Automated Reconnaissance Pipeline & Web UI
Engineered an automated offensive reconnaissance tool designed to map external organization attack surfaces in a single unified workflow. Chained industry-standard CLI security tools (Subfinder for passive certificate-based subdomain enumeration, HTTPX for live host probing, Nmap for active port discovery, and WHOIS domain registry lookups) through an asynchronous Python FastAPI backend. Implemented defensive secure coding standards: strict domain regex validation via Pydantic field validators, client rate limiting via slowapi (enforcing 3 scans/minute per IP with HTTP 429 response handling), parameterized subprocess calls eliminating shell injection risks, and SQLite scan history caching. Built an interactive two-column React and Tailwind CSS dashboard featuring 4 tabbed modal views, port inspection cards, and historical scan review.
Benchmarked against high-profile targets including Tesla (~917 subdomains and 195 live hosts) and Intigriti, resolved DNS latency bottlenecks via static NetworkManager configuration to achieve 2.5s scan times per host, and enforced strict rate limiting and domain regex validation.
Key Metrics & Measurable Impact
Empirical benchmarks and discovery telemetry gathered across multi-tool reconnaissance pipelines and rate-limited API endpoints.
Automated orchestration: Subfinder -> HTTPX -> Nmap -> WHOIS in single workflow
Verified live against tesla.com (917 subdomains, 195 live hosts) and hackerone.com
Eliminated DNS resolution latency via static 8.8.8.8 configuration in NetworkManager
Enforced IP-based rate limiting via slowapi returning HTTP 429 upon threshold breach
FastAPI routing for health checks, automated multi-tool scans, and SQLite historical recall
40 completed milestones, 1 in progress, 9 planned for async worker polling
Work Artifacts & Key Evidence
Selected technical screenshots and logs. Use the side arrows to scroll or click any card to inspect.
Integrated Multi-Tool API Response
Unified /scan API endpoint response consolidating Subfinder, HTTPX, Nmap, and WHOIS outputs in a single execution pipeline.
SQLite Scan History Persistence
Direct SQLite query validation confirming persistent historical storage of target reconnaissance telemetry.
Rate Limit Enforcement (HTTP 429)
API rate limiting verification: triggered HTTP 429 'Rate limit exceeded: 3 per 1 minute' via consecutive curl requests.
Live Attack Surface Results in UI
Live frontend discovery rendering: real-time attack surface results populated smoothly across UI tabs following CORS resolution.
Two-Column Reconnaissance Dashboard
Production-ready dual-column UI layout integrating interactive target submission form, live scanning state, and historical scan logs.
Investigation Timeline
Pipeline Chaining & Subprocess Architecture
Constructed Python subprocess pipeline chaining Subfinder passive enumeration into HTTPX live probing, followed by targeted Nmap open port scanning (-F --open) and WHOIS domain queries.
Secure Coding: Domain Regex & SlowAPI Throttling
Enforced strict defensive standards: domain regex validation via Pydantic field validators, parameterized command execution to prevent shell injection, and rate limiting (3 requests/min per IP) via slowapi.
DNS Latency Triage & VirtualBox Performance Optimization
Triaged severe Nmap scanning delays caused by VirtualBox NAT DNS lookup stalls. Configured static Google DNS (8.8.8.8) in NetworkManager, reducing per-host active scan latency from indefinite hangs to 2.5 seconds.
Interactive Two-Column Dashboard & Historical Storage
Engineered React interface featuring 4 tabbed modal views (Subdomains, Live Hosts, Nmap Cards, and WHOIS) backed by SQLite scan persistence via SQLAlchemy.
Implementation Phases & Checklist
- ✓Provision Ubuntu Desktop 24.04 VM (8 GB RAM, 4 vCPUs, 40 GB storage)
- ✓Establish repository directory layout (backend, frontend, docs)
- ✓Configure Python 3.12 virtual environment and dependencies
- ✓Install Go runtime 1.22.2 and Node.js 20 runtime via NVM
- ✓Configure permanent static Google DNS (8.8.8.8) via nmcli on netplan-enp0s3
- ✓Configure VS Code Remote-SSH connectivity from Windows host
- ✓Install security tools: Subfinder, HTTPX, Nmap, WHOIS, and SQLite3
- ✓Scaffold FastAPI application with Uvicorn development server
- ✓Implement GET / health check endpoint
- ✓Integrate Subfinder passive subdomain enumeration via subprocess
- ✓Integrate HTTPX live probing via stdin input streaming
- ✓Integrate Nmap active port discovery (restricted to 10 hosts, --open -F)
- ✓Integrate WHOIS domain registration lookup for root target
- ✓Configure SQLite database and SQLAlchemy scan_results schema
- ✓Implement GET /history endpoint retrieving 10 most recent scans
- ✓Configure CORS middleware restricting origins to local frontend
- ✓Implement strict domain regex validation via Pydantic field validators
- ✓Enforce API rate limiting (3 requests/min per IP) via slowapi with HTTP 429 handling
- ✓Clean debug outputs and generate pinned requirements.txt
- ✓Initialize React application with Vite build tooling and Tailwind CSS
- ✓Build target domain submission form with active scanning states
- ✓Design fixed-size 4-tab results modal (Subdomains, Live Hosts, Nmap, WHOIS)
- ✓Implement Nmap host service cards with interactive port detail popups
- ✓Implement WHOIS summary parser (registrar, dates, nameservers, status)
- ✓Segregate live hosts into HTTPS and HTTP categories
- ✓Implement historical scan viewer fetching past telemetry from /history
- ✓Design responsive two-column layout (documentation left, scanner right)
- ✓Implement client-side error handling for HTTP 429 and 422 validation states
- ✓Execute manual CLI validation across all 4 underlying security tools
- ✓Validate API contracts via Swagger UI documentation (/docs)
- ✓Perform end-to-end integration testing from React frontend
- ✓Verify rate limit enforcement: confirm 4th consecutive request receives HTTP 429
- ○Execute boundary tests with invalid domain inputs and special characters
- ○Evaluate Nmap service version detection (-sV -sC) in high-throughput network
- ◐Compile repository README with architectural overview and usage instructions
↳ Draft complete, finalizing repository push
- ○Document domain regex security design and validation rationale
- ○Produce walkthrough demonstration recording
- ○Design asynchronous background task queue with status polling for extended scans
Documentation & Technical Reports
This tool was developed strictly for authorized offensive security assessments, educational reconnaissance research, and professional portfolio demonstration. Scanning targets without prior written authorization is illegal. All demonstration benchmarks were executed against approved public bug bounty programs adhering to platform rules of engagement.