After your all your active and passive scanning is finished, you should have a a pretty good understanding of the technology that makes up your target. The next step is to look for weaknesses in those technologies. Vulnerability databases are a trove of information on what versions of different technologies have vulnerabilities that can be exploited. Some vulnerability entries will even have information on and links to, the exploit coded for the target vulnerability.
Vulnerability Research Databases
- National Vulnerability DB - The NIST NVD includes databases of security checklist references, security-related software flaws, misconfigurations, product names, and impact metrics.
- MITRE CVE - Identify, define, and catalog publicly disclosed cybersecurity vulnerabilities
- GitHub Advisory Database - Security vulnerability database inclusive of CVEs and GitHub originated security advisories
- cloudvulndb.org - The Open Cloud Vulnerability & Security Issue Database
- osv.dev - Open Source Vulnerabilities
- Vuldb - Public and community supported vulnerability database
- Attacker KB - Vulnerability forum where researchers can add details to a vulnerability entry.
- CVE details - Vulnerability database with some enrichment around the vulnerability
- Zero Day DB - Research and data repository for Zero-Day vulnerability discoveries.
- Security Focus - The SecurityFocus Vulnerability Database provides security professionals with the most up-to-date information on vulnerabilities for all platforms and services.
- Vulners.com - Your Search Engine for Security Intelligence
- opencve.io - Easiest way to track CVE updates and be alerted about new vulnerabilities
- Mend Vulnerability Database - The largest open source vulnerability DB
- https://vulmon.com/ - Vulmon is a vulnerability search engine with vulnerability intelligence features. Vulmon conducts full text search in its database; therefore, you can search everything related to vulnerabilities. It includes CVE ID, vulnerability types, vendors, products, exploits, operating systems and anything else related to vulnerabilities.
- https://hpi-vdb.de/vulndb/ - a comprehensive and up-to-date repository which contains a large number of known vulnerabilities of Software. The vulnerability information being gathered from Internet is evaluated, normalized, and centralized in the high performance database.
- https://snyk.io/vuln/ - Detailed information and remediation guidance for known vulnerabilities.
- VulnIQ - Vulnerability intelligence and management solution
- SynapsInt - The unified OSINT research tool
- Aqua Vulnerability Database - Vulnerabilities and weaknesses in open source applications and cloud native infrastructure
- https://inthewild.io/feed - Fantastic free vuln and exploit feed.
Exploit Databases
- Vulners DB - Lucene based search engine to parse the largest database of vulnerabilities and exploits available.
- Rapid 7 Exploit DB - A curated repository of vetted computer software exploits and exploitable vulnerabilities.
- CX Exploit DB - BugTraq, Search for published entries of vulnerabilities and related exploits
- Packet Storm Exploits - Collection of vulnerabilities and exploits pulled from across the web.
- Securiteam - A central Security web site containing all the newest security information from various mailing lists, hacker channels, tools, and knowledge.
- FullDisclosure - A public, vendor-neutral forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community.
- Shodan Exploits - Use Shodan searching capabilities to search vulnerabilities and exploits across multiple platforms
- SploitUs - Vulnerability and Exploit search engine powered by Vulners. Bonus: it has dark mode.
Exploit Evaluation
-
https://attackerkb.com - When a new vulnerability prompts discussion on Twitter or hits media outlets, it can be difficult for security teams to wade through all the hype to determine risk and priority. How pervasive is the vulnerability? Is the expected shelf life long enough that it’s worth developing an exploit for? Is it worth dropping everything to patch or mitigate? Does an adversary or threat actor have a desire or motive to exploit the opportunity? Or is it actually… not useful or interesting?
Security researchers and hackers are almost always the first to shed light on the specific conditions and characteristics that make a vulnerability not just exploitable, but actually useful to attackers. AttackerKB was built to capture, highlight, and expand that knowledge for the whole security community.
Command Line Tools
- Searchsploit - Exploit code search tool
- #sudo apt update && sudo apt install exploitdb
- #searchsploit -u
- #searchsploit [options] [term1] [term2]
- #searchsploit remote smb microsoft windows
- --exclude options to focus search, use the | operator to separate
- FindSploit - Findsploit is a simple bash script to quickly and easily search both local and online exploit databases.
- Getsploit - Command line search and download tool for Vulners Database
- Pompem - Pompem is an open source tool, designed to automate the search for Exploits and Vulnerability in the most important databases. In the current version, it performs searches in PacketStorm security, CXSecurity, ZeroDay, Vulners, National Vulnerability Database, WPScan Vulnerability Database and more.
- NSE exploit scripts - Search for exploits available in NSE
- # cd /usr/share/nmap/scripts
- # grep Exploits *.nse
{% embed url="https://youtu.be/29GlfaH5qCM" %}