duriandurino/vuln

Vulnerability Analysis Skill

Analyze discovered services and versions against known CVEs. Identify what's exploitable before attempting exploitation.

When to Use

✅ USE this skill when:

• "Check for vulnerabilities on this host"
• "What CVEs affect OpenSSH 8.2p1?"
• "Analyze these scan results for known weaknesses"
• "Is this service exploitable?"
• "Run vulnerability scripts against this target"
• "Research exploitability of what we found"
• "What's the risk of running this version?"

When NOT to Use

❌ DON'T use this skill when:

• Still gathering service info → use enum skill
• Ready to exploit → use exploit skill
• Post-compromise work → use post skill
• Passive recon → use recon skill

Automation-First Workflow

Prefer the standardized wrappers under scripts/ before doing one-off research commands.

Recommended Default Profile

For web-facing service analysis with parsed enum artifacts:

python3 scripts/orchestration/run_vuln_profile.py \
  --profile vuln-web-service \
  --target <TARGET-OR-URL> \
  --engagement <target-name> \
  --input <parsed-enum-json>

Step 1 — Review Parsed Enum Results

Start from the structured enum artifacts when available:

cat engagements/<target>/enum/parsed/*.json
cat engagements/<target>/enum/summaries/*.md

Step 2 — Version-to-CVE Candidate Mapping

python3 scripts/vuln/cve-mapping/map_versions_to_cves.py \
  --input <parsed-enum-json> \
  --engagement <target-name>

Step 3 — Searchsploit Automation

scripts/vuln/cve-mapping/searchsploit_auto.sh \
  --input <parsed-enum-json> \
  --engagement <target-name>

Step 4 — Web Baseline Checks

scripts/vuln/web/web_baseline.sh --target <TARGET-OR-URL> --engagement <target-name> --safe

Legacy / Manual Research

Use manual commands when wrappers do not cover the case or you need deeper confirmation:

# All vuln scripts against discovered ports
nmap -sV --script vuln -p <PORTS> <TARGET>

# Specific vulnerability checks
nmap -sV --script ssl-heartbleed,ssl-poodle,http-shellshock,smb-vuln-ms17-010 -p <PORTS> <TARGET>

# Direct searchsploit use
searchsploit openssh 8.2
searchsploit vsftpd 3.0.3

# Direct CVE database lookups
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=openssh+8.2&resultsPerPage=5"

Step 5 — Risk Assessment

For each identified vulnerability, assess:

| Factor | Question | |--------|----------| | Exploitability | Is there a public exploit? How complex? | | Access level | What access is needed? (local, remote, unauthenticated) | | Impact | What's the worst-case outcome? (RCE, DoS, info leak) | | Affected version | Is the target version confirmed vulnerable? | | Mitigations | Are there any mitigating controls in place? |

CVE Matching from Versions

When a service version is identified, cross-reference with known CVEs:

# Automated version-to-CVE mapping
python3 scripts/cve_lookup.py --service openssh --version "8.2p1"
python3 scripts/cve_lookup.py --service vsftpd --version "3.0.3"
python3 scripts/cve_lookup.py --file engagements/<target>/enum/enum-<target>-*.json

Vulnerability Classification

| Category | Examples | |----------|---------| | Remote Code Execution | CVE-2024-6387 (regreSSHion), Shellshock | | Authentication Bypass | Default creds, auth bypass in web apps | | Privilege Escalation | Local privesc via SUID, kernel exploits | | Information Disclosure | Directory traversal, info leak in headers | | Denial of Service | Network-level DoS, resource exhaustion | | Injection | SQLi, command injection, XSS |

NSE Script Categories

| Category | What it checks | |----------|---------------| | vuln | Known CVEs with PoC | | auth | Authentication issues | | default | Default settings/credentials | | intrusive | May disrupt service | | safe | Non-intrusive checks |

Output Format

Document findings in engagements/<target>/vuln/ following the workspace engagement structure. The orchestrator will specify the target name. Preserve original filenames. NEVER create ad-hoc directories.

# Vulnerability Analysis — <target>

## Services Analyzed
| Port | Service | Version | Status |
|------|---------|---------|--------|
| 22 | ssh | OpenSSH 8.2p1 | VULNERABLE — CVE-2024-6387 |
| 80 | http | Apache 2.4.41 | OK (but missing headers) |

## Findings
### CVE-2024-6387 — regreSSHion
- **CVSS:** 9.8 (Critical)
- **Affected:** OpenSSH 8.2p1-9.6p1
- **Exploit:** Public, reliable RCE as root
- **Exploitable:** YES
- **Notes:** Signal handler race condition, unauthenticated RCE

Decision Tree

Service + Version identified
    │
    ├── searchsploit returns results?
    │     ├── YES → Document CVE, check exploit availability
    │     └── NO → Check NSE vuln scripts
    │
    ├── NSE vuln scripts flag it?
    │     ├── YES → Confirm with CVE database
    │     └── NO → Check version against NVD
    │
    └── Any confirmed vulns?
          ├── YES → Prioritize for exploitation (next phase)
          └── NO → Document as "no known CVEs" — note for manual testing

testing