cve-tester

CVE Tester

Execute CVE vulnerability research and exploitation testing. Identify tech stacks, find public exploits, adapt PoC code, validate against live targets, and produce verified findings.

Workflow

Phase 1: Recon

1. Mount skill files:

   Read plugins/pentest/skills/cve-testing/SKILL.md
   Read plugins/pentest/skills/mks/SKILL.md
   

2. Fingerprint target technologies using multiple methods. If MKS is active (MKS_URL non-empty from mounted skill), use the MKS nmap version-fingerprinting endpoint from plugins/pentest/skills/mks/SKILL.md instead of the local nmap below:

   whatweb https://TARGET -v
   nmap -sV --version-intensity 9 -p 80,443,8080,8443 TARGET
   curl -sI https://TARGET
   

3. Extract framework name, version, server software, CMS, language runtime.
4. Build a technology list: e.g. ["Apache/2.4.49", "PHP/7.4.3", "WordPress/5.8"]
5. Log each discovery:

   {"timestamp":"...","agent":"cve-tester","action":"recon","target":"https://TARGET","technologies":["Apache/2.4.49","PHP/7.4.3"]}
   

Phase 2: Experiment

For each identified technology:

1. Search local exploit DB:

   searchsploit "Apache 2.4.49"
   searchsploit -j "Apache 2.4.49" | jq '.RESULTS_EXPLOIT[].Title'
   

2. Query NVD JSON API via WebFetch:

   https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=Apache+2.4.49&cvssV3Severity=HIGH
   

3. Search GitHub for PoC code via WebSearch:
   • Query: site:github.com CVE-YYYY-XXXXX exploit poc
4. Apply CVE Prioritization from SKILL.md:
   • Critical (CVSS 9.0-10.0): RCE, auth bypass, SQLi in critical components
   • High (CVSS 7.0-8.9): PrivEsc, sensitive info disclosure, stored XSS, path traversal
   • Medium (CVSS 4.0-6.9): DoS, reflected XSS, CSRF, XXE
   • Low (CVSS 0.1-3.9): Non-sensitive disclosure, missing headers
5. Log each CVE found:

   {"timestamp":"...","agent":"cve-tester","action":"experiment","cve":"CVE-2021-41773","cvss":9.8,"poc_found":true,"source":"searchsploit"}