NetSniper - Bash-based network reconnaissance engine with devi

项目说明

NetSniper

Network reconnaissance and exposure-intelligence sensor for authorized security assessments.

NetSniper is a Bash-based network discovery and ser pipeline. It performs local-subnet host discovery, scans a curated set of security-relevant TCP ports, classifies likely device roles, scores exposed services, and writes structured telemetry for downstream tools such as DeltaAegis.

Current Release

Current release: NetSniper v2.1.1 — Bundle Integrity Hotfix

De candidate: NetSniper v2.2.0 — Runtime Isolation and Integration Safety (not yet released)

NetSniper v2.1.1 corrects the v2.1 bundle-finalization sequence so
bundle_quality.json is recorded as a required, size-bound, SHA-256-bound
artifact before a telemetry bundle is published. The release preserves the
v2.1 classification contracts, CLI/headless architecture, v2.0 telemetry
compatibility, and v1.9 scan-profile behavior.

v2.2.0 De Candidate

NetSniper v2.2.0 is a compatibility-preserving reliability update. It adds private per-run workspaces, exact RFC1918 and host containment checks, atomic bundle publication, safe optional e handling, full-profile duration accounting, dependency , and defensi/Greenbone handling. The netsniper-run-v3, capability-manifest v1, and host-classification v2 contracts remain unchanged for DeltaAegis compatibility.

v2.1.1 Highlights

v2.1.0 Highlights

Bundle Artifacts

Finalized NetSniper v2.0 run bundles can include:

analysis.json
analysis.enriched.json
bundle_quality.json
classification_quality.json
classification_quality.md
manifest.json
os_detection.xml / os_detection.gnmap / os_detection.nmap
udp_lite.xml / udp_lite.gnmap / udp_lite.nmap

analysis.json remains the compatibility artifact. OS and UDP-lite e are archived as
separate artifacts when produced by the accurate profile; they should be treated as supporting
e, not standalone device identity.

bundle_quality.json tells downstream tools whether the bundle is safe to ingest. DeltaAegis
should treat deltaaegis_ready: false as a rejection or quarantine condition, not as valid telemetry.

Classification Philosophy

NetSniper v2.1.1 remains intentionally conser.

A weak or generic service should remain possible or re instead of becoming a
confident but unreliable classification. The goal is to produce explainable network intelligence
for review, not pretend that every open port pro identity.

Recommended

For focused classifier de and pre-commit review, run:

./tools/ll.sh
python3 tools/tadata.py

Review the exact release-finalization diff before requesting approval to stage and
commit it. After separate approval to stage and commit, run the authoritative
release gate from the clean committed feature branch:

./tools/te.sh

Rerun the same clean-tree gate after an appro and before creating or
moving the v2.1.1 tag or publishing the GitHub Release.

The v2.1 release gate checks:

Features

Requirements

Install required packages:

sudo apt update
sudo apt install -y nmap jq coreutils

Optional Greenbone integration requires a configured G and g.

Installation

Clone and install:

git clone
cd NetSniper
chmod +x install.sh
./install.sh

Usage

After installation, run:

netsniper

Or run from the repository:

./netsniper.sh

Pipeline

Discovery
↓
Curated service scan
↓
Rele extraction
↓
Exposure analysis
↓
Bundle finalization
↓
v1.7 enrichment and quality artifacts
↓
Immutable DeltaAegis telemetry bundle

Runtime Outputs

Runtime output is intentionally excluded from Git.

~/NetSniper/
├── discovery/ # latest discovery e
├── scans/ # latest ser e
├── targets/ # latest analysis files
├── reports/ # generated reports
├── runs/ # immutable DeltaAegis telemetry bundles
└── config/ # local runtime configuration

A finalized runs/<scan_id>/manifest.json file marks a telemetry bundle as ready for downstream ingestion.

DeltaAegis Telemetry Contract

Current immutable bundles use:

netsniper-run-v3

The v3 manifest records:

Compatibility aliases from netsniper-run-v2 are intentionally preserved for downstream migration.

See docs/CT.md.

Changelog

See CHANGELOG.md for full release history.

Scope and Limitations

NetSniper is a focused sensor, not a full SIEM and not an exploit framework.

It reports obser from its configured TCP profile. It does not claim to scan every possible TCP or UDP port, and it does not perform exploit checks or aggressi probing.

Authorized Use Only

NetSniper is provided for educational use and authorized security testing. Use it only on systems and networks for which you ha permission.

License

MIT License. See LICENSE.

项目信息

开发语言：Shell

Star 数：3

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Bash-based network reconnaissance engine with device fingerprinting, exposure scoring, structured JSON output, and optional Greenbone integration.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。