netscraper 0.1.0__py3-none-any.whl

netscraper/core/cors_parser.py

@@ -0,0 +1,45 @@
+"""
+Parses a real `curl -i` response for the CORS check: pulls out
+Access-Control-Allow-Origin / Access-Control-Allow-Credentials and decides
+whether the server reflected our deliberately bogus Origin (see
+cors_runner.EVIL_ORIGIN) back verbatim. That's the one signal this check is
+judged on -- a static "*" wildcard, a different real allow-listed origin,
+or no CORS header at all are all left as NOT reflected, so none of them
+gets misclassified as a reflection vulnerability.
+"""
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from typing import Optional
+
+_ACAO_RE = re.compile(r"^Access-Control-Allow-Origin:\s*(.+?)\s*$", re.IGNORECASE | re.MULTILINE)
+_ACAC_RE = re.compile(r"^Access-Control-Allow-Credentials:\s*(.+?)\s*$", re.IGNORECASE | re.MULTILINE)
+
+
+@dataclass
+class CorsResult:
+    host: str
+    port: int
+    raw_text: str
+    origin_sent: str
+    acao: Optional[str] = None
+    acac: Optional[str] = None
+    reflected: bool = False
+
+
+def parse_cors_text(raw_text: str, host: str, port: int, origin_sent: str) -> CorsResult:
+    acao_match = _ACAO_RE.search(raw_text)
+    acac_match = _ACAC_RE.search(raw_text)
+    acao = acao_match.group(1).strip() if acao_match else None
+    acac = acac_match.group(1).strip() if acac_match else None
+
+    # An exact echo of the Origin we sent (ignoring a trailing slash / case)
+    # is what proves dynamic reflection -- a static "*" wildcard, or any
+    # other real value, doesn't match and is correctly left as Safe.
+    reflected = bool(acao) and acao.rstrip("/").lower() == origin_sent.rstrip("/").lower()
+
+    return CorsResult(
+        host=host, port=port, raw_text=raw_text, origin_sent=origin_sent,
+        acao=acao, acac=acac, reflected=reflected,
+    )

netscraper/core/cors_rules.py

@@ -0,0 +1,71 @@
+"""
+Rule engine for the CORS check: exactly one deterministic rule -- did the
+server reflect our deliberately bogus Origin (https://evil.com by default,
+see cors_runner.EVIL_ORIGIN) back verbatim in its own
+Access-Control-Allow-Origin response header? A static "*" wildcard, a
+different real allow-listed origin, or no CORS header at all are all Safe
+-- only an exact echo of the attacker-controlled value we sent proves the
+server isn't validating Origin against a real allow-list, which is exactly
+what cors_parser.py's `reflected` flag already captures.
+
+No manual-verification bucket here -- like Host Header Injection / XST,
+this is a binary yes/no read of the server's own real response, nothing
+fuzzy to ask a human to confirm. No POC screenshot is ever rendered for
+this check either (see cli.py's render_poc=False for the cors family) --
+instead, the evidence below always includes the exact curl command a
+tester can re-run against the real host to build their own manual PoC.
+"""
+from __future__ import annotations
+
+from typing import List, Tuple
+
+from netscraper.core.rules import Finding
+from netscraper.core.cors_parser import CorsResult
+
+
+def evaluate(result: CorsResult) -> Tuple[List[Finding], List[Finding]]:
+    if not result.reflected:
+        return [], []
+
+    creds = (result.acac or "").strip().lower() == "true"
+    scheme = "https" if result.port in (443, 8443, 9443) else "http"
+    poc_cmd = f'curl -sS -i -H "Origin: {result.origin_sent}" {scheme}://{result.host}:{result.port}/'
+
+    if creds:
+        impact = (
+            "including credentialed requests (cookies/session), since Access-Control-Allow-Credentials "
+            "is also true -- an attacker-controlled page can make a victim's browser send authenticated "
+            "requests here and read the response back. This is a critical, often account-takeover-class "
+            "CORS misconfiguration."
+        )
+    else:
+        impact = (
+            "for non-credentialed requests (Access-Control-Allow-Credentials wasn't also true, so "
+            "cookie/session-authenticated responses aren't included in what a cross-origin page can "
+            "read) -- still a real misconfiguration worth fixing."
+        )
+
+    finding = Finding(
+        rule_id="cors_origin_reflection",
+        label="CORS Misconfiguration -- Arbitrary Origin Reflected",
+        folder_name="CORS_Misconfiguration",
+        severity="high" if creds else "medium",
+        evidence_lines=[
+            f"Host: {result.host}:{result.port}",
+            f"Origin sent: {result.origin_sent}",
+            f"Access-Control-Allow-Origin returned: {result.acao}",
+            f"Access-Control-Allow-Credentials returned: {result.acac or '(not present)'}",
+            "",
+            f"--> The server reflects an arbitrary, attacker-controlled Origin back verbatim instead "
+            f"of validating it against a real allow-list, {impact}",
+            "",
+            "Manual verification / PoC (run this against the real host yourself to confirm and capture "
+            "your own screenshot for the report if you need one):",
+            f"  {poc_cmd}",
+        ],
+        # No POC screenshot is ever rendered for this check -- the curl
+        # command above, already filled in with the real host/port, is the
+        # PoC a tester runs by hand.
+        highlight_regex=None,
+    )
+    return [finding], []

