8 ms·

Open-Source Detector of CISA's Known Exploitable Vulnerabilities

115 points by alaeddine001 3y ago

yieldcrv 3y ago
useful for bug bounties?
- retrochameleon 3y ago
  Useful for scanning your network for devices with known vulnerabilities.
  - jas- 3y ago
    Doesn't metasploit, OpenVAS and others already do a lot of this? Why not contribute modules there vs. write a new framework?
    - RamblingCTO 3y ago
      It seems to be using nuclei, metasploit etc. under the hood. I hope they recontribute the recipes though.
      - alaeddine001 3y ago
        Yes everything added is open-sourced: Metasploit: https://github.com/Ostorlab/agent_metasploit https://github.com/Ostorlab/agent_metasploit Nuclei: https://github.com/Ostorlab/agent_nuclei https://github.com/Ostorlab/agent_nuclei OpenVas (not used though due to many issues): https://github.com/Ostorlab/agent_openvas https://github.com/Ostorlab/agent_openvas Asteroid: https://github.com/Ostorlab/agent_asteroid https://github.com/Ostorlab/agent_asteroid
- scoot 3y ago
  No. The companies offering bug bounties have already done more than the bare minimum. Finding a vulnerability for a bug bounty requires actual work.
  - yieldcrv 3y ago
    this seems to be airing a frustration that has moved beyond accuracy in the process, companies offering bug bounties may have done the bare minimum at one point in time but every production push they do changes that, and potentially reintroduces simple scannable vulnerabilities.
    - scoot 3y ago
      That's fair. We get numerous reports from script kiddies reporting "vulnerabilities" that aren't, because they don't understand the tool that they're running, or the output that it produces, or why it isn't relevant. It's possible that they catch a known issue, but the reality is that the majority have no idea what they're doing.
  - alaeddine001 3y ago
    We did test it on Bug Bounty targets (see article) and found 2.5% of programs to suffer from at least one of these issues.
    - alaeddine001 3y ago
      https://blog.ostorlab.co/known_exploitable_vulnerabilities_catching_them_all.html https://blog.ostorlab.co/known_exploitable_vulnerabilities_c...
- batch12 3y ago
  Most programs won't pay for scanner output and will require work that demonstrates the impact of the finding, etc. Several programs I've seen actually state that automated scans are out of scope and ask the bounty hunter not to use them. With that said, this may be a good recon tool to hunt for bugs, if its allowed by the target. I am not sure how much better itd be than Qualys or Nessus, etc though. I like the idea for personal use. I was just looking for something similar the other day and for once I'm happy I don't need to build it.
NKCSS 3y ago
Looks nice. Only critique I would give is the fact that they use public DNS IP's in the examples to scan hosts I know they expect the target audience to know better, but you'd be surprised
- alaeddine001 3y ago
  Good catch, we should indeed make that explicit.
- pythonguython 3y ago
  Can you explain this? DNS resolves to an IP address, then that is scanned. What am I missing?
  - wrs 3y ago
    It can be rude/unwise/dangerous (depending on the target) to run a scanner on somebody else’s public IPs.
  - doakes 3y ago
    I think the DNS IPs are just example IPs to be scanned. You're not supplying a DNS to use for domain lookups. Using them in the example is perhaps confusing that there's some sort of DNS argument required.
deleted 3y ago
[deleted]
frantic2821 3y ago
Is anyone dealing with a large volume of vulnerabilities and getting tired of vulnerability scanners giving mundane results and not explicitly saying what to fix for your environment? We are looking for beta users to try out our MVP; it's all based on open-source too, and we are offering the service for free! There are actual experts with over 20 years of experience who will look through the vulnerabilities and prioritize according to your environment at the end of our MVP to make sure the user doesn't waste more time investigating solutions and can go back to working on their product. Automating is nice, but you do need a human to look through at the end we feel apologies for hijacking your post OP but I am curious if people flocking to such a post would be interested in being beta users for us too
- jollofricepeas 3y ago
  It’s not the results. It’s what happens after. More scanners aren’t what we need because vendors still can’t meaningfully answer the most important questions: - Is the vulnerability valid based on the environment it was found in? Solve this and you’ll reduce enterprise vulnerabilities by probably 30-40%. - What are the compensating controls? Identify these automagically and reduce the vuln risk scores based on what controls are found, you will remove another 30% of vuln work for engineering teams We don’t need any more scanners. We need better asset and vuln management.
  - SteveNuts 3y ago
    Exactly. A lot of times the vulnerability exists in something you’re not using, but it still shows up in reports. Sifting through that and writing up why that vulnerability doesn’t actually apply to your environment and showing evidence of such is an incredibly time consuming process. It’s honestly easier to just patch it, a lot of times.
  - kjok 3y ago
    I've seen startups claiming to solve these with reachability analysis. I think upgrading libs regardless could be a better solution, particularly for high-risk vulnerabilities.
letters90 3y ago
Scan Created? Scan Created where? ... Usage Instructions seem lacking.
- alaeddine001 3y ago
  Indeed the README page assumes familiarity with the scanner. Updated the readme with the basic commands and referenced another tutorial with in-depth info: https://docs.ostorlab.co/tutorials/run-your-first-scan.html https://docs.ostorlab.co/tutorials/run-your-first-scan.html
quesera 3y ago
I think the "Scanning a Domain" subheading (and body text, including subcommand name!) should be "Scanning a Host", etc. www.example.com is not a domain name, and AFAICT there is no attempt to enumerate hosts in a domain and scan them all.
- alaeddine001 3y ago
  There is, see the section "Targetting all subdomains". You can do so by adding your domain name generation tool of your choice, or all. The ones supported for now are `subfinder` and `amass`. Agent Subfinder: https://github.com/Ostorlab/agent_subfinder https://github.com/Ostorlab/agent_subfinder Agent Amass: https://github.com/Ostorlab/agent_amass https://github.com/Ostorlab/agent_amass
  - quesera 3y ago
    That's interesting. But it's under a separate subhead and takes additional config and different syntax (though the same subcommand name, which is awkward).. I think the confusion still remains. Scanning "domain-name www.example.com" will not scan a domain. (And www.example.com is not a domain name, but maybe I'm being prescriptivist here? Have we colloquially abandoned the distinction between hosts and domains? Even if so, I'd argue that a network tool should not use the colloquial sense, but I can go check for kids on my lawn if that would be more fruitful...)
    - alaeddine001 3y ago
      You are right, worth fixing.
boleary-gl 3y ago
Hello! ProjectDiscovery team member here - great to see the community leveraging Nuclei templates in new and exciting ways! Be sure to let us know how we can help, and you are welcome to open issues on GitHub or join our Discord if you have questions.
mdaniel 3y ago
That repo also has no license information that I can tell, although the pip install is Apache 2 <https://github.com/Ostorlab/ostorlab#readme https://github.com/Ostorlab/ostorlab#readme>

