Open-Source Detector of CISA's Known Exploitable Vulnerabilities

[frantic2821]

Is anyone dealing with a large volume of vulnerabilities and getting tired of vulnerability scanners giving mundane results and not explicitly saying what to fix for your environment? We are looking for beta users to try out our MVP; it's all based on open-source too, and we are offering the service for free! There are actual experts with over 20 years of experience who will look through the vulnerabilities and prioritize according to your environment at the end of our MVP to make sure the user doesn't waste more time investigating solutions and can go back to working on their product. Automating is nice, but you do need a human to look through at the end we feel

apologies for hijacking your post OP but I am curious if people flocking to such a post would be interested in being beta users for us too

[jollofricepeas]

It’s not the results.

It’s what happens after.

More scanners aren’t what we need because vendors still can’t meaningfully answer the most important questions:

- Is the vulnerability valid based on the environment it was found in? Solve this and you’ll reduce enterprise vulnerabilities by probably 30-40%.

- What are the compensating controls? Identify these automagically and reduce the vuln risk scores based on what controls are found, you will remove another 30% of vuln work for engineering teams

We don’t need any more scanners. We need better asset and vuln management.

[arejaytee]

Interested

[NKCSS]

Looks nice. Only critique I would give is the fact that they use public DNS IP's in the examples to scan hosts I know they expect the target audience to know better, but you'd be surprised

[alaeddine001]

Good catch, we should indeed make that explicit.

[pythonguython]

Can you explain this? DNS resolves to an IP address, then that is scanned. What am I missing?

[mdaniel]

That repo also has no license information that I can tell, although the pip install is Apache 2 <https://github.com/Ostorlab/ostorlab#readme>

[quesera]

I think the "Scanning a Domain" subheading (and body text, including subcommand name!) should be "Scanning a Host", etc.

www.example.com is not a domain name, and AFAICT there is no attempt to enumerate hosts in a domain and scan them all.

[alaeddine001]

There is, see the section "Targetting all subdomains".

You can do so by adding your domain name generation tool of your choice, or all. The ones supported for now are `subfinder` and `amass`.

Agent Subfinder: https://github.com/Ostorlab/agent_subfinder Agent Amass: https://github.com/Ostorlab/agent_amass

[boleary-gl]

Hello! ProjectDiscovery team member here - great to see the community leveraging Nuclei templates in new and exciting ways!

Be sure to let us know how we can help, and you are welcome to open issues on GitHub or join our Discord if you have questions.

[letters90]

Scan Created? Scan Created where? ...

Usage Instructions seem lacking.

[alaeddine001]

Indeed the README page assumes familiarity with the scanner.

Updated the readme with the basic commands and referenced another tutorial with in-depth info: https://docs.ostorlab.co/tutorials/run-your-first-scan.html

[yieldcrv]

useful for bug bounties?

[batch12]

Most programs won't pay for scanner output and will require work that demonstrates the impact of the finding, etc. Several programs I've seen actually state that automated scans are out of scope and ask the bounty hunter not to use them. With that said, this may be a good recon tool to hunt for bugs, if its allowed by the target. I am not sure how much better itd be than Qualys or Nessus, etc though.

I like the idea for personal use. I was just looking for something similar the other day and for once I'm happy I don't need to build it.

[scoot]

No. The companies offering bug bounties have already done more than the bare minimum. Finding a vulnerability for a bug bounty requires actual work.

[retrochameleon]

Useful for scanning your network for devices with known vulnerabilities.