SploitScan(1)

📦
version 0.14.3 · 2 versions
, in ubuntu stonking

✨ SploitScan(1) — General Commands Manual ✨

okay bestie, deep breath, hydrate, because you just opened the SploitScan(1) page (that's the manual, general commands flavour 💅) and honestly? it's a whole moment. it's a tool, it's iconic, and by the end of this you're gonna know every flag like the back of your hand. no cap.

📛 NAME 💖

  • SploitScan — a tool that fetches and displays vulnerability information and public exploits for whatever CVE IDs you feed it. that's the mission. that's the whole thing. periodt.

📜 Description 🦋

SploitScan is a powerful and user-friendly tool whose entire personality is making "find the exploits for known vulnerabilities and their respective exploitation probability" not be a whole ordeal. it streamlines that process so cybersecurity professionals can swiftly identify and apply known and test exploits. it's especially valuable if you're out here trying to beef up your security measures or build robust detection strategies against emerging threats, fr fr.

like… it's giving "I have a job interview in an hour and need to know everything about this CVE." we love a tool with range. 🫶

📖 Table of contents 🎀

  • 📜 Description
  • 🌟 Features
  • 💣 Supported Exploit Databases
  • 📁 Supported Vulnerability Scanner Import
  • ⚙️ Installation
  • 🚀 Usage
  • 🤖 AI-Powered Risk Assessment
  • 🛡️ Patching Priority System
  • 📆 Changelog
  • 🫱🏼‍🫲🏽 Contributing
  • 📌 Author
  • 📚 References

🌟 Features 🌈

  • CVE Information Retrieval — fetches the CVE details straight from the National Vulnerability Database. no manual stalking required ✨
  • EPSS Integration — pulls in Exploit Prediction Scoring System (EPSS) data, which hands you a probability score for how likely the CVE is to actually get exploited. prioritisation queen behaviour 👑
  • Public Exploits Aggregation — gathers up publicly available exploits so you actually understand the vulnerability, not just its vibe.
  • CISA KEV — tells you if the CVE is listed in the Known Exploited Vulnerabilities (KEV) of CISA. if it's on that list, it's lowkey famous for all the wrong reasons 😭
  • AI-Powered Risk Assessment — leverages OpenAI to serve up detailed risk assessments, potential attack scenarios, mitigation recommendations, and executive summaries. yes, exec summaries. ate 💅
  • HackerOne Reports — shows if the CVE was used within HackerOne Bug Bounty programs, including their total rank overall and severity distribution.
  • Patching Priority System — evaluates and assigns a priority rating for patching based on various factors, including public exploits availability. it literally does the "should I panic" math for you.
  • Multi-CVE Support and Export Options — supports multiple CVEs in a single run, and lets you export the results to HTML, JSON and CSV formats. obsessed with the range 🔥
  • Vulnerability Scanner Import — import vulnerability scans from popular vulnerability scanners and search directly for known exploits.
  • User-Friendly Interface — easy to use, and it gives you clear and concise information. as it should.
  • Comprehensive Security Tool — ideal for quick security assessments and for staying informed about recent vulnerabilities. main character energy 🦋

💣 Supported Exploit Databases 💥

📁 Supported Vulnerability Scanner Import 🗂️

⚙️ Installation 🛠️

pick your fighter, bestie — there's a path for everybody.

GitHub 🐙

git clone https://github.com/xaitax/SploitScan.git
cd sploitscan
pip install -r requirements.txt

pip 📦

pip install --user sploitscan

Kali/Ubuntu/Debian 🐧

apt install sploitscan

Configuration File 🔧

make a config.json file in one of these locations and drop your API keys in it:

  • Current directory
  • ~/.sploitscan/
  • ~/.config/sploitscan/
  • /etc/sploitscan/
{
  "vulncheck_api_key": "your_vulncheck_api_key",
  "openai_api_key": "your_openai_api_key"
}

🚀 Usage 🚀

run the help and this is what greets you (yes, the banner is a whole entrance, don't question it):

$ sploitscan.py -h

███████╗██████╗ ██╗      ██████╗ ██╗████████╗███████╗ ██████╗ █████╗ ███╗   ██╗
██╔════╝██╔══██╗██║     ██╔═══██╗██║╚══██╔══╝██╔════╝██╔════╝██╔══██╗████╗  ██║
███████╗██████╔╝██║     ██║   ██║██║   ██║   ███████╗██║     ███████║██╔██╗ ██║
╚════██║██╔═══╝ ██║     ██║   ██║██║   ██║   ╚════██║██║     ██╔══██║██║╚██╗██║
███████║██║     ███████╗╚██████╔╝██║   ██║   ███████║╚██████╗██║  ██║██║ ╚████║
╚══════╝╚═╝     ╚══════╝ ╚═════╝ ╚═╝   ╚═╝   ╚══════╝ ╚═════╝╚═╝  ╚═╝╚═╝  ╚═══╝
v0.10.1 / Alexander Hagenah / @xaitax / ah@primepage.de

usage: sploitscan.py [-h] [-e {json,JSON,csv,CSV,html,HTML}] [-t {nessus,nexpose,openvas,docker}] [-i IMPORT_FILE] [-d] [cve_ids ...]

SploitScan: Retrieve and display vulnerability data as well as public exploits for given CVE ID(s).

positional arguments:
  cve_ids               Enter one or more CVE IDs to fetch data. Separate multiple CVE IDs with spaces. Format for each ID: CVE-YYYY-NNNNN. This argument is optional if an import file is provided
                        using the -n option.

options:
  -h, --help            show this help message and exit
  -e {json,JSON,csv,CSV,html,HTML}, --export {json,JSON,csv,CSV,html,HTML}
                        Optional: Export the results to a JSON, CSV, or HTML file. Specify the format: 'json', 'csv', or 'html'.
  -t {nessus,nexpose,openvas,docker}, --type {nessus,nexpose,openvas,docker}
                        Specify the type of the import file: 'nessus', 'nexpose', 'openvas' or 'docker'.
  -i IMPORT_FILE, --import-file IMPORT_FILE
                        Path to an import file from a vulnerability scanner. If used, CVE IDs can be omitted from the command line arguments.
  -d, --debug           Enable debug output.

Single CVE Query 🎯

one CVE, one vibe check:

sploitscan CVE-2024-1709

Multiple CVE Query 🎯🎯

give it a whole friend group of CVEs, just separate them with spaces:

sploitscan CVE-2024-1709 CVE-2024-21413

Import from Vulnerability Scanner 📥

tell it the type — 'nessus', 'nexpose', 'openvas', or 'docker' — and hand over the file path:

sploitscan --import-file path/to/yourfile.nessus --type nessus

Export Results 📤

pick your format: 'json', 'csv', or 'html'.

sploitscan CVE-2024-1709 -e html

Docker 🐳

build it, then run it:

docker build -t sploitscan .
docker run --rm sploitscan CVE-2024-1709

With a volume mounted from the current directory

Windows (Powershell) 🪟

docker run -v ${PWD}:/app --rm sploitscan CVE-2024-1709 -e JSON

Linux 🐧

docker run -v $(pwd):/app --rm sploitscan CVE-2024-1709 -e JSON

🤖 AI-Powered Risk Assessment ✨

okay so this is the part where SploitScan gets a brain — it plugs into OpenAI and generates a full AI-powered risk assessment for every single CVE it shows you. no cap, it's giving security-analyst-in-your-pocket. here's what it hands you:

  • Detailed Risk Assessment — the actual nature of the vulnerability and what it means for your business, spelled out. 💅
  • Potential Attack Scenarios — descriptions of how an attacker could actually come at you using the vuln.
  • Mitigation Recommendations — specific, actionable stuff you can do to shut the risk down. 🫶
  • Executive Summary — a short, non-technical summary that your stakeholders can read without crying, highlighting business impact and urgency. perfect for the group chat that includes leadership. 👑

🌈 Example output

$ sploitscan.py CVE-2024-21413

[...]

