evidence-v7
External & SMB Security Posture, Backed by Recorded Evidence.
SMB Scanner Lite is an evidence-first external security assessment tool designed for small and medium businesses. It audits 22 critical security controls across DNS, E-mail Authentication (SPF/DKIM/DMARC), TLS Encryption, Web Security Headers, and Network/SMB (TCP 445) Exposure — turning complex technical telemetry into clear, verifiable reports.
✨ Click any sample target in the simulator below to watch the posture score ring and category bars animate in real time.
What Does SMB Scanner Lite Do? (For Non-Tech & Tech Readers)
Whether you own a small business or study cybersecurity, here is exactly what this project checks and why it matters.
Email Anti-Spoofing (SPF, DKIM & DMARC)
In plain English: Stops scammers from sending fake emails pretending to be your company.
Under the hood: Evaluates RFC 7208 check_host() SPF rules, DMARC enforcement (p=reject), and DKIM cryptographic RSA/Ed25519 key lengths.
Domain & DNS Integrity (DNSSEC, CAA, AXFR)
In plain English: Ensures attackers cannot tamper with your domain's address book or steal your full list of internal subdomains.
Under the hood: Locally recomputes RFC 4034 DS ↔ DNSKEY digests, tests zone-transfer restrictions, and checks 16 subdomain takeover signatures.
Website Encryption & Browser Safety (TLS & Headers)
In plain English: Confirms your website uses modern encryption and tells visitors' browsers to block malicious scripts and framing.
Under the hood: Probes TLS 1.0–1.3 support, certificate SAN/expiry, HSTS, CSP, X-Frame-Options, Cookies, and CORS reflection.
Office File-Sharing (SMB Port 445) & Port Hygiene
In plain English: Checks if internal Windows file-sharing (SMB), Remote Desktop (RDP), or databases are accidentally open to the public internet.
Under the hood: Performs safe protocol handshakes (including MS-SMB2 NEGOTIATE dialect & signing inspection) with anycast canary filtering.
No Claim Without Recorded Evidence
In plain English: Never cries wolf. If your internet connection hiccups during a check, it won't falsely claim your security failed.
Under the hood: Distinguishes NXDOMAIN/NODATA from TIMEOUT and marks unreachable checks INCONCLUSIVE.
Client-Ready Deliverables (HTML, JSON, CSV, TXT)
In plain English: Generates a clean report you can hand to management or your IT provider.
Under the hood: Accounts for all 22 controls in CONTROL_CATALOG and supports longitudinal history diffing (--compare auto).
Live Simulated Assessment Report Browser
Switch between three sample small-business assessments below, filter by outcome, and click any finding row to inspect the recorded technical evidence and remediation guidance.
| Status | Control | Category | Severity | Asset | Recorded Evidence Summary |
|---|
22 Weighted Security Controls Across 5 Categories
Every control is weighted by real-world security impact under scoring model evidence-v7.
1. DNS Integrity (6 Controls)
dns-resolution (6) · dnssec-chain (16) · caa (8) · axfr (16) · open-resolver (10) · takeover (14)
2. E-mail Authentication (4 Controls)
spf (14) · dmarc (16) · dkim (12, ASN.1 DER RSA/Ed25519 key size verification) · mx-posture (6, incl. RFC 7505 Null MX)
3. Transport Security (2 Controls)
tls (18, per-version TLS 1.0–1.3 probing, SAN coverage, expiry & key strength) · https-redirect (10, first-hop HTTP→HTTPS check)
4. Web Security Headers (9 Controls)
hsts (12) · csp (14) · clickjacking (8) · nosniff (6) · cookie-security (8) · cors (8) · referrer-policy (4) · permissions-policy (4) · info-disclosure (4)
5. Network & SMB Exposure (1 Control, 23 Ports)
port-hygiene (18) — Protocol-verified handshakes for SMB2/3 Negotiate (445), RDP (3389), MySQL (3306), PostgreSQL (5432), Redis (6379), Elasticsearch (9200), Memcached, SSH, FTP, and Telnet.
Scope & Safety Locks
Built-in --allowlist, --blocklist, private-IP CIDR opt-in, and same-registrable-domain redirect boundaries ensure assessments stay strictly in scope.
Download SMB Scanner Lite
Ready to download and test the tool locally? Review our security & misuse-prevention notice below and sign the User Consent Agreement to unlock the public build.
Public Downloads Are Provided as a Protected Private Sandbox
This portal documents the complete SMB Scanner Lite v5.2.0 project. However, to prevent strangers from misusing the tool to scan unauthorized websites or businesses, the public GitHub download is protected as follows:
- Private Full Source Code: The complete internal source code of the project is stored privately and is not exposed in the public repository.
- Limited to 5 Public Testing Websites: When you clone or download the repository, the tool runs in a Private Sandbox Mode limited strictly to 5 publicly free-to-use testing domains (
example.com,example.org,example.net,scanme.nmap.org, andbadssl.com). - Mandatory User Consent Proof: Before any scan runs, the user must accept the Privacy Policy & User Consent Agreement, recording a tamper-evident SHA-256 Consent Proof Receipt (
CONSENT-YYYYMMDD-XXXXXXXX).