Sources of Vulnerabilities

[Sinderella]

• [x] Exploit-DB - Offensive Security Exploit Database
• [x] 0day.today - 0day today
• [x] Packet Storm - Packet Storm Global Security Resource
• [ ] Core Impact - Core Impacts search functionality
• [ ] Iranian Exploit DB Iranian Exploit database
• [ ] CVE - MITRE CVE (see #26)
• [ ] NVD - US National Vulnerability Database
• [ ] CERT - US Computer Emergency Readiness Team
• [ ] OSVDB - Open Sourced Vulnerability Database
• [ ] Bugtraq - Symantec SecurityFocus ! this redirects to securityfocus now
• [ ] Fulldisclosure - Full Disclosure Mailing List
• [ ] MS Bulletin - Microsoft Security Bulletin
• [ ] MS Advisory - Microsoft Security Advisories
• [ ] SecuriTeam - Securiteam Vulnerability Information
• [ ] CXSecurity - CSSecurity Bugtraq List
• [ ] Vulnerability Laboratory - Vulnerability Research Laboratory
• [ ] ZDI - Zero Day Initiative
• [ ] Metasploit - Rapid7 Metasploit
• [x] SecurityFocus - Security Focus (see #4)
• [ ] Security Database - Security Database
• [ ] VulDB - Vulnerability Database

source: https://github.com/enaqx/awesome-pentest#vulnerability-databases

Just a suggestion, create an issue for each of them and someone should pick it up.

[ngkogkos]

From my understanding: http://cve-search.org/software/#public-web-api-of-cve-search

If we use the cve-search API, then we can probably get all the results in the above CVE vendors, so it would be cool to run a module for that first, then judge which ones to scrape I guess? Or maybe the API even provides all the required info.

[Sinderella]

@ngkogkos anything we could use to improve our tool here?

[ngkogkos]

@Sinderella that blog post is not bad, there are some sources in there that we dont have in our sources. One day he may update it to refer ephe :)

Lets have a look into it again in the future.

[ngkogkos]

Probably a very future idea would be harvesting social media as well, mostly Twitter I guess, for any exploit or CVE references 💃

[ngkogkos]

From your blog post @Sinderella have you checked http://iedb.ir/search.php? Looks very script-kiddish but again maybe there will be something there not elsewhere? Highly doubt it though but looks like we could add one more searcher for it quite easily. (inb4 it goes down immediately after we implement it)