NetKit

A local, self-hosted network security and OSINT toolkit. One Flask app, one browser tab, no cloud dependency — everything runs on your own machine against targets you're authorized to test.

This must be cloned and run locally — it is not a hosted web app. NetKit reads Windows registry keys, changes network adapter settings, opens raw sockets, and shells out to nmap/tshark/certbot on the machine it runs on. Deploying it to a remote host (Vercel, a VPS, anything reached over the internet) doesn't just add risk — it silently breaks or neuters most of the toolkit (MAC changer, firewall manager, packet sniffer/capture, ARP scan, IP spoofer, and any tool detection all assume they're touching your machine's local OS and network stack) while exposing local-network attack tooling to the internet. Run it with run.bat on your own machine; don't put it behind a public URL.

Authorized use only. Port scanning, packet capture, ARP/MAC manipulation, IP spoofing, and OSINT lookups can be misused. Only point NetKit at systems, networks, and accounts you own or have explicit permission to test.

What it does

Area	Highlights
Port & service scanning	Banner grabbing, NMAP integration (service/OS detection), TLS & HTTP metadata extraction without decryption
Packet capture & analysis	Live capture and PCAP inspection via tshark — DNS/HTTP/TLS/ARP/ICMP breakdowns, socket & conversation tables, stream reassembly, cleartext credential hints
Certificates	Read any local cert file's metadata (subject, issuer, SANs, expiry, fingerprint); issue/renew Let's Encrypt certs via certbot
Network internals	Socket lab, SSL/TLS inspector, interface list, MAC changer, IP tools, DNS lab, subnet calculator, ARP scan, traceroute/ping, packet sniffer, network optimizer (DNS/MTU)
Monitoring	Live per-interface traffic, process↔socket ownership map, process resource monitor (CPU/RAM/network), Windows Firewall manager
OSINT	Phone intel, IP/domain WHOIS, subdomain recon, breach check, username hunt (Sherlock/Maigret), geo intel, EXIF metadata, DNS recon, email/subdomain harvesting
Investigation	Tamper-evident evidence chain, IP lockout/null-route, VM/emulator detection, proxy & network-policy intelligence, snapshotting
Learn	Built-in learning platform (the LEARN tab) — see below

Every capability above is a plain Flask endpoint under /api/..., driven by a single-page UI in templates/index.html.

The LEARN tab

NetKit ships its own reference material in the UI, not just tools — the LEARN panel is a self-contained networking encyclopedia with five sections:

• OSI Encyclopedia — layer-by-layer breakdown of the OSI model
• Protocol Dictionary — lookup reference for common protocols
• Glossary — networking/security terminology
• Protocol Labs — interactive, hands-on protocol walkthroughs
• Packet Anatomy — visual breakdown of packet structure

It's entirely static/client-side (no /api/* calls) — useful if you want to look something up while a scan or capture is running elsewhere in the UI.

Requirements

• Python 3.11 or 3.12
• Windows — exclusively. NetKit is not cross-platform. It shells out directly to Windows-only commands and APIs throughout server.py: winreg (MAC changer), netsh (Firewall manager, network optimizer, DNS/MTU tools, several others), ipconfig, tracert, systeminfo, and more. Roughly half the panels depend on one of these. Running server.py on Linux or macOS will start the process, but a large fraction of endpoints will error out immediately — this isn't a "degrades gracefully" situation like the optional external tools below, it's core functionality that assumes it's talking to Windows. Porting it would mean rewriting each of those integrations against Linux equivalents (nmcli/ip, iptables/nftables, /proc, etc.) — that hasn't been done.
• Optional external tools, auto-detected at runtime (NetKit degrades gracefully if any are missing):
  • Nmap — service/OS detection scans
  • Wireshark/tshark — packet capture & PCAP analysis
  • certbot — Let's Encrypt certificate issuance/renewal
  • Npcap (Windows) — required by the optional scapy-based ARP scan/packet sniffer/IP spoofer

See requirements.txt for the full pinned Python dependency list.

Linux is not supported

Don't run this on Linux expecting it to work. It won't, for a large fraction of the toolkit. This isn't a theoretical gap — server.py directly invokes Windows-only tooling in the code paths for:

• MAC Changer (winreg registry edits)
• Windows Firewall manager (netsh advfirewall)
• Network Optimizer / DNS & MTU tools (netsh interface, ipconfig)
• Traceroute (tracert, the Windows binary — not traceroute)
• System info (systeminfo)
• Several other places calling netsh/ipconfig for interface and adapter data

The winreg import is guarded (try/except ImportError), so the process itself will start on Linux — but every endpoint that depends on it or on netsh/ipconfig/tracert/systeminfo will fail at request time (command not found, or the guarded import flag being False). certbot, nmap, and tshark themselves are actually easier to install on Linux than Windows — but that doesn't matter if the endpoints wired to them still depend on Windows-only commands elsewhere in the same request path. Treat NetKit as Windows-only; a real Linux port would mean rewriting each Windows-specific integration against its Linux equivalent (nmcli/ip, iptables/nftables, /proc, traceroute), which hasn't been done.

Quick start

run.bat

This creates a .venv, installs requirements.txt, checks for the optional external tools, generates a local self-signed dev TLS cert on first run (certs/, gitignored), and starts the server at https://localhost:8443. Your browser will warn the cert is untrusted on first visit — that's expected for a self-signed local cert; accept/continue to proceed.

Manual setup:

python -m venv .venv
.venv\Scripts\activate      # Windows
pip install -r requirements.txt
python server.py

Configuration

NetKit works with zero configuration. A few optional environment variables tune external-tool behavior:

Variable	Default	Purpose
SECRET_KEY	random per-run	Flask session secret
PORT	8443	HTTPS port the server listens on
TSHARK_PATH	auto-detected	Override the tshark binary location
CAPTURE_SECONDS	10	Default live-capture duration
PACKET_LIMIT	100	Default packet count per capture/read

NetKit serves over HTTPS on port 8443 using a self-signed cert generated on first run (cert_tools.get_or_create_dev_tls_cert()) and cached in certs/ (gitignored — it's a local dev cert, not something to share or commit). This is separate from the Let's Encrypt tooling in the CERTS tab, which issues real certs for domains you control.

Project layout

server.py            Flask app — all /api/* routes, UI serving, HTTPS entry point
nmap_tools.py         Nmap-backed port/TLS/HTTP investigation
wireshark_tools.py    tshark-backed capture & PCAP analysis
cert_tools.py         Local cert parsing, self-signed dev-TLS cert, certbot wrapper
templates/index.html  Single-page UI (vanilla JS, no build step) — includes the LEARN tab
certs/                Auto-generated self-signed dev cert (gitignored)
docs/                 Setup notes, architecture, and design-decision log

Security notes

• No secrets are checked into this repo (see .gitignore); logs, evidence files, and .env files never leave your machine.
• The /api/cert/request and /api/cert/renew endpoints only wrap certbot's own ACME client — NetKit stores no ACME account keys or DNS credentials of its own.
• get_credentials_hint (Wireshark) and similar tools surface cleartext credentials found in captures you already control — for authorized testing/incident response only.