.TH SploitScan 1 "Version 0.9" "SploitScan user manual"
.SH NAME
\fBSploitScan\fP - A tool to fetch and display vulnerability information and public exploits for given CVE IDs.
.SH 📜 Description
.PP
SploitScan is a powerful and user\-friendly tool designed to streamline the process of identifying exploits for known vulnerabilities and their respective exploitation probability. Empowering cybersecurity professionals with the capability to swiftly identify and apply known and test exploits. It's particularly valuable for professionals seeking to enhance their security measures or develop robust detection strategies against emerging threats.
.SH 🌟 Features
.RS
.IP \(bu 2
\fBCVE Information Retrieval\fP: Fetches CVE details from the National Vulnerability Database.
.IP \(bu 2
\fBEPSS Integration\fP: Includes Exploit Prediction Scoring System (EPSS) data, offering a probability score for the likelihood of CVE exploitation, aiding in prioritization.
.IP \(bu 2
\fBPublic Exploits Aggregation\fP: Gathers publicly available exploits, enhancing the understanding of vulnerabilities.
.IP \(bu 2
\fBCISA KEV\fP: Shows if the CVE has been listed in the Known Exploited Vulnerabilities (KEV) of CISA.
.IP \(bu 2
\fBPatching Priority System\fP: Evaluates and assigns a priority rating for patching based on various factors including public exploits availability.
.IP \(bu 2
\fBMulti\-CVE Support and Export Options\fP: Supports multiple CVEs in a single run and allows exporting the results to HTML, JSON and CSV formats.
.IP \(bu 2
\fBVulnerability Scanner Import\fP: Import vulnerability scans from popular vulnerability scanners and search directly for known exploits.
.IP \(bu 2
\fBAI\-Powered Risk Assessment\fP: Leverages OpenAI to provide detailed risk assessments, potential attack scenarios, mitigation recommendations, and executive summaries.
.IP \(bu 2
\fBUser\-Friendly Interface\fP: Easy to use, providing clear and concise information.
.IP \(bu 2
\fBComprehensive Security Tool\fP: Ideal for quick security assessments and staying informed about recent vulnerabilities.
.RE
.SH 💣 Supported Exploit Databases
.RS
.IP \(bu 2
\fBGitHub \[la]https://poc-in-github.motikan2010.net/\[ra]\fP
.IP \(bu 2
\fBExploitDB \[la]https://www.exploit-db.com/\[ra]\fP
.IP \(bu 2
\fBVulnCheck \[la]https://vulncheck.com/\[ra]\fP (requires a \fBfree\fP VulnCheck API key)
.IP \(bu 2
\fBPacket Storm \[la]https://packetstormsecurity.com/\[ra]\fP
.IP \(bu 2
\fBNuclei \[la]https://github.com/projectdiscovery/nuclei-templates\[ra]\fP
.RE
.SH 📁 Supported Vulnerability Scanner Import
.RS
.IP \(bu 2
\fBNessus \[la]https://www.tenable.com/products/nessus\[ra] (.nessus)\fP
.IP \(bu 2
\fBNexpose \[la]https://www.rapid7.com/products/nexpose/\[ra] (.xml)\fP
.IP \(bu 2
\fBOpenVAS \[la]https://www.openvas.org/\[ra] (.xml)\fP
.IP \(bu 2
\fBDocker \[la]https://docs.docker.com/scout/\[ra] (.json)\fP:
.RS
.IP \(bu 2
\fB\fC$ docker scout cves <image> \-\-format sarif \-\-output image_scan.json\fR
.RE
.RE
.SH 🚀 Usage
.PP
\fBRegular\fP:
.PP
.RS
.nf
$ python sploitscan.py CVE\-YYYY\-NNNNN
.fi
.RE
.PP
\fBEnter one or more CVE IDs to fetch data. Separate multiple CVE IDs with spaces.\fP
.PP
.RS
.nf
$ python sploitscan.py CVE\-YYYY\-NNNNN CVE\-YYYY\-NNNNN
.fi
.RE
.PP
\fBOptional: Import functionality. Specify the type: 'nessus', 'nexpose', 'openvas' or 'docker' and import file.\fP
.PP
.RS
.nf
$ python sploitscan.py \-\-import\-file path/to/yourfile.nessus \-\-type nessus
.fi
.RE
.PP
\fBOptional: Export the results to a JSON, CSV or HTML file. Specify the format: 'json', 'csv' or 'html'.\fP
.PP
.RS
.nf
$ python sploitscan.py CVE\-YYYY\-NNNNN \-e HTML
.fi
.RE
.PP
\fBDocker\fP 
.PP
.RS
.nf
$ docker build \-t sploitscan .