┌───[ 🤖 AI-Powered Risk Assessment ]
|
| 1. Risk Assessment
| -------------------
| The vulnerability identified by CVE-2024-21413 is a critical remote code execution flaw in
| Microsoft Outlook with a CVSS score of 9.8. The impact on business operations can be severe due to
| its high potential to be exploited over a network without any user interactions or elevated
| privileges. This unvalidated input vulnerability (CWE-20) could allow an attacker to execute
| arbitrary code on the target system, thereby compromising the confidentiality, integrity, and
| availability of critical business data and systems. Given its critical rating and the existence of
| multiple exploits on public repositories like GitHub, the likelihood of exploitation is very high.
| This necessitates immediate attention from the security teams to mitigate the risks associated.
|
| 2. Potential Attack Scenarios
| ------------------------------
| An attacker could exploit this vulnerability by sending a specially crafted email to a victim
| using Microsoft Outlook. Once the email is opened or previewed, the malicious payload would
| execute, allowing the attacker to gain control over the victim's system. The process involves: 1.
| Crafting a malicious email leveraging the specific flaw in email handling within Microsoft
| Outlook. 2. Sending the email to the intended victim. 3. Upon opening or previewing the email, the
| victim’s system executes the malicious code. The potential outcomes of this attack include theft
| of sensitive information, installation of malware or ransomware, and compromising other systems
| within the same network due to lateral movement capabilities.
|
| 3. Mitigation Recommendations
| ------------------------------
| Immediate mitigation recommendation includes: 1. Applying the latest security patches provided by
| Microsoft. Reference: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413 2.
| Implementing network-level protections such as email filtering and network segmentation to limit
| the spread of potential infections. 3. Conducting regular security awareness training for users to
| recognize phishing and malicious emails. 4. Monitoring network and system activity for signs of
| suspicious behavior and unauthorized execution. 5. Regularly backing up critical data and ensuring
| the integrity of backups.
|
| 4. Executive Summary
| ---------------------
| CVE-2024-21413, a critical remote code execution vulnerability in Microsoft Outlook, poses a
| significant risk to businesses due to its potential to be exploited without user interaction.
| Multiple exploit proofs are publicly available, increasing the likelihood of attacks.
| Organizations must act swiftly by applying the necessary patches from Microsoft, enhancing their
| email security protocols, and educating their staff to identify potential phishing attempts.
| Mitigating this vulnerability is essential to protect sensitive information, maintain business
| integrity, and ensure system availability, thus preventing potential financial and reputational
| damage. Immediate action is crucial to safeguard the organization against this severe threat.
|
└────────────────────────────────────────

🛡️ Patching Priority System 💀

the Patching Prioritization System is SploitScan's way of telling you which fire to put out first. it's lowkey a whole strategy: instead of you staring at 400 CVEs wondering where to start, it ranks them by severity and exploitability. it takes inspiration from the model by CVE Prioritizer ⟨https://github.com/TURROKS/CVE_Prioritizer⟩, with extra sauce added for handling publicly available exploits. here's the tea: 🍓

  • A+ Priority — handed to CVEs that show up in CISA's KEV or that have publicly available exploits. this is the highest risk, highest urgency tier, bestie — patch these immediately. 🔥
  • A to D Priority — sorted by a combo of CVSS scores and EPSS probability percentages. the decision matrix goes like this:
    • A: CVSS score >= 6.0 and EPSS score >= 0.2. high severity with a significant probability of exploitation. 👀
    • B: CVSS score >= 6.0 but EPSS score < 0.2. high severity, but the probability of exploitation is lower.
    • C: CVSS score < 6.0 and EPSS score >= 0.2. lower severity, but a higher probability of exploitation.
    • D: CVSS score < 6.0 and EPSS score < 0.2. lower severity and lower probability of exploitation. chilling in the back, respectfully. 😌

so yeah — this system helps you make actually-informed decisions about which vulnerabilities to patch first, weighing both the potential impact and the likelihood of exploitation. and the thresholds? they can be changed to your business needs. customizable slay. 💅

📆 Changelog 🦋

[26. June 2024] - Version 0.10

  • HackerOne Integration: added support for searching through HackerOne, and it displays if the CVE was used in any Bug Bounty program — including its rank and severity distribution. 🏆
  • General Improvements: various bug fixes.

