loading
Loading content
loading
Vulnerability Scanning
CVE scanning for known CVE and CNVD issues on a URL list. Matcher-based checks flag outdated software with published IDs. Not a live feed, not SCA.
CVE scanning for outdated software asks a focused question: does this running version have a public, matcher-proven vulnerability ID? This module runs HTTP matcher templates tagged CVE or CNVD against a URL list and reports the IDs that fire. It is not a live NVD feed, not SCA, and not setup hardening.
You feed a URL list. This module runs HTTP matcher templates tagged CVE or CNVD against those live URLs. A finding is a matcher hit for a published ID, not a live NVD query and not an SCA inventory. Coverage is the template pack at scan time.
Pipeline guidance
findings into Generate Scan Report.urls face. Same contract, different artifact class, unswappable H1s. Scan for Technology-Specific Vulnerabilities is not a sixth row here; it consumes fingerprint output, not this urls face.This family sits on the web tail after probe (hosts -> probe-web -> this family). The named-stack checks sit later: hosts -> probe-web -> web FP -> tech-specific. Do not cross-wire into hosts -> open-ports -> network FP.
Nest this after you have live web URLs and you want to know which of those URLs hit a published CVE or CNVD matcher. A root-only URL list misses nested instances; seed deeper paths from crawling or directory brute force when the vulnerable app lives under a prefix. This is stack-agnostic matching on urls. If you already named a stack and want the closed ten-stack checks, that is a different module.
urls (FILE): live web server URLs, one per line. Example: https://foo.example.com, https://bar.example.com.
header (STRING): header(s) to include in HTTP requests.
header-file (FILE): file of header(s) to include.
rate-limit (STRING): max requests per second per machine. Default 300.
findings: JSONLines rows. Published fields: finding, location, severity, hostname, domain_name, method, description, and the triggering request. Example rows: WordPress HTML5 Video Player SQL Injection (critical), Citrix Gateway and Citrix ADC Cross-Site Scripting (medium).
The tables this module produces. Sample rows are illustrative.
Matcher hits for published CVE and CNVD IDs against the live URL list.
findingtext | locationurl | severitytext | matchestext | descriptiontext | hostnametext | domain_nametext | ip_addresstext | methodtext | fieldtext | |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 | WordPress HTML5 Video Player SQL Injection | https://blog.example.com/wp-content/plugins/html5-video-player/ | critical | CVE-2024-1234 | HTML5 Video Player plugin below 1.2 is vulnerable to SQL injection. | blog.example.com | example.com | 203.0.113.10 | GET | |
| 2 | Citrix Gateway Cross-Site Scripting | https://gateway.example.com/ | medium | CVE-2024-5678 | Citrix Gateway and Citrix ADC cross-site scripting. | gateway.example.com | example.com | 198.51.100.25 | GET | |
| 3 | Apache Struts Remote Code Execution | https://legacy.example.com/struts.action | critical | CVE-2024-9012 | Apache Struts 2.5.x RCE via OGNL injection. | legacy.example.com | example.com | 203.0.113.40 | POST | action |
Artifact class it owns
Insecure setup: APIs, debug, default-state takeover
Upstream it needs
live urls
Scan for Outdated Software
Artifact class it owns
Known CVE/CNVD HTTP matchers
Upstream it needs
live urls
Artifact class it owns
Login UI, then default creds on a subset
Upstream it needs
live urls
Artifact class it owns
Token patterns in the live HTTP response
Upstream it needs
live urls
Do not 301 any of these six onto each other. Do not 301 this page onto /tools/nuclei (different object: flags and the full catalog, not this URL-list job).
questions
ten named stacks after fingerprint; not this job
template engine; flags live there, not here
Drop this module into a Trickest workflow and connect it to your upstream and downstream nodes. The face contract above is the wiring.
Get a personalized demo
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.