🔥 Flare

Network Mapping, Made Obvious — the full power of Nmap, without the command line.

Point it at a target, pick a profile, and get a clean, color-coded map of every open port — each one automatically rated by how much it matters (RDP open? that's flagged HIGH/CRITICAL), with a one-click formatted Excel report. Beginner-friendly, bilingual (Indonesia / English), one Windows app — click and run.

⬇️ Install · ✨ Features · 📖 Usage · 🎛️ Menu guide · ⚠️ Disclaimer

Nmap is the gold standard for network mapping — but it has hundreds of flags, and its output is raw text. Beginners see 3389/tcp open ms-wbt-server and have no idea it's dangerous. Zenmap (the classic GUI) is dated, its exports are XML, and it doesn't tell you what's risky.

Flare wraps the real Nmap engine in a clean desktop app that:

• exposes all of Nmap's techniques and 600+ NSE scripts, with a plain-language hint on every option,
• automatically scores the criticality of each open port so you know what to look at first,
• exports a polished, multi-sheet Excel report (not raw CSV),
• speaks Indonesian and English, and runs from a single .exe.

• 🎯 Ready profiles — Quick, Quick+Version, Intense, Intense (All/UDP), Ping Sweep, Discovery, Vuln, Stealth — plus raw Custom Flags for power users.
• 🧠 Port Criticality Engine — every open port gets a transparent, context-aware severity (e.g. RDP/SMB/Redis), with the reason in plain language and a fix tip. Internet-facing services and known-exploited CVEs are escalated automatically.
• 🥇 Priorities view — a ranked "what to fix first" list for non-experts.
• 🧬 Full NSE picker — the 14 categories + curated bundles (vuln, SMB, HTTP, SSL, DNS, CVE correlation), custom expressions and script-args, with safety badges.
• 👁️ Live command preview + Learning Mode — see the exact Nmap command that runs, and learn what each flag means.
• 📊 Formatted Excel report — Summary, Priorities, Hosts, Open Ports, Services, NSE/CVE, Appendix — color-coded, filterable, print-ready. Also HTML / JSON / CSV.
• 🌍 Bilingual — full Indonesian / English UI and reports.
• 🎨 Modern GUI — dark/light themes, sortable table, a hint on every menu.
• 🛡️ Safe by default — authorization prompt, polite timing, TCP-Connect fallback when not running as admin.
• 💻 Single .exe — built with PyInstaller; bundles the Nmap engine.

Main window — type a target, pick a profile, see the live command preview.

Live results — open ports stream in, color-coded by criticality (High, Medium, Info).

Host details — per-port reasons and plain-language fix advice for each finding.

HTML report — shareable, with a ranked Priorities table and full port list.

Excel report — polished, multi-sheet, severity-colored, print-ready.

Why Windows 10+ only? The GUI uses Qt 6 (PySide6), which dropped support for Windows 7/8. The code also runs from source on Linux/macOS (python main.py), but official binaries target Windows.

Two flavors are published on every release — pick whichever fits you.

1. Go to Releases.
2. Download FlareSetup-<version>.exe.
3. Run it — installs to Program Files, adds a Start Menu (and optional desktop) shortcut, proper uninstaller.
4. If Nmap and/or Npcap aren't detected on your system, the installer offers to open the official Nmap download page for you (its installer also offers to install Npcap) — Flare itself doesn't bundle or redistribute either (see Licensing note).

1. Go to Releases.
2. Download Flare.exe.
3. Double-click to run — nothing is written outside the app's own folder.
4. On first launch, if Npcap isn't installed, the app will guide you. Without it, TCP Connect scans still work.

First launch may show Windows SmartScreen because neither build is code-signed. Click More info → Run anyway. Verify integrity with the published .sha256.txt file next to each download.

git clone https://github.com/n0xnull/Flare.git
cd Flare
python -m venv .venv && .venv\Scripts\activate     # Windows
pip install -r requirements.txt
python main.py

You need an nmap available — either installed system-wide (on PATH) or dropped into flare/data/nmap/ (see that folder's README).

:: 1. Portable exe (Windows, one click):
build.bat
:: -> dist\Flare.exe

:: 2. Installer — needs Inno Setup 6 (free: https://jrsoftware.org/isinfo.php)
::    and step 1 done first:
build-installer.bat
:: -> dist\FlareSetup-<version>.exe

Manual equivalent of step 1:

pip install -r requirements-dev.txt
pyinstaller flare.spec --noconfirm --clean

To ship a self-contained binary, place a Windows Nmap build into flare/data/nmap/ before building (see flare/data/nmap/README.md and the licensing note below). The installer script (installer/flare.iss) never bundles Nmap/Npcap either way — same licensing reasoning applies.

1. Type a target — an IP, hostname, range, or CIDR (e.g. 192.168.1.0/24, example.com, 10.0.0.1-50). Separate several with spaces.
2. Pick a profile (start with Quick Scan) — or add NSE scripts and Custom Flags. Watch the command preview update live.
3. Click ▶ Start. Confirm you're authorized. Watch the live log + progress/ETA; Cancel any time.
4. Browse the Ports table (color-coded by criticality) and the host list. Click a host for Details (OS, exposure, per-port reasons & advice).
5. Open the Priorities tab to see what needs attention first.
6. Export → Excel (recommended), HTML, JSON, or CSV. Save scans and reopen them later.

python -m flare.cli 192.168.1.0/24 --profile quick --lang en --excel report.xlsx

Every menu item also shows a hint in the status bar when you hover it, in your chosen language.

target → command builder → Nmap engine (-oX) → XML parser → models
       → exposure classify → Port Criticality Engine → priorities & roll-up
       → live table + Excel / HTML / JSON / CSV

The app never reimplements Nmap; it runs the real engine and parses its XML, so every Nmap technique and script is available and stays current with the bundled Nmap version. The Port Criticality Engine then adds meaning: a base severity per service (from an editable knowledge base), raised by internet exposure, cleartext protocols, missing authentication (from NSE evidence), and known CVEs — with every contributing reason recorded so you can see why.

• v1.1 — Compare/diff scans (newly opened ports), topology view, scheduler, pause/resume UI.
• v1.2 — Richer CVE/KEV summaries in Excel, PDF export, company-branded report templates.
• v2.0 (working title: NoxNull Atlas) — merge Fathom + Flare: domain → subdomain → host → port → service → vulnerability in one flow.

Flare's own code is MIT. It runs Nmap, which is under the Nmap Public Source License (NPSL), and relies on Npcap, which has its own license and may not be redistributed without permission. The app therefore does not redistribute Npcap (it guides you to the official installer). If you publish a build that bundles nmap.exe, comply with the NPSL. See THIRD-PARTY-LICENSES.md.

For authorized security testing and educational use only. Scan only systems you own or are permitted to test. See DISCLAIMER.md.

MIT © 2026 Abil Khosim. Nmap and Npcap are the property of their respective owners.