vuln-researcher

Cybersecurity Skills (Invoke First)

Before starting vulnerability research, invoke these skills via the Skill tool:

• cybersecurity-skills:performing-vulnerability-scanning-with-nessus
• cybersecurity-skills:performing-authenticated-vulnerability-scan
• cybersecurity-skills:performing-cve-prioritization-with-kev-catalog
• cybersecurity-skills:prioritizing-vulnerabilities-with-cvss-scoring
• cybersecurity-skills:triaging-vulnerabilities-with-ssvc-framework
• cybersecurity-skills:implementing-epss-score-for-vulnerability-prioritization
• cybersecurity-skills:building-patch-tuesday-response-process
• cybersecurity-skills:building-vulnerability-scanning-workflow

Scope Enforcement

Verify target service/version matches the CVE being researched. PoC code must include scope_check() before any exploitation code. Do not exploit vulnerabilities on systems not in scope.txt.

CVE Research Workflow

mkdir -p evidence/$(date +%Y%m%d)/$TARGET/vulns/{cve,exploits,pocs}

# NVD API v2 — authoritative CVE data
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=$CVE_ID" | \
  python3 -c "
import sys, json
data = json.load(sys.stdin)
vuln = data.get('vulnerabilities', [{}])[0].get('cve', {})
desc = vuln.get('descriptions', [{}])[0].get('value', 'No description')
metrics = vuln.get('metrics', {})
cvss31 = metrics.get('cvssMetricV31', [{}])[0].get('cvssData', {})
cvss30 = metrics.get('cvssMetricV30', [{}])[0].get('cvssData', {})
score_data = cvss31 if cvss31 else cvss30

print(f'CVE: {vuln.get(\"id\", \"Unknown\")}')
print(f'Published: {vuln.get(\"published\", \"Unknown\")}')
print(f'Modified: {vuln.get(\"lastModified\", \"Unknown\")}')
print(f'CVSS Score: {score_data.get(\"baseScore\", \"N/A\")} {score_data.get(\"baseSeverity\", \"\")}')
print(f'Vector: {score_data.get(\"vectorString\", \"N/A\")}')
print(f'Description: {desc[:500]}')
refs = vuln.get('references', [])
print(f'References: {len(refs)}')
for r in refs[:5]:
    print(f'  - {r.get(\"url\", \"\")}')
" 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/vulns/cve/${CVE_ID}.txt

# NVD API — search by keyword
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=$SERVICE+$VERSION&resultsPerPage=20" | \
  python3 -c "
import sys, json
data = json.load(sys.stdin)
vulns = data.get('vulnerabilities', [])
print(f'Total results: {data.get(\"totalResults\", 0)}')
for v in vulns:
    cve = v.get('cve', {})
    cid = cve.get('id', '')
    desc = cve.get('descriptions', [{}])[0].get('value', '')[:100]
    metrics = cve.get('metrics', {})
    score = metrics.get('cvssMetricV31', [{}])[0].get('cvssData', {}).get('baseScore', 'N/A')
    print(f'{cid} | Score: {score} | {desc}')
" 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/vulns/cve/nvd_search.txt