netscraper/core/cors_runner.py

@@ -0,0 +1,100 @@
+"""
+Runs a real `curl` request against a target with a deliberately
+attacker-style Origin header (see EVIL_ORIGIN below) and captures the raw
+response headers. The CORS check itself is judged entirely on whether the
+server's own Access-Control-Allow-Origin response header reflects that
+exact value back (see cors_parser.py / cors_rules.py) -- this module's only
+job is to make the real request and hand back the real response, untouched.
+
+Like DIRSEARCH, CORS has no fixed port -- the user chooses it (single or
+comma-separated) when selecting this mode; by the time a Target reaches
+this module, target.port is already one concrete, real port to probe.
+"""
+from __future__ import annotations
+
+import shutil
+import subprocess
+from pathlib import Path
+from typing import List, Optional, Tuple
+
+from netscraper.core.targets import Target
+
+# Sent as the request's Origin header on every probe. It's a domain that
+# could never legitimately sit on any real allow-list, so the server
+# reflecting it back verbatim in Access-Control-Allow-Origin proves it
+# isn't validating Origin against a real allow-list at all -- it's just
+# echoing whatever it was sent.
+EVIL_ORIGIN = "https://evil.com"
+
+# Same http-vs-https heuristic used by the DIRSEARCH check (see
+# dirsearch_runner.py) -- there's no cheap way to know for sure without a
+# real TLS handshake first, but this matches the overwhelming majority of
+# real-world setups; a wrong guess just fails to connect (an ERROR row,
+# never a false "vulnerable" result).
+_HTTPS_PORTS = {443, 8443, 9443}
+
+
+class CurlNotFound(RuntimeError):
+    pass
+
+
+class CorsScanError(RuntimeError):
+    def __init__(self, target: Target, message: str):
+        super().__init__(message)
+        self.target = target
+
+
+def scheme_for(target: Target) -> str:
+    return "https" if target.port in _HTTPS_PORTS else "http"
+
+
+def _command_parts(target: Target, timeout: int) -> List[str]:
+    url = f"{scheme_for(target)}://{target.host}:{target.port}/"
+    return [
+        "curl", "-sS", "-i", "--max-time", str(timeout),
+        "-H", f"Origin: {EVIL_ORIGIN}",
+        url,
+    ]
+
+
+def command_display(target: Target, timeout: int) -> str:
+    """The exact command shown in evidence -- same string whether this ran
+    live or is being replayed, and usable directly as a manual PoC."""
+    return " ".join(_command_parts(target, timeout))
+
+
+def _require(binary: str) -> str:
+    path = shutil.which(binary)
+    if not path:
+        raise CurlNotFound(f"'{binary}' is not installed or not on PATH.")
+    return path
+
+
+def run_live_text(target: Target, timeout: int = 15) -> str:
+    binary = _require("curl")
+    cmd = _command_parts(target, timeout)
+    cmd[0] = binary
+    try:
+        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
+    except subprocess.TimeoutExpired as exc:
+        raise CorsScanError(target, f"curl timed out after {timeout}s") from exc
+    text = (proc.stdout or "") + (proc.stderr or "")
+    if not text.strip():
+        raise CorsScanError(target, "curl produced no output")
+    return text
+
+
+def run_replay_text(target: Target, xml_dir: str) -> str:
+    candidate = Path(xml_dir) / f"{target.label}_cors.txt"
+    if not candidate.exists():
+        candidate = Path(xml_dir) / f"{target.host}_cors.txt"
+    if not candidate.exists():
+        raise CorsScanError(target, f"No captured CORS probe output found for {target.host} in {xml_dir}")
+    return candidate.read_text(encoding="utf-8")
+
+
+def get_cors_text(target: Target, xml_dir: Optional[str], timeout: int = 15) -> Tuple[str, str]:
+    cmd = command_display(target, timeout)
+    if xml_dir:
+        return run_replay_text(target, xml_dir), cmd
+    return run_live_text(target, timeout=timeout), cmd

