System Vulnerability Checklist

A Blue Team style Python auditing tool that establishes a system baseline, runs it against a checklist of common vulnerability classes, and produces a risk-ranked threat report — built as Cyber Security Project 4 ("Audited Systems: A Framework for Blue Team Defense").

"A system's integrity is dynamic. The security auditor is the essential gatekeeper for organizational resilience."

What it checks

Step	Area	Checks
1	The Identity Front Door	Password strength (NIST 800-63B), MFA method strength (flags legacy SMS/voice OTP)
2	Software Decay & Patch Management	Pending OS/package updates, staleness of the patch cache, antivirus definitions
3	Unsafe Practices & Exposure	Host firewall status, SSH hardening (root login / password auth), unexpected listening ports, passwordless sudo rules
Output	Threat Reporting	Risk-ranked findings (Critical → Info) + a deduplicated remediation roadmap, exportable as JSON

The tool follows the Input → Process → Output blueprint:

1. Input — establish the baseline (what's installed, what's listening, what's configured).
2. Process — cross-reference the baseline against the checklist.
3. Output — a risk-ranked vulnerability list with a remediation roadmap.

Project structure

system-vulnerability-checklist/
├── main.py                     # CLI entry point
├── checklist/
│   ├── password_check.py       # Step 1: passwords & MFA
│   ├── patch_check.py          # Step 2: patch management
│   ├── user_practices.py       # Step 3: firewall/SSH/ports/sudo
│   └── report.py               # Output: risk-ranked reporting
├── sample_data/
│   └── sample_credentials.txt  # Demo file for the password checker
├── tests/
│   ├── test_password_check.py
│   └── test_report.py
├── reports/                    # Generated JSON reports land here
├── requirements.txt
└── README.md

Requirements

• Python 3.10+
• No third-party packages required to run (standard library only)
• pytest if you want to run the test suite

Installation

git clone https://github.com/<your-username>/system-vulnerability-checklist.git
cd system-vulnerability-checklist
pip install -r requirements.txt   # only needed for running tests

Usage

Run the full checklist (patch + practices checks always run; password checks run if you supply a credentials file):

python main.py full --passwords sample_data/sample_credentials.txt

Save the report as JSON under reports/:

python main.py full --passwords sample_data/sample_credentials.txt --save

Run a single checklist step:

python main.py passwords --passwords sample_data/sample_credentials.txt
python main.py patches
python main.py practices

Example output

========================================================
 SYSTEM VULNERABILITY CHECKLIST — THREAT REPORT
========================================================
 System   : my-laptop
 Platform : Linux-6.8.0-x86_64-with-glibc2.35
 Generated: 2026-07-15T18:20:00+00:00
 Overall Risk: CRITICAL
--------------------------------------------------------
[CRITICAL] password_strength
            - Password appears on a common/breached password list.
[HIGH     ] listening_ports
            - Unexpected open port(s): [8080]. Verify each is an approved, needed service.
...
--------------------------------------------------------
 REMEDIATION ROADMAP (risk-ranked)
 1. [CRITICAL] password_strength: Enforce NIST 800-63B length-based password policy...
 2. [HIGH] listening_ports: Investigate and close/firewall any unapproved listening service.
========================================================

Important notes on the password checker

This tool never reads real account credentials off the machine. It audits a plain-text identifier:password file that you supply — e.g. a password-policy test file or export from a password manager — so it can be run safely without elevated privileges. Do not commit real credentials into sample_data/; the sample file is for demonstration only.

Running tests

pytest

Exit codes

main.py exits with code 2 if the overall risk is CRITICAL (handy for CI pipelines / cron jobs that should alert on regression), and 0 otherwise.

License

MIT — see LICENSE.