Skip to content

Instantly share code, notes, and snippets.

@bryanseah234
Created October 3, 2026 10:45
Show Gist options
  • Select an option

  • Save bryanseah234/3df639813acb938c4f3d21e7df28dd5d to your computer and use it in GitHub Desktop.

Select an option

Save bryanseah234/3df639813acb938c4f3d21e7df28dd5d to your computer and use it in GitHub Desktop.
network-scan2020-code (Python network scanning utility using scapy)
import argparsefrom scapy.all import *def arp_scan(ip): """ Performs a network scan by sending ARP requests to an IP address or a range of IP addresses. Args: ip (str): An IP address or IP address range to scan. For example: - 192.168.1.1 to scan a single IP address - 192.168.1.1/24 to scan a range of IP addresses. Returns: A list of dictionaries mapping IP addresses to MAC addresses. For example: [ {'IP': '192.168.2.1', 'MAC': 'c4:93:d9:8b:3e:5a'} ] """ request = Ether(dst="ff:ff:ff:ff:ff:ff") / ARP(pdst=ip) ans, unans = srp(request, timeout=2, retry=1) result = [] for sent, received in ans: result.append({'IP': received.psrc, 'MAC': received.hwsrc}) return resultdef tcp_scan(ip, ports): """ Performs a TCP scan by sending SYN packets to <ports>. Args: ip (str): An IP address or hostname to target. ports (list or tuple of int): A list or tuple of ports to scan. Returns: A list of ports that are open. """ try: syn = IP(dst=ip) / TCP(dport=ports, flags="S") except socket.gaierror: raise ValueError('Hostname {} could not be resolved.'.format(ip)) ans, unans = sr(syn, timeout=2, retry=1) result = [] for sent, received in ans: if received[TCP].flags == "SA": result.append(received[TCP].sport) return resultdef main(): parser = argparse.ArgumentParser() subparsers = parser.add_subparsers( dest="command", help="Command to perform.", required=True ) arp_subparser = subparsers.add_parser( 'ARP', help='Perform a network scan using ARP requests.' ) arp_subparser.add_argument( 'IP', help='An IP address (e.g. 192.168.1.1) or address range (e.g. 192.168.1.1/24) to scan.' ) tcp_subparser = subparsers.add_parser( 'TCP', help='Perform a TCP scan using SYN packets.' ) tcp_subparser.add_argument('IP', help='An IP address or hostname to target.') tcp_subparser.add_argument( 'ports', nargs='+', type=int, help='Ports to scan, delimited by spaces. When --range is specified, scan a range of ports. Otherwise, scan individual ports.' ) tcp_subparser.add_argument( '--range', action='store_true', help='Specify a range of ports. When this option is specified, <ports> should be given as <low_port> <high_port>.' ) args = parser.parse_args() if args.command == 'ARP': result = arp_scan(args.IP) for mapping in result: print('{} ==> {}'.format(mapping['IP'], mapping['MAC'])) elif args.command == 'TCP': if args.range: ports = tuple(args.ports) else: ports = args.ports try: result = tcp_scan(args.IP, ports) except ValueError as error: print(error) exit(1) for port in result: print('Port {} is open.'.format(port))if __name__ == '__main__': main()

