⚙️ Quick Setup
- Install Python 3.9+: python.org/downloads
- Install NMAP: nmap.org/download.html
- Run:
pip install -r requirements.txt (Flask, nmap wrapper, scheduler, waitress server)
- Run as Administrator:
python app.py or py app.py
- Open http://localhost:5000 — status pill turns green ✅
🔒 Optional environment variables (set before launching):
SCANNER_PASS requires a login
(HTTP Basic — optionally SCANNER_USER, default admin);
SCANNER_PORT changes the port (default 5000).
Auth is off by default for local use — enable it (behind TLS) if you expose this beyond localhost.
🔐 Microsoft App Registration (Azure · Entra · Defender · EASM)
The Azure, Entra, Defender and EASM importers all sign in through
one Entra app registration — a single Client ID covers all four.
Cloud Apps uses its own API token instead (Defender for Cloud Apps → Settings → Security extensions).
EASM additionally needs each user to hold a role on the workspace itself: the app registration
grants the API, Azure RBAC grants the data.
- Entra ID → App registrations → New registration; account type Single tenant.
- Add a Single-page application (SPA) platform whose Redirect URI is the exact URL you open this app on
(e.g.
http://localhost:5000 locally, or your
https://… domain — it must match the origin exactly; the value is shown in each import tab).
- Copy the Application (client) ID into the Client ID field on any of the import tabs.
- Under API permissions, add the following as Delegated permissions, then Grant admin consent:
- Azure (public IP discovery):
Azure Service Management → user_impersonation
- Entra (Named Locations):
Microsoft Graph → Policy.Read.All
- Defender for Endpoint (internet-facing devices + confirmed CVEs):
WindowsDefenderATP → Machine.Read + AdvancedQuery.Read + Vulnerability.Read
- Azure App Service (web app hostnames): no extra permission — same
Azure Service Management → user_impersonation as Azure, read through Resource Graph.
- Azure Arc (servers outside Azure): no extra permission — it reads through the same
Azure Service Management → user_impersonation as Azure, via Resource Graph. Reader on the subscriptions holding the Arc resources is enough.
- Defender EASM (externally discovered addresses):
EASM API → AssetResource.Read.All + Workspace.Read.All — optional: these are requested by resource URI at sign-in and consented dynamically, so the import works without them being listed here. Add them if you want the permission pre-consented and visible. They live under APIs my organization uses, not Microsoft APIs; if that filter returns nothing, let the list finish loading before typing, or copy the requiredResourceAccess entry for b7faa489-a4c8-4b39-bb0c-842c3de2de6a from a working app's Manifest. Workspace discovery reuses the Azure Service Management permission above.
- Defender EASM — the part that is not optional: each user needs an Azure role on the
Microsoft.Easm/workspaces resource. Without it every call returns 403 while the app registration looks entirely correct, because the failure is not in Entra at all.
- Defender for Cloud Apps (corporate IP ranges):
Microsoft Cloud App Security → Settings.read (shown as "Microsoft Cloud App Security" in the API picker; also needs the tenant portal URL)
- Entra roles (highest role on the device card · optional):
Microsoft Threat Protection → AdvancedHunting.Read (resolve the identity) + Microsoft Graph → RoleManagement.Read.Directory (active + PIM-eligible roles)
Running behind a domain? Add that https://… URL as an additional SPA redirect URI (you can register several).
🧩 Optional scan-pipeline components
These are external binaries (not pip packages). When present the scanner extends the pipeline
to masscan → nmap → httpx → nuclei; when absent it degrades gracefully to nmap only.
Detection runs at startup, so restart app.py after installing.
- masscan — fast discovery on CIDR/ranges (then nmap fingerprints only the
open ports). Needs Npcap on Windows.
github.com/robertdavidgraham/masscan
· Linux:
sudo apt install masscan
⚠ MDE alert: Microsoft Defender for Endpoint will trigger a security alert when masscan.exe is present or executed. Add an MDE exclusion before deploying on a monitored endpoint.
- httpx — after nmap, confirms which open ports are live HTTP/HTTPS and detects
the real scheme, title and tech, then feeds clean URLs to nuclei.
download a release binary
or
go install github.com/projectdiscovery/httpx/cmd/httpx@latest.
⚠ MDE alert: Microsoft Defender for Endpoint will trigger a security alert when httpx is executed from most paths. Exception: placing httpx.exe directly in the application root folder (same directory as app.py) suppresses the MDE alert on monitored Windows endpoints.
- nuclei — web vulnerability scan after httpx (severity medium/high/critical).
download a release binary
or
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest.
Templates auto-install on first scan.
⚠ MDE alert: Microsoft Defender for Endpoint will trigger a security alert when nuclei.exe is present or executed. Add an MDE exclusion before deploying on a monitored endpoint.
- subfinder + dnsx — used by the Domain Enum tab to enumerate a domain's
subdomains (passively) and resolve them to IPs you can scan.
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
· go install github.com/projectdiscovery/dnsx/cmd/dnsx@latest
⚠️ These send active traffic to targets (masscan floods ranges; httpx and nuclei
send HTTP requests / crafted exploit probes). Only run them against assets you are authorized to test.
