Open-Source Detector of CISA's Known Exploitable Vulnerabilities

https://github.com/Ostorlab/KEV

by alaeddine001 • 3 years ago

115 49 3 years ago

github.com

yieldcrv2• 3 years ago

useful for bug bounties?

retrochameleon• 3 years ago

Useful for scanning your network for devices with known vulnerabilities.

jas-• 3 years ago

Doesn't metasploit, OpenVAS and others already do a lot of this? Why not contribute modules there vs. write a new framework?

scoot2• 3 years ago

No. The companies offering bug bounties have already done more than the bare minimum. Finding a vulnerability for a bug bounty requires actual work.

yieldcrv2• 3 years ago

this seems to be airing a frustration that has moved beyond accuracy in the process, companies offering bug bounties may have done the bare minimum at one point in time but every production push they do changes that, and potentially reintroduces simple scannable vulnerabilities.

alaeddine0017• 3 years ago

We did test it on Bug Bounty targets (see article) and found 2.5% of programs to suffer from at least one of these issues.

batch12• 3 years ago

Most programs won't pay for scanner output and will require work that demonstrates the impact of the finding, etc. Several programs I've seen actually state that automated scans are out of scope and ask the bounty hunter not to use them. With that said, this may be a good recon tool to hunt for bugs, if its allowed by the target. I am not sure how much better itd be than Qualys or Nessus, etc though.

I like the idea for personal use. I was just looking for something similar the other day and for once I'm happy I don't need to build it.

NKCSS• 3 years ago

Looks nice. Only critique I would give is the fact that they use public DNS IP's in the examples to scan hosts I know they expect the target audience to know better, but you'd be surprised

alaeddine0017• 3 years ago

Good catch, we should indeed make that explicit.

pythonguython• 3 years ago

Can you explain this? DNS resolves to an IP address, then that is scanned. What am I missing?

wrs• 3 years ago

It can be rude/unwise/dangerous (depending on the target) to run a scanner on somebody else’s public IPs.

doakes• 3 years ago

I think the DNS IPs are just example IPs to be scanned. You're not supplying a DNS to use for domain lookups. Using them in the example is perhaps confusing that there's some sort of DNS argument required.

frantic282112• 3 years ago

Is anyone dealing with a large volume of vulnerabilities and getting tired of vulnerability scanners giving mundane results and not explicitly saying what to fix for your environment? We are looking for beta users to try out our MVP; it's all based on open-source too, and we are offering the service for free! There are actual experts with over 20 years of experience who will look through the vulnerabilities and prioritize according to your environment at the end of our MVP to make sure the user doesn't waste more time investigating solutions and can go back to working on their product. Automating is nice, but you do need a human to look through at the end we feel

apologies for hijacking your post OP but I am curious if people flocking to such a post would be interested in being beta users for us too

jollofricepeas• 3 years ago

It’s not the results.

It’s what happens after.

More scanners aren’t what we need because vendors still can’t meaningfully answer the most important questions:

- Is the vulnerability valid based on the environment it was found in? Solve this and you’ll reduce enterprise vulnerabilities by probably 30-40%.

- What are the compensating controls? Identify these automagically and reduce the vuln risk scores based on what controls are found, you will remove another 30% of vuln work for engineering teams

We don’t need any more scanners. We need better asset and vuln management.

SteveNuts• 3 years ago

Exactly. A lot of times the vulnerability exists in something you’re not using, but it still shows up in reports.

Sifting through that and writing up why that vulnerability doesn’t actually apply to your environment and showing evidence of such is an incredibly time consuming process. It’s honestly easier to just patch it, a lot of times.

kjok• 3 years ago

I've seen startups claiming to solve these with reachability analysis. I think upgrading libs regardless could be a better solution, particularly for high-risk vulnerabilities.

FuriouslyAdrift2• 3 years ago

I've gotten more use out of Microsoft's "Security Score" to identify and advise on mitigation in my environment than most other "automated" options.