Repository StandardsThis document is the authoritative list of standards every repository in thisworkspace is expected to follow. New repositories created fromtheprawntemplate inherit the baseline automatically; this file records whatthat baseline is, what is required vs. optional, and the packaging pattern forcontainer repositories.It exists so that humans and automation agents working across the fleet have asingle source of truth to conform to, rather than relying on implicitper-repository conventions.Last reviewed: 2026-09-27.## ScopeApplies to all owned repositories (currently 79: 71 non-container, 7 container,plus one history-managed repository). "Container repository" means a repositorythat builds and publishes one or more container images to GitHub ContainerRegistry (GHCR, ghcr.io).## 1. Security scanning (REQUIRED for every repo)Every repository must carry these GitHub Actions workflows. They are present intheprawntemplate and propagate to new repositories:| Workflow | File | Purpose || --- | --- | --- || CodeQL | .github/workflows/codeql.yml | Static analysis / code scanning || Semgrep | .github/workflows/semgrep.yml | Pattern-based SAST || TruffleHog | .github/workflows/trufflehog.yml | Secret scanning || Dependency Review | .github/workflows/dependency-review.yml | Blocks vulnerable dependency changes in PRs || Scorecard | .github/workflows/scorecard.yml | OpenSSF supply-chain posture || LFS Guard | .github/workflows/lfs-guard.yml | Blocks accidental large/binary commits |A repository is security-compliant when all six are present and enabled.## 2. Automation and CI (REQUIRED)- .github/workflows/ci.yml — project checks; adapt commands to the stack.- .github/dependabot.yml + .github/workflows/dependabot-auto-merge.yml and .github/workflows/auto-merge-bots.yml — dependency updates with guarded auto-merge.- .github/workflows/labeler.yml, greetings.yml, heartbeat.yml, summary.yml — repository hygiene and activity signals.- .github/workflows/deploy.yml — deployment (or a clear statement that the repo is not deployed).## 3. Governance and hygiene files (REQUIRED unless noted)| File | Requirement || --- | --- || LICENSE | Required — Apache-2.0. || NOTICE | Required — accompanies Apache-2.0. || SECURITY.md | Required. Use GitHub private "Report a vulnerability"; never a personal email. || CONTRIBUTING.md | Required. || AGENTS.md | Required — instructions for automation agents. || .github/dependabot.yml | Required. || .env.example | Required only when the project reads environment variables. Repos with no env config legitimately omit it. || .github/ISSUE_TEMPLATE/*, .github/pull_request_template.md | Required. || .gitignore, .gitattributes | Required. |## 4. Privacy and portability rules (REQUIRED)These reflect the fleet-wide remediation sweep and must hold for every repo:- No secrets in git. Use environment variables and .env.example. TruffleHog enforces this in CI; do not defeat it.- No personal contact details or private operator references in tracked files (READMEs, SECURITY.md, configs, .agents/). Vulnerability reporting goes through GitHub's private channel, not a personal email.- Windows/Linux portability. Launchers and paths must work on both; avoid hardcoded absolute paths and OS-specific-only launch scripts where a portable equivalent exists.- .agents/ hygiene. Never write secrets or personal details into .agents/STATE.md or .agents/JOURNAL.md.- PRs over direct commits to main. Changes land through reviewed pull requests.## 5. Container / GHCR packaging (REQUIRED for container repos; OPT-IN for others)Container repositories publish images to ghcr.io/<owner>/<repo>/<component>.The standard packaging pattern — verified present in all seven current containerrepositories (musicstream, facetracker, FORGE, unifiedcollector, unifiedanalyzer,ticketremaster-b, ctfsolver) — is:| File | Purpose || --- | --- || .github/workflows/docker-publish.yml | Builds and pushes image(s) to GHCR on the release trigger. || .github/scripts/ghcr-retention.cjs | Prunes old GHCR package versions to control storage. || Dockerfile (and variants) | Image build definition(s). |Opt-in scaffolding for these files lives under.github/optional/ so a new repository can adopt thepackaging pattern by copying them into place rather than hand-rolling each time.See .github/optional/README.md for enable steps.Package visibility: package visibility (private vs public) is governed by theorganization's package-creation policy (Org Settings → Packages). Individualcontainer package visibility is a deliberate, per-package decision — especiallyfor privacy-sensitive images (photo/OSINT/security tooling) whose layers becomeworld-pullable when public.## 6. Compliance statusA live compliance matrix across all owned repositories is maintained out-of-band(see repo-standards-compliance-matrix.md in the workspace release artifacts).As of the last review, 76/79 repositories carry the full security-workflow set;the known exceptions are actively-developed repositories that have not yetadopted the baseline. All seven container repositories carry the complete GHCRpipeline.## How to use this document- Creating a new repo: start from theprawntemplate; you inherit sections 1–4 automatically. If it will publish containers, adopt section 5 from .github/optional/.- Auditing an existing repo: check it against sections 1–4 (all repos) and section 5 (container repos). Missing required items are compliance gaps to fix via a reviewed PR.- Agents: treat this file as the conformance target for any repository work.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment