NetSentinel follows a modular architecture to ensure each component is reusable, testable, and easy to extend. Modules are isolated by function and interact through a shared data structure passed at runtime.

netsentinel/
├── core/
│ ├── recon.py # Network scanning, host discovery
│ ├── smb_enum.py # SMB share enumeration
│ ├── kerberos_enum.py # SPN & AS-REP Kerberos recon
│ └── init.py
├── utils/
│ ├── logger.py # Unified logging
│ ├── config.py # Domain credentials (env or file)
│ ├── ports.py # Common TCP ports list
│ └── init.py
main.py # CLI entry point

Each module receives structured data (host records) from recon.py, and may enrich it with new keys (e.g., open ports, hostnames, shares). Output is passed down the pipeline and optionally written to a JSON file.

main.py → recon.py → [ smb_enum.py | kerberos_enum.py ] → export

All modules use the centralized Logger class in utils/logger.py. This provides:

• Timestamped output
• Colorized severity indicators (INFO, WARN, ERROR)
• Optional debugging verbosity

NetSentinel is designed to be easily extended by adding modules to the core/ directory. These modules should focus on a single responsibility (e.g., SNMP scan, HTTP banner grabbing) and follow a consistent structure.

Create a new file in core/, e.g., snmp_enum.py:

from utils.logger import Logger

class SNMPEnumerator:
    def __init__(self, logger: Logger):
        self.logger = logger

    def enumerate(self, hosts: list):
        self.logger.info("Running SNMP scan...")
        for host in hosts:
            ip = host.get("ip")
            # SNMP logic here
            self.logger.debug(f"Queried {ip} via SNMP")

Import and call your module conditionally based on a new CLI argument:

from core.snmp_enum import SNMPEnumerator

if args.snmp_enum:
    snmp = SNMPEnumerator(logger)
    snmp.enumerate(results)

Add this to your argument parser:

parser.add_argument("--snmp-enum", action="store_true", help="Enumerate SNMP devices")

• Accept a list of hosts from recon

• Use the shared Logger for output

• Return enriched results or modify the host data inline

• Fail gracefully with try/except blocks

• Don’t hard-code ports — use ports.py or inline where justified

python3 main.py --target 10.0.0.0/24 --snmp-enum

This structure ensures consistent behavior across all modules.

The recon.py module performs initial host discovery and port scanning. It feeds structured output to all other modules. This document explains how to enhance its functionality with new enrichment methods or discovery logic.

Each discovered host is returned as a dictionary:

{
  "ip": "10.0.0.5",
  "mac": "00:11:22:33:44:55",
  "hostname": "DC01",
  "ports": [445, 135]
}

This list is passed to modules like smb_enum and kerberos_enum.

To extend the recon process, add new methods to the NetworkScanner class in recon.py.

def enrich_with_os_guessing(self):
    for host in self.live_hosts:
        ip = host["ip"]
        ttl = self.get_ttl(ip)
        host["os_guess"] = self.guess_os_from_ttl(ttl)

Call this function inside run() or through a new CLI argument.

• Keep methods isolated and testable

• Use .get("ip") defensively

• Avoid blocking calls where possible

• Append enrichment data, never overwrite core fields

scanner = NetworkScanner(...)
scanner.run()
scanner.enrich_with_os_guessing()

This improves data passed to all downstream modules.