netscraper/core/dirsearch_parser.py

@@ -0,0 +1,48 @@
+"""
+Parses real `dirsearch` output (quiet mode) down to just the found-path
+lines a tester actually cares about. dirsearch is already asked (via its own
+-i/--exclude-sizes CLI flags -- see dirsearch_runner.py) to only print
+status 200/301/302 and skip 0-byte responses, but this module re-verifies
+that against the real captured text rather than trusting the CLI flags
+blindly -- the same principle every other check in this toolkit follows
+(e.g. sslscan's XML is parsed and re-evaluated, never assumed correct).
+"""
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+from typing import List
+
+_WANTED_CODES = {"200", "301", "302"}
+
+# Tolerant of dirsearch's real output layout across versions -- e.g.
+# "200 -  318B  - /robots.txt" or "[10:11:12] 301 -    0B  - /images ->
+# /images/". The size token is always a number immediately followed by a
+# unit ("B", "KB", "MB", ...).
+_LINE_RE = re.compile(
+    r"(?P<code>\d{3})\s*-?\s*(?P<size>[\d.]+\s?[KMGT]?B)\s*-\s*(?P<path>\S+)"
+)
+
+
+@dataclass
+class DirsearchResult:
+    host: str
+    port: int
+    raw_text: str
+    found_lines: List[str] = field(default_factory=list)
+
+
+def parse_dirsearch_text(raw_text: str, host: str, port: int) -> DirsearchResult:
+    found_lines: List[str] = []
+    for line in raw_text.splitlines():
+        m = _LINE_RE.search(line)
+        if not m:
+            continue
+        code = m.group("code")
+        if code not in _WANTED_CODES:
+            continue
+        size = m.group("size").replace(" ", "").upper()
+        if size == "0B":
+            continue
+        found_lines.append(line.strip())
+    return DirsearchResult(host=host, port=port, raw_text=raw_text, found_lines=found_lines)

netscraper/core/dirsearch_rules.py

@@ -0,0 +1,39 @@
+"""
+Rule engine for the DIRSEARCH check. There's really only one "rule" here:
+did dirsearch find anything worth a tester looking at (a real 200/301/302 on
+a real path, never a 0-byte noise hit)? If yes, that's one finding carrying
+every found line as its evidence; if no, it's Safe -- exactly the same
+Vulnerable/Safe shape every other check in this toolkit uses, so it needs no
+special-case handling in cli.py's summary/Excel logic.
+
+No manual-verification bucket here -- dirsearch's own real HTTP status code
+is either a real hit or it isn't, nothing fuzzy to ask a human to confirm.
+"""
+from __future__ import annotations
+
+from typing import List, Tuple
+
+from netscraper.core.rules import Finding
+from netscraper.core.dirsearch_parser import DirsearchResult
+
+
+def evaluate(result: DirsearchResult) -> Tuple[List[Finding], List[Finding]]:
+    if not result.found_lines:
+        return [], []
+
+    finding = Finding(
+        rule_id="dirsearch_paths_found",
+        label=f"Dirsearch -- {len(result.found_lines)} Path(s)/File(s) Found",
+        folder_name="Found_Paths",
+        severity="medium",
+        evidence_lines=(
+            [f"Host: {result.host}:{result.port}", ""]
+            + result.found_lines
+        ),
+        # No screenshot is ever rendered for this check (see cli.py's
+        # render_poc=False for the dirsearch family), so there's nothing to
+        # highlight a line for -- the saved evidence .txt above is the
+        # "Found results" the client asked to see.
+        highlight_regex=None,
+    )
+    return [finding], []

netscraper/core/dirsearch_runner.py

@@ -0,0 +1,109 @@
+"""
+Runs the real `dirsearch` tool (directory/file brute-forcer) against a
+single host:port, asking dirsearch itself to already narrow its own output
+down to exactly what a tester wants to see -- quiet mode (no banner/progress
+noise), only status codes 200/301/302, and no 0-byte responses -- so the
+captured text is close to "found results" already. The parser layer
+(dirsearch_parser.py) still re-verifies that filtering itself against the
+real captured output rather than trusting the CLI flags blindly, same as
+every other check in this toolkit.
+
+Unlike every other check's port, DIRSEARCH's port isn't fixed -- the user
+chooses it (single or comma-separated) when they select this mode. See
+cli.py's _resolve_prompt_gated_ports() for where that port list actually comes
+from; by the time a Target reaches this module, target.port is already one
+concrete, real port to brute-force.
+"""
+from __future__ import annotations
+
+import shutil
+import subprocess
+from pathlib import Path
+from typing import List, Optional, Tuple
+
+from netscraper.core.targets import Target
+
+# 443 and the common alternate HTTPS ports are probed over TLS; everything
+# else is treated as plain HTTP. This is a heuristic (there's no cheap way
+# to know for sure without a real TLS handshake first), but it matches the
+# overwhelming majority of real-world setups. If it guesses wrong, dirsearch
+# just fails to connect -- reported as an ERROR row like any other
+# unreachable target, never a false "found" result.
+_HTTPS_PORTS = {443, 8443, 9443}
+
+# Per-HTTP-request timeout dirsearch itself enforces (its own --timeout
+# flag) -- deliberately kept short and fixed, separate from the overall
+# wall-clock budget for the whole brute-force run (see get_dirsearch_text's
+# own `timeout` argument, which is the subprocess-level cutoff).
+_REQUEST_TIMEOUT = "10"
+
+
+class DirsearchNotFound(RuntimeError):
+    pass
+
+
+class DirsearchScanError(RuntimeError):
+    def __init__(self, target: Target, message: str):
+        super().__init__(message)
+        self.target = target
+
+
+def scheme_for(target: Target) -> str:
+    return "https" if target.port in _HTTPS_PORTS else "http"
+
+
+def _command_parts(target: Target) -> List[str]:
+    url = f"{scheme_for(target)}://{target.host}:{target.port}/"
+    return [
+        "dirsearch", "-u", url,
+        "-q",                              # quiet mode -- suppress banner/progress noise
+        "-i", "200,301,302",               # only status codes worth a tester's time
+        "--exclude-sizes", "0B",           # a 0-byte "200" is almost always noise
+        "--timeout", _REQUEST_TIMEOUT,
+    ]
+
+
+def command_display(target: Target) -> str:
+    """The exact command shown in evidence, without needing dirsearch to
+    actually be on PATH (used for both live and replay output)."""
+    return " ".join(_command_parts(target))
+
+
+def _require_binary() -> str:
+    path = shutil.which("dirsearch")
+    if not path:
+        raise DirsearchNotFound(
+            "'dirsearch' is not installed or not on PATH "
+            "(pip install dirsearch, or clone https://github.com/maurosoria/dirsearch and add it to PATH)."
+        )
+    return path
+
+
+def run_live_text(target: Target, timeout: int = 300) -> str:
+    binary = _require_binary()
+    cmd = _command_parts(target)
+    cmd[0] = binary
+    try:
+        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
+    except subprocess.TimeoutExpired as exc:
+        raise DirsearchScanError(target, f"dirsearch timed out after {timeout}s") from exc
+    text = (proc.stdout or "") + (proc.stderr or "")
+    if not text.strip():
+        raise DirsearchScanError(target, "dirsearch produced no output")
+    return text
+
+
+def run_replay_text(target: Target, xml_dir: str) -> str:
+    candidate = Path(xml_dir) / f"{target.label}_dirsearch.txt"
+    if not candidate.exists():
+        candidate = Path(xml_dir) / f"{target.host}_dirsearch.txt"
+    if not candidate.exists():
+        raise DirsearchScanError(target, f"No captured dirsearch output found for {target.host} in {xml_dir}")
+    return candidate.read_text(encoding="utf-8")
+
+
+def get_dirsearch_text(target: Target, xml_dir: Optional[str], timeout: int = 300) -> Tuple[str, str]:
+    cmd = command_display(target)
+    if xml_dir:
+        return run_replay_text(target, xml_dir), cmd
+    return run_live_text(target, timeout=timeout), cmd

netscraper/core/dns_parser.py

@@ -0,0 +1,34 @@
+"""Parses `dig` output for the DNS recursion check."""
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from typing import Optional
+
+_FLAGS_RE = re.compile(r"^;;\s*flags:\s*(?P<flags>[a-z0-9 ]*?);", re.IGNORECASE | re.MULTILINE)
+_TIMEOUT_MARKERS = ("connection timed out", "no servers could be reached", "communications error")
+
+
+@dataclass
+class DnsResult:
+    host: str
+    port: int
+    raw_text: str
+    recursion_available: Optional[bool] = None  # None = inconclusive (no answer at all)
+
+
+def parse_dig_text(raw_text: str, host: str, port: int) -> DnsResult:
+    result = DnsResult(host=host, port=port, raw_text=raw_text)
+
+    if any(marker in raw_text.lower() for marker in _TIMEOUT_MARKERS):
+        result.recursion_available = None
+        return result
+
+    m = _FLAGS_RE.search(raw_text)
+    if not m:
+        result.recursion_available = None
+        return result
+
+    flags = m.group("flags").split()
+    result.recursion_available = "ra" in flags
+    return result

netscraper/core/dns_rules.py

@@ -0,0 +1,57 @@
+"""Rule engine for the DNS family: DNS Recursion Enabled (#3)."""
+from __future__ import annotations
+
+import re
+from typing import List, Optional, Tuple
+
+from netscraper.core.rules import Finding
+from netscraper.core.dns_parser import DnsResult
+
+
+def check_recursion_enabled(result: DnsResult) -> Optional[Finding]:
+    if result.recursion_available is not True:
+        return None
+    return Finding(
+        rule_id="dns_recursion_enabled",
+        label="DNS Recursion Enabled",
+        folder_name="DNS_Recursion_Enabled",
+        severity="medium",
+        evidence_lines=[
+            f"Host: {result.host}:{result.port}",
+            "The DNS response header includes the 'ra' (Recursion Available) flag for an arbitrary, "
+            "non-local domain query.",
+            "--> An open recursive resolver reachable from untrusted networks is a classic vector for "
+            "DNS amplification (DDoS reflection), cache poisoning, and unauthorized reconnaissance.",
+        ],
+        highlight_regex=re.compile(r"^;;\s*flags:.*\bra\b", re.IGNORECASE | re.MULTILINE),
+    )
+
+
+def check_recursion_manual(result: DnsResult) -> Optional[Finding]:
+    if result.recursion_available is not None:
+        return None
+    return Finding(
+        rule_id="dns_recursion_unknown",
+        label="DNS Recursion Enabled",
+        folder_name="Needs_Manual_Verification/DNS_Recursion",
+        severity="medium",
+        evidence_lines=[
+            f"Host: {result.host}:{result.port}",
+            "dig did not get a well-formed DNS response (no answer, or a transport-level failure) -- "
+            "not enough to call this Safe or Vulnerable.",
+            "--> Confirm manually, e.g. `dig @<host> google.com A`.",
+        ],
+        highlight_regex=None,
+    )
+
+
+def evaluate(result: DnsResult) -> Tuple[List[Finding], List[Finding]]:
+    confirmed = []
+    manual = []
+    f = check_recursion_enabled(result)
+    if f:
+        confirmed.append(f)
+    f = check_recursion_manual(result)
+    if f:
+        manual.append(f)
+    return confirmed, manual

netscraper/core/dns_runner.py

@@ -0,0 +1,68 @@
+"""
+Runs `dig` against a target's DNS service to test for open recursion (#3):
+a resolver that will happily recurse an arbitrary (non-authoritative,
+non-local) query for anyone is a classic amplification/cache-poisoning/
+reconnaissance risk. The real signal is the "ra" (Recursion Available) flag
+in the response header -- exactly what nmap's own `dns-recursion` script
+keys off, and what was validated here against two real local `named`
+instances (recursion enabled/open vs. recursion disabled).
+"""
+from __future__ import annotations
+
+import shutil
+import subprocess
+from pathlib import Path
+from typing import Optional
+
+from netscraper.core.targets import Target
+
+# A public-ish domain used purely to see how the SERVER'S resolver behaves
+# (an authoritative/local-only server should refuse or answer without "ra";
+# an open recursive resolver will show "ra" whether or not it can actually
+# complete the lookup upstream).
+_PROBE_DOMAIN = "google.com"
+
+
+class DigNotFound(RuntimeError):
+    pass
+
+
+class DnsScanError(RuntimeError):
+    def __init__(self, target: Target, message: str):
+        super().__init__(message)
+        self.target = target
+
+
+def _require(binary: str) -> str:
+    path = shutil.which(binary)
+    if not path:
+        raise DigNotFound(f"'{binary}' is not installed or not on PATH (apt install dnsutils).")
+    return path
+
+
+def run_live_text(target: Target, timeout: int = 10) -> str:
+    binary = _require("dig")
+    cmd = [binary, f"@{target.host}", "-p", str(target.port), _PROBE_DOMAIN, "A", "+time=3", "+tries=1"]
+    try:
+        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
+    except subprocess.TimeoutExpired as exc:
+        raise DnsScanError(target, f"dig timed out after {timeout}s") from exc
+    text = (proc.stdout or "") + (proc.stderr or "")
+    if not text.strip():
+        raise DnsScanError(target, "dig produced no output")
+    return text
+
+
+def run_replay_text(target: Target, xml_dir: str) -> str:
+    candidate = Path(xml_dir) / f"{target.label}_dig.txt"
+    if not candidate.exists():
+        candidate = Path(xml_dir) / f"{target.host}_dig.txt"
+    if not candidate.exists():
+        raise DnsScanError(target, f"No captured dig output found for {target.host} in {xml_dir}")
+    return candidate.read_text(encoding="utf-8")
+
+
+def get_dig_text(target: Target, xml_dir: Optional[str], timeout: int = 10) -> str:
+    if xml_dir:
+        return run_replay_text(target, xml_dir)
+    return run_live_text(target, timeout=timeout)

