Tag Archives: vulners

The Vulners team has released nmap-vulners 2.0

Leave a reply

The Vulners team has released nmap-vulners 2.0

The Vulners team has released nmap-vulners 2.0. This plugin (an NSE script) turns the popular Nmap port scanner into a black-box vulnerability scanner. Simply run $ nmap -sV --script vulners <target> to get a prioritized report on vulnerabilities and exploits. And all of this is available for free with no limitations. 🆓😉

How exactly does this plugin work?

To find vulnerabilities, the software is identified first:

🔹 The service's CPE identifier may be provided by Nmap itself (using the -sV option).

🔹 If Nmap fails to identify the service, the plugin attempts to determine the CPE identifier from the raw banner using rules for FTP, SMTP, SSH, MySQL, DNS, NTP, LDAP, and other services. Starting with version 2.0, the fingerprint catalog is updated weekly based on Recog, Wappalyzer, WhatWeb, FingerprintHub, and nuclei-templates. The latest catalog is automatically fetched when the plugin runs.

🔹 If an HTTP service is detected, nmap-vulners also attempts to identify the web stack, including the framework, CMS, or PHP version behind a reverse proxy. It analyzes Server and X-Powered-By headers, cookies, the page title, meta tags, filenames in script src, and page content. The plugin includes more than 700 rules. In version 2.0, the number of HTTP path fingerprints increased from 125 to 939, while parallelization kept the processing time at around 6 seconds per port.

🔹 If a product is identified but its version is unknown, the plugin makes a single request to a known file that contains version information, such as /CHANGELOG.txt for Drupal or /administrator/manifests/files/joomla.xml for Joomla. This works with Concrete5, Drupal, Jira, Joomla, Apache Tomcat, and WordPress.

🔹 Finally, if a service cannot be identified, Smart Audit can be used. The raw banner is sent to the Vulners server, which identifies the software and its version and then looks for related vulnerabilities. This is the only paid feature! Each unique request costs 1 credit, and results are cached. The number of requests is limited by the vulners.max_items parameter, which defaults to 32. Smart Audit can be disabled entirely with --script-args vulners.max_items=0.

The service data is then sent to the Vulners server, which returns a prioritized vulnerability report. For each vulnerability or exploit, the report includes its ID, SEVERITY level, CVSS and EPSS scores, Vulners AI score, KEV and EXP flags, and a link to its page on the Vulners website.

So, is an API key actually required?

🔹 The plugin can work without an API key. However, detection will use the legacy endpoint, and some vulnerability and exploit data will not be available.

🔹 Adding an API key, even without credits, enables the "EXP" flag for vulnerabilities and the "KEV" flag for both vulnerabilities and exploits. It also adds an EPSS score column, providing more complete prioritization: KEV → CISA SSVC Exploitation Active → exploits → EPSS → CVSS. So, an API key is recommended. 😉

🔹 If your API key has credits, the Smart Audit feature is also available (see above).

Installation

To install the plugin, simply run the one-line script. The installer automatically finds Nmap and its NSE script directory, installs the latest vulners.nse version, and removes old 1.x files. It then runs nmap --script-updatedb and verifies the installation. The --user and --prefix options let you specify the installation directory, while --uninstall removes the plugin. If needed, the installer prompts for a Vulners API key, validates it, and saves it to ~/.nmap/vulners.key with permissions set to 600.

The Vulners team has released an updated version Getsploit

Leave a reply

The Vulners team has released an updated version Getsploit

The Vulners team has released an updated version of Getsploit. The utility allows you to search for public exploits in the Vulners.com database. It supports both an online mode (search queries are executed on the Vulners server) and a fully offline mode (exploit data from Vulners is downloaded to a local SQLite FTS5 index, which is then used for subsequent searches). I find the second option particularly interesting and useful. 😉 The data can be downloaded with a single command, getsploit --update, and the resulting database is ~1.7 GB in size.

You can then search for exploits locally, either by CVE or using full-text search:

$ getsploit --local CVE-2024-3094
$ getsploit --local "wordpress 4.7 remote code execution"

As a result, you get information about the exploits in the following format: ID, Title, and URL on the Vulners website.

