ShadowAudit
A Windows security auditing tool that shows its working
Ongoing
- lines of Python
- 14,000
- read-only checks
- 17
- tools in the family
- 3
- Python
- Tkinter
- Pillow
- PyInstaller
- WinRM
No screenshots. A real run shows the actual security posture of whichever machine it audited, so the source is the better thing to look at anyway.
This one started as a shrug. A client asked whether they were secure, and what I had was an opinion. Not a report, not evidence, just a technician saying it looked fine to him. So I built the thing that would let me answer properly.
ShadowAudit runs 17 checks against a Windows host and never writes to it. Firewall, Defender, patch level, BitLocker, UAC, SMB, RDP, local accounts, shares, legacy protocols, boot security, missing updates, end-of-life software, credential hygiene, domain configuration, the router, TLS. Each finding gets a severity and, more importantly, the evidence it was based on. If the tool says SMBv1 is enabled, it shows you the registry value it read.
The decisions worth defending
It scans ports itself. The obvious move is to shell out to nmap. I wrote the port scanning and service identification into the tool instead, because nmap’s licence makes bundling it into something you sell a problem you don’t want to discover late. Writing a scanner cost me a fortnight. Discovering the licensing issue after shipping would have cost a rewrite.
Remote credentials never touch the disk. It audits other machines over WinRM. Those credentials live in memory for the duration of that run and are gone afterwards. No config file, no keyring, no “remember me” tick box. Somebody running a security tool should not have to trust it with a domain admin password in plain text on disk, and I didn’t want to be the person who got that wrong.
It diffs. Point it at a previous export and it tells you what got fixed, what’s new, and what’s still sitting there from last time. A one-off score is close to useless. What a client actually wants to know is whether the last three months of paying attention did anything.
On Cyber Essentials
Findings map to the relevant Cyber Essentials control, which makes the report useful when someone’s preparing for certification. That’s all it does. A scan is not an assessment, and mapping to a control is not certifying against it, because only an IASME-licensed certification body can do that. I’m careful about this wording because the gap between “helps you prepare” and “certifies you” is the kind of thing that ends up in a complaint.
There’s a related honesty problem the tool can’t solve. The single most common Cyber Essentials failure is multi-factor authentication that isn’t actually enforced on cloud services, and no host-based scan can see that. It has to be asked.
Two companions
ShadowBreach takes a finding and proves it’s genuinely exploitable before anyone escalates. Its rating is the deepest phase it actually reached, so it can’t inflate itself by claiming a risk it never demonstrated.
ShadowFix closes findings. It refuses to apply anything it can’t reverse, and it dry-runs by default. Twelve of the fixes are deliberately left manual, because some things should not happen without a person deciding.