115 points by alaeddine001 3y ago

yieldcrv 3y ago

useful for bug bounties?

retrochameleon 3y ago
Useful for scanning your network for devices with known vulnerabilities.
- jas- 3y ago
  Doesn't metasploit, OpenVAS and others already do a lot of this? Why not contribute modules there vs. write a new framework?
  - RamblingCTO 3y ago
    It seems to be using nuclei, metasploit etc. under the hood. I hope they recontribute the recipes though.
    - alaeddine001 3y ago
      Yes everything added is open-sourced: Metasploit: https://github.com/Ostorlab/agent_metasploit https://github.com/Ostorlab/agent_metasploit Nuclei: https://github.com/Ostorlab/agent_nuclei https://github.com/Ostorlab/agent_nuclei OpenVas (not used though due to many issues): https://github.com/Ostorlab/agent_openvas https://github.com/Ostorlab/agent_openvas Asteroid: https://github.com/Ostorlab/agent_asteroid https://github.com/Ostorlab/agent_asteroid
scoot 3y ago
No. The companies offering bug bounties have already done more than the bare minimum. Finding a vulnerability for a bug bounty requires actual work.
- yieldcrv 3y ago
  this seems to be airing a frustration that has moved beyond accuracy in the process, companies offering bug bounties may have done the bare minimum at one point in time but every production push they do changes that, and potentially reintroduces simple scannable vulnerabilities.
  - scoot 3y ago
    That's fair. We get numerous reports from script kiddies reporting "vulnerabilities" that aren't, because they don't understand the tool that they're running, or the output that it produces, or why it isn't relevant. It's possible that they catch a known issue, but the reality is that the majority have no idea what they're doing.
- alaeddine001 3y ago
  We did test it on Bug Bounty targets (see article) and found 2.5% of programs to suffer from at least one of these issues.
  - alaeddine001 3y ago
    https://blog.ostorlab.co/known_exploitable_vulnerabilities_catching_them_all.html https://blog.ostorlab.co/known_exploitable_vulnerabilities_c...
batch12 3y ago
Most programs won't pay for scanner output and will require work that demonstrates the impact of the finding, etc. Several programs I've seen actually state that automated scans are out of scope and ask the bounty hunter not to use them. With that said, this may be a good recon tool to hunt for bugs, if its allowed by the target. I am not sure how much better itd be than Qualys or Nessus, etc though. I like the idea for personal use. I was just looking for something similar the other day and for once I'm happy I don't need to build it.