$ docker run \-\-rm sploitscan CVE\-2024\-1709

With a volume mounted from the current directory

Windows (Powershell)
$ docker run \-v ${PWD}:/app \-\-rm sploitscan CVE\-2024\-1709 \-e JSON

Linux
$ docker run \-v $(pwd):/app \-\-rm sploitscan CVE\-2024\-1709 \-e JSON
.fi
.RE
.SH 🛡️ Patching Prioritization System
.PP
The Patching Prioritization System in SploitScan provides a strategic approach to prioritizing security patches based on the severity and exploitability of vulnerabilities. It's influenced by the model from CVE Prioritizer \[la]https://github.com/TURROKS/CVE_Prioritizer\[ra], with enhancements for handling publicly available exploits. Here's how it works:
.RS
.IP \(bu 2
A+ Priority: Assigned to CVEs listed in CISA's KEV or those with publicly available exploits. This reflects the highest risk and urgency for patching.
.IP \(bu 2
A to D Priority: Based on a combination of CVSS scores and EPSS probability percentages. The decision matrix is as follows:
.RS
.IP \(bu 2
A: CVSS score >= 6.0 and EPSS score >= 0.2. High severity with a significant probability of exploitation.
.IP \(bu 2
B: CVSS score >= 6.0 but EPSS score < 0.2. High severity but lower probability of exploitation.
.IP \(bu 2
C: CVSS score < 6.0 and EPSS score >= 0.2. Lower severity but higher probability of exploitation.
.IP \(bu 2
D: CVSS score < 6.0 and EPSS score < 0.2. Lower severity and lower probability of exploitation.
.RE
.RE
.PP
This system assists users in making informed decisions on which vulnerabilities to patch first, considering both their potential impact and the likelihood of exploitation. Thresholds can be changed to your business needs.
.SH 📆 Changelog
.SS [24. May 2024] \- Version 0.9
.RS
.IP \(bu 2
\fBAI\-Powered Risk Assessment\fP: Integrated OpenAI for detailed risk assessments, potential attack scenarios, mitigation recommendations, and executive summaries (needs OpenAI API key).
.IP \(bu 2
\fBCVE Information Retrieval\fP: Due to API rate limits and instabilities replaced NIST NVD with CVE Program \[la]https://github.com/CVEProject/cvelistV5\[ra]\&.
.IP \(bu 2
\fBGeneral Improvements\fP: Various bug fixes and performance improvements.
.RE
.SS [18. May 2024] \- Version 0.8
.RS
.IP \(bu 2
\fBHTML Export Functionality\fP: Introduced the ability to export vulnerability data to HTML reports.
.IP \(bu 2
\fBPacket Storm Integration\fP: Added support for fetching exploit data from Packet Storm.
.IP \(bu 2
\fBEnhanced Display Functions\fP: Added CVE\fIGITHUB\fPURL as CVE source, and functions to output the most updated CVE source.
.IP \(bu 2
\fBCode Refactoring\fP: Refactored code to improve maintainability and readability due to the growing code base.
.RE
.SS [11. May 2024] \- Version 0.7
.RS
.IP \(bu 2
\fBNuclei Template Integration\fP: Added support for discovery of Nuclei templates, enhancing vulnerability data sources.
.IP \(bu 2
\fBEnhanced Display Functions\fP: Refined visual output across all display functions for consistency and readability.
.IP \(bu 2
\fBGeneral Improvements\fP: Various bug fixes and performance improvements such as improved error handling.
.RE
.SS [06. May 2024] \- Version 0.6.1
.RS
.IP \(bu 2
\fBImport File Capabilities\fP: Added support for importing vulnerability data directly from Docker Scout scan files.
.RE
.SS [05. May 2024] \- Version 0.6
.RS
.IP \(bu 2
\fBImport File Capabilities\fP: Added support for importing vulnerability data directly from Nessus, Nexpose, and OpenVAS scan files.