netscraper/core/excel_report.py

@@ -0,0 +1,84 @@
+"""
+Builds the final PT_Scan_Report.xlsx for a run, styled to match the
+reference template the client provided: S.No / Vulnerability / Host /
+Status columns, a blue header row, and a red/green Status cell per row
+(Vulnerable = red, Not Vulnerable = green), bold white text throughout,
+thin borders, centered alignment.
+
+Only two kinds of rows go in here, by design (matching what the reference
+template's Status column actually supports):
+  - One row per CONFIRMED finding -- "Vulnerable", red.
+  - One row per (host, check) that came back completely clean -- "Not
+    Vulnerable", green.
+N/A (port not open), ERROR (tool failure), and NEEDS MANUAL VERIFICATION
+results are deliberately left out of this file -- they don't fit a binary
+Vulnerable/Not-Vulnerable verdict, and forcing them into one would
+misrepresent an inconclusive result as a real finding. They're still fully
+recorded in summary.csv and in their own POC/evidence files either way.
+"""
+from __future__ import annotations
+
+from pathlib import Path
+from typing import List, Tuple
+
+from openpyxl import Workbook
+from openpyxl.styles import Alignment, Border, Font, PatternFill, Side
+
+_HEADER_FILL = PatternFill(start_color="FF0070C0", end_color="FF0070C0", fill_type="solid")
+_VULNERABLE_FILL = PatternFill(start_color="FFFF0000", end_color="FFFF0000", fill_type="solid")
+_NOT_VULNERABLE_FILL = PatternFill(start_color="FF00B050", end_color="FF00B050", fill_type="solid")
+
+_WHITE_BOLD = Font(name="Aptos Narrow", size=12, bold=True, color="FFFFFFFF")
+_PLAIN = Font(name="Aptos Narrow", size=12, bold=False, color="FF000000")
+
+_THIN = Side(style="thin")
+_BORDER = Border(top=_THIN, bottom=_THIN, left=_THIN, right=_THIN)
+_CENTER = Alignment(horizontal="center", vertical="center", wrap_text=True)
+
+_HEADERS = ["S.No", "Vulnerability", "Host", "Status"]
+
+# ReportRow: (vulnerability_label, host_str, status) where status is
+# exactly "Vulnerable" or "Not Vulnerable".
+ReportRow = Tuple[str, str, str]
+
+
+def write_report(rows: List[ReportRow], output_path: Path) -> None:
+    wb = Workbook()
+    ws = wb.active
+    ws.title = "PT Scan Report"
+
+    for col_idx, header in enumerate(_HEADERS, start=1):
+        cell = ws.cell(row=1, column=col_idx, value=header)
+        cell.fill = _HEADER_FILL
+        cell.font = _WHITE_BOLD
+        cell.alignment = _CENTER
+        cell.border = _BORDER
+
+    for row_idx, (vuln, host_str, status) in enumerate(rows, start=2):
+        s_no_cell = ws.cell(row=row_idx, column=1, value=row_idx - 1)
+        vuln_cell = ws.cell(row=row_idx, column=2, value=vuln)
+        host_cell = ws.cell(row=row_idx, column=3, value=host_str)
+        status_cell = ws.cell(row=row_idx, column=4, value=status)
+
+        for cell in (s_no_cell, vuln_cell, host_cell):
+            cell.font = _PLAIN
+            cell.alignment = _CENTER
+            cell.border = _BORDER
+
+        status_cell.alignment = _CENTER
+        status_cell.border = _BORDER
+        if status == "Vulnerable":
+            status_cell.fill = _VULNERABLE_FILL
+            status_cell.font = _WHITE_BOLD
+        else:
+            status_cell.fill = _NOT_VULNERABLE_FILL
+            status_cell.font = _WHITE_BOLD
+
+    ws.column_dimensions["A"].width = 8
+    ws.column_dimensions["B"].width = 48
+    ws.column_dimensions["C"].width = 22
+    ws.column_dimensions["D"].width = 16
+    ws.freeze_panes = "A2"
+
+    output_path.parent.mkdir(parents=True, exist_ok=True)
+    wb.save(str(output_path))