[24. May 2024] - Version 0.9

  • AI-Powered Risk Assessment: integrated OpenAI for detailed risk assessments, potential attack scenarios, mitigation recommendations, and executive summaries (needs OpenAI API key). 🤖
  • CVE Information Retrieval: due to API rate limits and instabilities, replaced NIST NVD with CVE Program ⟨https://github.com/CVEProject/cvelistV5⟩.
  • General Improvements: various bug fixes and performance improvements.

[18. May 2024] - Version 0.8

  • HTML Export Functionality: introduced the ability to export vulnerability data to HTML reports. ✨
  • Packet Storm Integration: added support for fetching exploit data from Packet Storm.
  • Enhanced Display Functions: added CVEGITHUBURL as a CVE source, plus functions to output the most updated CVE source.
  • Code Refactoring: refactored code to improve maintainability and readability due to the growing code base.

[11. May 2024] - Version 0.7

  • Nuclei Template Integration: added support for discovery of Nuclei templates, enhancing vulnerability data sources.
  • Enhanced Display Functions: refined visual output across all display functions for consistency and readability.
  • General Improvements: various bug fixes and performance improvements such as improved error handling.

[06. May 2024] - Version 0.6.1

  • Import File Capabilities: added support for importing vulnerability data directly from Docker Scout scan files.

[05. May 2024] - Version 0.6

  • Import File Capabilities: added support for importing vulnerability data directly from Nessus, Nexpose, and OpenVAS scan files.
  • Expanded Command-Line Options: introduced new command-line options to specify the import file and its type.
  • Robust Configuration Management: improved error handling for missing or malformed configuration files.
  • General Improvements: various bug fixes and performance improvements.

[02. March 2024] - Version 0.5

  • ExploitDB Integration: added support for fetching exploit data from ExploitDB.
  • CVSS Enhancements: added support for CVSS 2 and CVSS 3.x
  • Docker support
  • Code fixes

[28. February 2024] - Version 0.4

  • VulnCheck Integration: added support for fetching exploit data from VulnCheck, enhancing the exploit information available.
  • API Key Configuration: introduced the requirement for a VulnCheck API key, specified in config.json.
  • Requirements satisfied for Debian Integration

[17. February 2024] - Version 0.3

  • Additional Information: added further information such as references & vector string
  • Removed: Star count in publicly available exploits

[15. January 2024] - Version 0.2

  • Multiple CVE Support: now capable of handling multiple CVE IDs in a single execution.
  • JSON and CSV Export: added functionality to export results to JSON and CSV files.
  • Enhanced CVE Display: improved visual differentiation and information layout for each CVE.
  • Patching Priority System: introduced a priority rating system for patching, influenced by various factors including the availability of public exploits.

[13th January 2024] - Version 0.1

  • Initial release of SploitScan. 🎉

🫱🏼🫲🏽 Contributing 🫶

contributions are so welcome, bestie. please feel free to fork, modify, and make pull requests — or report issues. this project is literally built by the community and it ate. 💖

special thanks to:

📌 Author 👑

Alexander Hagenah

📚 References 📚

okay bestie, here's the receipts 💅 — every source SploitScan pulls from, fed by the brilliant brains behind them. Go give them a follow, they ate:

and that's the whole entire page, bestie 🫶 you made it to the end, iconic behavior, no notes 👑

this was the SploitScan user manual, sitting pretty at Version 0.12.0, filed under SploitScan(1) 💖 go patch something before it patches you ✨🦋

📦 where this page comes from