If you use the "--mirror" option, the full text of the found exploits will be saved to separate files. This works with all Vulners exploit databases except githubexploit and gitee.

Why would you want to search for exploits in the first place? This can be very useful for enriching vulnerability data in your VM solution and, consequently, for better prioritization. It can also be quite useful for red teamers to keep track of new exploitation tools as they emerge. 😉

How much does it cost? Each getsploit update uses 10 credits. According to the pricing, the free plan currently includes 100 credits per month. So, if you update the exploit data once every 3 days, you can use it completely free of charge. 🆓 For $600, you can get 600 credits per month, which is enough to update getsploit roughly twice a day.

Vulners has added information on exploits

Leave a reply

Vulners has added information on exploits

Vulners has added information on exploits. But wasn’t that already available before? After all, Vulristics takes most of its exploit-related data from Vulners! 🤔

That’s true. ✅ But previously an exploit in Vulners was always a Vulners object from a specific collection. For example, an exploit page from ExploitDB. The centralized, collection-based approach works great for sources like vulnerability databases, security bulletins, and exploit packs.

However, quite often an exploit PoC is found in random places - for example, in a researcher’s blog post or on a vendor’s page. For such cases, Vulners now also stores exploits as sets of links in the vulnerability metadata. 🔗🧩 These links are collected from various sources, including NVD, GitHub, and Gitee.

The number of sources will expand, exploit information in Vulners will become more complete, and tools like Vulristics will be able to prioritize vulnerabilities even better based on that. 🧰📈

На русском

🔍 Vulners Lookup – augmented CVE reality

Leave a reply

🔍 Vulners Lookup – augmented CVE reality🔍 Vulners Lookup – augmented CVE reality🔍 Vulners Lookup – augmented CVE reality🔍 Vulners Lookup – augmented CVE reality🔍 Vulners Lookup – augmented CVE reality🔍 Vulners Lookup – augmented CVE reality🔍 Vulners Lookup – augmented CVE reality

🔍 Vulners Lookup – augmented CVE reality.

Yesterday, VulnCheck unveiled a prototype Chrome/Chromium plugin that highlights CVE identifiers on any website and shows a popup with vulnerability details, including whether the vulnerability is in the VulnCheck KEV (an extended CISA KEV). ⚡️

The Vulners team saw this news, loved the idea, and built their own plugin in just one day. 👨‍💻 CVEs are highlighted, and hovering over them shows up-to-date details: description, evidence of exploitation in the wild, and public exploits. Clicking takes you to the Vulners website, where you can explore actual exploits and attack details. 😉🚀

The wow factor is definitely here! 🤯🙂👍 News, regulatory bulletins, vulnerability top lists, and blogs are suddenly bursting with new colors. 🎨 So cool! 😎 And best of all - it’s free! 🆓

📦 While Vulners Lookup is under review in the Google plugin store, you can download and install it from the archive.

На русском

I watched a joint webinar by Vulners and RST Cloud about Vulnerability Prioritization

Leave a reply

I watched a joint webinar by Vulners and RST Cloud about Vulnerability PrioritizationI watched a joint webinar by Vulners and RST Cloud about Vulnerability PrioritizationI watched a joint webinar by Vulners and RST Cloud about Vulnerability PrioritizationI watched a joint webinar by Vulners and RST Cloud about Vulnerability Prioritization

I watched a joint webinar by Vulners and RST Cloud about Vulnerability Prioritization.

🔹 Kir Ermakov from Vulners spoke about the importance of prioritizing vulnerabilities (especially for MSSP companies, since they are responsible for customer security) and how it can be improved using dynamically updated AI Score v2. I really liked his phrase: "if you don’t know your assets very well, turn off the webinar and go do Asset Management". Asset Management is the base. 👍

🔹 Yury Sergeev from RST Cloud told how, when prioritizing vulnerabilities, take into account data on the exploitation of vulnerabilities in real attacks (in your location, in your industry, for your attacker profile). He provided a formula and demonstrated how taking these factors into account affects prioritization. I liked his regreSSHion example: there is a lot of hype, but the attack is very noticeable and takes a lot of time, so the exploitation is unlikely to be widespread.

На русском

Linux Patch Wednesday: here is this May peak!