NKCSS 3y ago

Looks nice. Only critique I would give is the fact that they use public DNS IP's in the examples to scan hosts I know they expect the target audience to know better, but you'd be surprised

alaeddine001 3y ago
Good catch, we should indeed make that explicit.
pythonguython 3y ago
Can you explain this? DNS resolves to an IP address, then that is scanned. What am I missing?
- wrs 3y ago
  It can be rude/unwise/dangerous (depending on the target) to run a scanner on somebody else’s public IPs.
- doakes 3y ago
  I think the DNS IPs are just example IPs to be scanned. You're not supplying a DNS to use for domain lookups. Using them in the example is perhaps confusing that there's some sort of DNS argument required.

deleted 3y ago

[deleted]

frantic2821 3y ago

Is anyone dealing with a large volume of vulnerabilities and getting tired of vulnerability scanners giving mundane results and not explicitly saying what to fix for your environment? We are looking for beta users to try out our MVP; it's all based on open-source too, and we are offering the service for free! There are actual experts with over 20 years of experience who will look through the vulnerabilities and prioritize according to your environment at the end of our MVP to make sure the user doesn't waste more time investigating solutions and can go back to working on their product. Automating is nice, but you do need a human to look through at the end we feel apologies for hijacking your post OP but I am curious if people flocking to such a post would be interested in being beta users for us too

jollofricepeas 3y ago
It’s not the results. It’s what happens after. More scanners aren’t what we need because vendors still can’t meaningfully answer the most important questions: - Is the vulnerability valid based on the environment it was found in? Solve this and you’ll reduce enterprise vulnerabilities by probably 30-40%. - What are the compensating controls? Identify these automagically and reduce the vuln risk scores based on what controls are found, you will remove another 30% of vuln work for engineering teams We don’t need any more scanners. We need better asset and vuln management.
- SteveNuts 3y ago
  Exactly. A lot of times the vulnerability exists in something you’re not using, but it still shows up in reports. Sifting through that and writing up why that vulnerability doesn’t actually apply to your environment and showing evidence of such is an incredibly time consuming process. It’s honestly easier to just patch it, a lot of times.
- kjok 3y ago
  I've seen startups claiming to solve these with reachability analysis. I think upgrading libs regardless could be a better solution, particularly for high-risk vulnerabilities.

letters90 3y ago

Scan Created? Scan Created where? ... Usage Instructions seem lacking.

alaeddine001 3y ago
Indeed the README page assumes familiarity with the scanner. Updated the readme with the basic commands and referenced another tutorial with in-depth info: https://docs.ostorlab.co/tutorials/run-your-first-scan.html https://docs.ostorlab.co/tutorials/run-your-first-scan.html

quesera 3y ago

I think the "Scanning a Domain" subheading (and body text, including subcommand name!) should be "Scanning a Host", etc. www.example.com is not a domain name, and AFAICT there is no attempt to enumerate hosts in a domain and scan them all.

alaeddine001 3y ago
There is, see the section "Targetting all subdomains". You can do so by adding your domain name generation tool of your choice, or all. The ones supported for now are `subfinder` and `amass`. Agent Subfinder: https://github.com/Ostorlab/agent_subfinder https://github.com/Ostorlab/agent_subfinder Agent Amass: https://github.com/Ostorlab/agent_amass https://github.com/Ostorlab/agent_amass
- quesera 3y ago
  That's interesting. But it's under a separate subhead and takes additional config and different syntax (though the same subcommand name, which is awkward).. I think the confusion still remains. Scanning "domain-name www.example.com" will not scan a domain. (And www.example.com is not a domain name, but maybe I'm being prescriptivist here? Have we colloquially abandoned the distinction between hosts and domains? Even if so, I'd argue that a network tool should not use the colloquial sense, but I can go check for kids on my lawn if that would be more fruitful...)
  - alaeddine001 3y ago
    You are right, worth fixing.

boleary-gl 3y ago

Hello! ProjectDiscovery team member here - great to see the community leveraging Nuclei templates in new and exciting ways! Be sure to let us know how we can help, and you are welcome to open issues on GitHub or join our Discord if you have questions.

mdaniel 3y ago

That repo also has no license information that I can tell, although the pip install is Apache 2 <https://github.com/Ostorlab/ostorlab#readme https://github.com/Ostorlab/ostorlab#readme>