Paying a managed service to advise is also an option. I have heard Huntress is pretty good. I am sure there are others out there.

frantic282112• 3 years ago

That is exactly what we are targeting! We know it's hard hence looking for users for whom we can tune the controls better for someone's specific environment - we will be able to do this as we have years of experience. This is kind of a side project/service we are going for and not our main business, so we are not looking to sell anything, but we are looking to understand the problem and space better.

Complete support is provided through Slack to (or however you wish), so you know you don't have to wait for any kind of support.

We know there are plenty of scanners out there. Hence we are using an open-source one and working on how we can improve the 'what happens after' part by using human-led expertise to save others their time

- Is the vulnerability valid based on the environment it was found in? Solve this and you’ll reduce enterprise vulnerabilities by probably 30-40%. --> Having a human expert confirm and filter the list is what we are offering to our closed beta users for now so yes that is what we are targeting to solve!

- What are the compensating controls? Identify these automagically and reduce the vuln risk scores based on what controls are found, you will remove another 30% of vuln work for engineering teams --> We have a list of controls we've identified, but we know each environment is different, hence looking for users we can tune our controls to

We are particularly looking for users who are in small organizations looking to grow rapidly. Ultimately, we are looking to save other devs time by taking over the cumbersome work.

ZeroSolstice3• 3 years ago

I would add the additional problem of CVE's being devoid of any useful information which lead to generic tests being created by vulnerability scanners as they have the same lack of insight as everyone else thats trying to patch the issue. Thus creating higher false positives or wasted effort trying to confirm an exploit yourself. I get not wanting to provide a PoC because "script kiddies" might use them but if we want vulnerabilities patched regularly you have to provide better assurances that they are valid and that we can show they are patched aka tests.

arejaytee• 3 years ago

Interested

frantic282112• 3 years ago

@areyjaytee Best way to reach you? Spruced up a quick landing page (ignore the UI for now) - https://labs.stack.io/vulnerability-scanner

Please sign up and let me know when you do so we can share more?

letters90• 3 years ago

Scan Created? Scan Created where? ...

Usage Instructions seem lacking.

alaeddine0017• 3 years ago

Indeed the README page assumes familiarity with the scanner.

Updated the readme with the basic commands and referenced another tutorial with in-depth info: https://docs.ostorlab.co/tutorials/run-your-first-scan.html

quesera2• 3 years ago

I think the "Scanning a Domain" subheading (and body text, including subcommand name!) should be "Scanning a Host", etc.

www.example.com is not a domain name, and AFAICT there is no attempt to enumerate hosts in a domain and scan them all.

alaeddine0017• 3 years ago

There is, see the section "Targetting all subdomains".

You can do so by adding your domain name generation tool of your choice, or all. The ones supported for now are `subfinder` and `amass`.

Agent Subfinder: https://github.com/Ostorlab/agent_subfinder Agent Amass: https://github.com/Ostorlab/agent_amass

quesera2• 3 years ago

That's interesting. But it's under a separate subhead and takes additional config and different syntax (though the same subcommand name, which is awkward)..

I think the confusion still remains. Scanning "domain-name www.example.com" will not scan a domain. (And www.example.com is not a domain name, but maybe I'm being prescriptivist here? Have we colloquially abandoned the distinction between hosts and domains? Even if so, I'd argue that a network tool should not use the colloquial sense, but I can go check for kids on my lawn if that would be more fruitful...)

boleary-gl• 3 years ago

Hello! ProjectDiscovery team member here - great to see the community leveraging Nuclei templates in new and exciting ways!

Be sure to let us know how we can help, and you are welcome to open issues on GitHub or join our Discord if you have questions.

mdaniel• 3 years ago

That repo also has no license information that I can tell, although the pip install is Apache 2 <https://github.com/Ostorlab/ostorlab#readme>

Open-Source Detector of CISA's Known Exploitable Vulnerabilities

Related Stories