Leave a reply

Linux Patch Wednesday: here is this May peak!

Linux Patch Wednesday: here is this May peak! 🤦‍♂️ Also about June Linux Patch Wednesday. If you remember, in my post about the May Linux Patch Wednesday I was happy that, despite the launch of the rule for Unknown dates, the peak in May was insignificant. Although "32406 oval definitions without a date received a nominal date of 2024-05-15". It turned out that the peak was not visible due to an error in the code. Ba-dum-tss! 🥸🤷‍♂️

I noticed that not all CVEs are in LPW bulletins, despite the addition of nominal dates, for example the high-profile vulnerability Elevation of Privilege (Local Privilege Escalation) - Linux Kernel (CVE-2024-1086). I could not find it anywhere. I debugged the function that distributes vulnerabilities into bulletins and added tests. I have ensured that all 38362 CVEs from the Linux OVAL content are actually distributed in bulletins. Including CVE-2024-1086. Here it is in February:

$ grep "CVE-2024-1086"  bulletins/*
bulletins/2024-02-21.json:        "CVE-2024-1086": [
bulletins/2024-02-21.json:                "title": "CVE-2024-1086 linux",
bulletins/2024-02-21.json:                "title": "CVE-2024-1086 linux",
bulletins/2024-02-21.json:                "title": "CVE-2024-1086 linux",

Well, there really is a peak in May. And how huge it is! 11476 CVEs! 😱 This is so much that I regenerated the Vulristics report for it only using 2 sources: Vulners and BDU. Since even from Vulners the data was not collected quickly enough. The report contains 77 vulnerabilities with signs of active exploitation in the wild and 1404 vulnerabilities with exploits, but without signs of active exploitation in the wild. Since for the most part these are old vulnerabilities for which it was simply not clear exactly when they were fixed, for example, Remote Code Execution - Apache HTTP Server (CVE-2021-42013), I will not analyze them in detail - for those interested, see the report. But please note that the report size is very large.

🗒 Vulristics report on the May Linux Patch Wednesday (31.3 MB)

As for the June Linux Patch Wednesday, which was finalized on June 19, there are 1040 vulnerabilities. Also quite a lot. Why is this so? On the one hand, the rule for Unknown dates added 977 Debian OVAL definitions without a date. Not 30k, like in May, but also significant. Out of 1040 vulnerabilities, 854 are Linux Kernel vulnerabilities. Moreover, there are quite a lot of "old" vulnerability identifiers, but created in 2024. For example, CVE-2021-47489 with NVD Published Date 05/22/2024. 🤔 CNA Linux Kernel is doing something strange.

🔻 With signs of exploitation in the wild again Remote Code Execution - Chromium (CVE-2024-5274, CVE-2024-4947), like in Microsoft Patch Tuesday. According to the BDU, Remote Code Execution - Libarchive (CVE-2024-26256) is also exploited in the wild.

🔸 Another 20 vulnerabilities with a public exploit. I can highlight separately Remote Code Execution - Cacti (CVE-2024-25641) and Remote Code Execution - onnx/onnx framework (CVE-2024-5187).

🗒 Vulristics report on the June Linux Patch Wednesday (4.4 MB)

RCE - Confluence (CVE-2024-21683) with public exploits on GitHub

Leave a reply

RCE - Confluence (CVE-2024-21683) with public exploits on GitHub

RCE - Confluence (CVE-2024-21683) with public exploits on GitHub. Authentication is required. Both Confluence Data Center and Confluence Server are vulnerable.

🔻 Version 8.5.9 LTS, which fixes the vulnerability, was released on May 9.
🔻 On May 23, after the description of the vulnerability in NVD and the Atlassian ticket became public, researcher Huong Kieu studied the patch, described the vulnerability and reported that he was able to make a PoC. On the same day, exploits for this vulnerability appeared on GitHub.

Atlassian likely held back information about fixing this vulnerability so that more organizations could update before active exploitation began. However, they didn’t quite succeed. Apparently they accidentally published the ticket on May 15th, and then hid it until May 23rd. But the vulnerability search engine Vulners remembered it. 😉 So information about the vulnerability was available all this time.

На русском