Blue16 Sightline — Microsoft-powered CTEM (Preview)

Your Internet Exposure

Blue16 Sightline
Microsoft-powered CTEM

Your Public IP

—

Locating…

Detecting your public IP…

Add targets on the left to begin →

🕐 Recent Scans

Loading…

⚙️ Quick Setup

Install Python 3.9+: python.org/downloads
Install NMAP: nmap.org/download.html
Run: pip install -r requirements.txt (Flask, nmap wrapper, scheduler, waitress server)
Run as Administrator: python app.py or py app.py
Open http://localhost:5000 — status pill turns green ✅

🔒 Optional environment variables (set before launching): SCANNER_PASS requires a login (HTTP Basic — optionally SCANNER_USER, default admin); SCANNER_PORT changes the port (default 5000). Auth is off by default for local use — enable it (behind TLS) if you expose this beyond localhost.

🔐 Microsoft App Registration (Azure · Entra · Defender)

The Azure, Entra and Defender importers all sign in through one Entra app registration — a single Client ID covers all three. Cloud Apps uses its own API token instead (Defender for Cloud Apps → Settings → Security extensions).

Entra ID → App registrations → New registration; account type Single tenant.
Add a Single-page application (SPA) platform whose Redirect URI is the exact URL you open this app on (e.g. http://localhost:5000 locally, or your https://… domain — it must match the origin exactly; the value is shown in each import tab).
Copy the Application (client) ID into the Client ID field on any of the import tabs.
Under API permissions, add the following as Delegated permissions, then Grant admin consent:
- Azure (public IP discovery): Azure Service Management → user_impersonation
- Entra (Named Locations): Microsoft Graph → Policy.Read.All
- Defender for Endpoint (internet-facing devices + confirmed CVEs): WindowsDefenderATP → Machine.Read + AdvancedQuery.Read + Vulnerability.Read

Running behind a domain? Add that https://… URL as an additional SPA redirect URI (you can register several).

🧩 Optional scan-pipeline components

These are external binaries (not pip packages). When present the scanner extends the pipeline to masscan → nmap → httpx → nuclei; when absent it degrades gracefully to nmap only. Detection runs at startup, so restart app.py after installing.

masscan — fast discovery on CIDR/ranges (then nmap fingerprints only the open ports). Needs Npcap on Windows. github.com/robertdavidgraham/masscan · Linux: sudo apt install masscan
⚠ MDE alert: Microsoft Defender for Endpoint will trigger a security alert when masscan.exe is present or executed. Add an MDE exclusion before deploying on a monitored endpoint.
httpx — after nmap, confirms which open ports are live HTTP/HTTPS and detects the real scheme, title and tech, then feeds clean URLs to nuclei. download a release binary or go install github.com/projectdiscovery/httpx/cmd/httpx@latest.
⚠ MDE alert: Microsoft Defender for Endpoint will trigger a security alert when httpx is executed from most paths. Exception: placing httpx.exe directly in the application root folder (same directory as app.py) suppresses the MDE alert on monitored Windows endpoints.
nuclei — web vulnerability scan after httpx (severity medium/high/critical). download a release binary or go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest. Templates auto-install on first scan.
⚠ MDE alert: Microsoft Defender for Endpoint will trigger a security alert when nuclei.exe is present or executed. Add an MDE exclusion before deploying on a monitored endpoint.
subfinder + dnsx — used by the Domain Enum tab to enumerate a domain's subdomains (passively) and resolve them to IPs you can scan. go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest · go install github.com/projectdiscovery/dnsx/cmd/dnsx@latest

⚠️ These send active traffic to targets (masscan floods ranges; httpx and nuclei send HTTP requests / crafted exploit probes). Only run them against assets you are authorized to test.

⚠️ Legal Disclaimer — Read Before Use