.IP \(bu 2
\fBExpanded Command\-Line Options\fP: Introduced new command\-line options to specify the import file and its type.
.IP \(bu 2
\fBRobust Configuration Management\fP: Improved error handling for missing or malformed configuration files.
.IP \(bu 2
\fBGeneral Improvements\fP: Various bug fixes and performance improvements.
.RE
.SS [02. March 2024] \- Version 0.5
.RS
.IP \(bu 2
\fBExploitDB Integration\fP: Added support for fetching exploit data from ExploitDB.
.IP \(bu 2
\fBCVSS Enhancements\fP: Added support for CVSS 2 and CVSS 3.x
.IP \(bu 2
\fBDocker support\fP
.IP \(bu 2
\fBCode fixes\fP
.RE
.SS [28. February 2024] \- Version 0.4
.RS
.IP \(bu 2
\fBVulnCheck Integration\fP: Added support for fetching exploit data from VulnCheck, enhancing the exploit information available.
.IP \(bu 2
\fBAPI Key Configuration\fP: Introduced the requirement for a VulnCheck API key, specified in config.json.
.IP \(bu 2
\fBRequirements satisfied for Debian Integration\fP
.RE
.SS [17. February 2024] \- Version 0.3
.RS
.IP \(bu 2
\fBAdditional Information\fP: Added further information such as references & vector string
.IP \(bu 2
\fBRemoved\fP: Star count in publicly available exploits
.RE
.SS [15. January 2024] \- Version 0.2
.RS
.IP \(bu 2
\fBMultiple CVE Support\fP: Now capable of handling multiple CVE IDs in a single execution.
.IP \(bu 2
\fBJSON and CSV Export\fP: Added functionality to export results to JSON and CSV files.
.IP \(bu 2
\fBEnhanced CVE Display\fP: Improved visual differentiation and information layout for each CVE.
.IP \(bu 2
\fBPatching Priority System\fP: Introduced a priority rating system for patching, influenced by various factors including the availability of public exploits.
.RE
.SS [13th January 2024] \- Version 0.1
.RS
.IP \(bu 2
Initial release of SploitScan.
.RE
.SH 🫱🏼‍🫲🏽 Contributing
.PP
Contributions are welcome. Please feel free to fork, modify, and make pull requests or report issues.
.RS
.IP \(bu 2
Nilsonfsilva \[la]https://github.com/Nilsonfsilva\[ra] for support on Debian packaging.
.IP \(bu 2
bcoles \[la]https://github.com/bcoles\[ra] for bugfixes.
.IP \(bu 2
Javier Álvarez \[la]https://github.com/jalvarezz13\[ra] for bugfixes.
.IP \(bu 2
Romullo \[la]https://github.com/Romullo\[ra] for ideas & suggestions.
.IP \(bu 2
davidfortytwo \[la]https://github.com/davidfortytwo\[ra] for enhancements (Updated CVE retrieval and PacketStorm addition).
.RE
.SH 📌 Author
.PP
\fBAlexander Hagenah\fP
\- URL \[la]https://primepage.de\[ra]
\- Twitter \[la]https://twitter.com/xaitax\[ra]
\- LinkedIn \[la]https://www.linkedin.com/in/alexhagenah\[ra]
.SH 📚 References
.RS
.IP \(bu 2
CVE Program \[la]https://github.com/CVEProject/cvelistV5\[ra]
.IP \(bu 2
FIRST EPSS \[la]https://www.first.org/epss/api\[ra]
.IP \(bu 2
CISA Known Exploited Vulnerabilities Catalog \[la]https://www.cisa.gov/known-exploited-vulnerabilities-catalog\[ra]
.IP \(bu 2
nomi\-sec PoC\-in\-GitHub API \[la]https://poc-in-github.motikan2010.net/\[ra]
.IP \(bu 2
VulnCheck \[la]https://vulncheck.com/\[ra]
.IP \(bu 2
ExploitDB \[la]https://www.exploit-db.com/\[ra]
.IP \(bu 2
ProjectDiscovery Nuclei \[la]https://github.com/projectdiscovery/nuclei-templates\[ra]
.IP \(bu 2
Packet Storm \[la]https://packetstormsecurity.com/\[ra]
.IP \(bu 2
OpenAI \[la]https://openai.com/\[ra]
.RE