445    microsoft-ds   Windows Server 2019
          → SMB - common ransomware vector
[  OK  ] Port 443    https          nginx 1.18.0
[⚠ RISK] Port 3389   ms-wbt-server  RDP
          → RDP - brute force target

[+] HTML report saved: scan_report_20241105_143022.html

---

Project Structure

security-toolkit/
├── main.py          # Entry point and CLI menu
├── phishing.py      # Email parser and VirusTotal IOC lookup
├── scanner.py       # Nmap-based vulnerability scanner
├── report.py        # HTML report generator
└── requirements.txt

---

⚠️ Disclaimer

This tool is intended for educational purposes and authorized testing only.
Do not run the network scanner against systems you do not own or have explicit permission to scan.

---

Author

Dakamulla Vijay
LinkedIn • GitHub