## https://sploitus.com/exploit?id=5492EA28-B573-5363-B9A7-7FDE68BB24D6
## VulnScope
**POC (Proof of Concept) Vulnerability Verification Script Management System**
With POC as the core asset, it provides management, storage, retrieval, import/export, labeling, and CVE association capabilities.
### Features
- **POC Full Lifecycle Management** – Creation, editing, version rollback, cloning, and status transition.
- **Multi-format Support** – Nuclei YAML, Pocsuite3, JSON, raw scripts; architecture is format-independent.
- **Batch Import/Export** – Automatic format sniffing, content deduplication, and multi-file support.
- **Labeling System** – Namespace labels and tree-structured categorization for flexible organization of POC assets.
- **CVE Vulnerability Database** – CVE numbers are automatically associated; vulnerabilities and POCs can be retrieved bidirectionally.
- **Statistics Dashboard** – Severity levels, status, source distribution, creation trends, popular tags, high-yield authors.
- **RBAC Permissions** – Roles like viewer, editor, and administrator with granular operation control.
- **Audit Logs** – Full records of all write operations, summaries before and after operations, and IP records.
- **Plugin Framework** – Four slots for Parser, Source, Verifier, and Exporter; plug-and-play.
- **Event-Driven Architecture** – Domain events are dispatched asynchronously, with decoupled interactions between modules.
### Quick Start
**Prerequisites**
- Python 3.10+
- Node.js 18+
- Optional: MySQL 8.0 (for production environments)
**Backend**
```bash
# Enter the backend directory
cd backend
# Create a virtual environment
python -m venv .venv
# Install dependencies (including development dependencies)
.venv/Scripts/pip install -e ".[dev]"
# Copy environment configuration
cp .env.example .env
# Execute database migration
.venv/Scripts/alembic upgrade head
# Start development server (automatic reload)
.venv/Scripts/uvicorn app.main:app --reload --port 8000
```
**Frontend**
```bash
# Enter the frontend directory
cd frontend
# Install dependencies
npm install
# Start development server
npm run dev
```
**Access Addresses**
| Address | Description |
|--------|--------|
| http://localhost:5173 | Frontend management backend |
| http://localhost:8000/docs | Swagger UI interaction documentation |
| http://localhost:8000/api/v1/health | Health check |
**Default Administrator Account**
| Username | Password | Role |
|--------|--------|--------|
| `admin` | `admin123` | admin |
### Project Structure
```
VulnScope/
├── backend/ # FastAPI backend
│ ├── app/
│ │ ├── main.py # Application entry and lifecycle
│ │ ├── core/ # Configuration, exceptions, security, events, cache
│ │ ├── db/ # Session management, base classes
│ │ ├── models/ # ORM models
│ │ ├── schemas/ # Pydantic requests/responses
│ │ ├── api/v1/ # REST routes
│ │ ├── services/ # Business service layer
│ │ └── plugins/ # Plugin framework
│ ├── tests/ # pytest tests
│ └── alembic/ # Database migration
├── frontend/ # Vue 3 frontend
│ └── src/
│ ├── views/ # Pages
│ ├── components/ # Components
│ ├── api/ # API client
│ ├── stores/ # State management
│ └── router/ # Routing
├── docs/ # Development documentation
```
└── docker-compose.yml # Docker deployment
```
## API Overview
| Method | Path | Description | Authentication Required |
|------|------|------|------|
| POST | `/api/v1/auth/login` | Login | No |
| POST | `/api/v1/auth/refresh` | Refresh Token | No |
| GET | `/api/v1/auth/me` | Current user | Requires authentication |
| GET/POST | `/api/v1/pocs` | POC list/create | Requires authentication |
| GET/PUT/DELETE | `/api/v1/pocs/{id}` | POC details/update/delete | Requires authentication |
| PATCH | `/api/v1/pocs/{id}/status` | Status transition | Editor/Admin |
| POST | `/api/v1/pocs/{id}/clone` | Clone POC | Editor/Admin |
| GET | `/api/v1/pocs/search` | Keyword search | Requires authentication |
| POST | `/api/v1/import` | Import POC | Editor/Admin |
| GET | `/api/v1/export` | Export POC | Requires authentication |
| GET/POST/PUT/DELETE | `/api/v1/tags` | Tag management | Requires authentication |
| GET | `/api/v1/vulns` | CVE vulnerability database | Requires authentication |
| GET | `/api/v1/dashboard/*` | Statistics dashboard | Requires authentication |
| GET/POST/PUT/DELETE | `/api/v1/users` | User management | Admin |
| GET | `/api/v1/audit-logs` | Audit logs | Admin |
## Configuration
Configure via environment variables or the `.env` file. Prefix `VULNSCOPE_`:
| Variable | Default Value | Description |
|------|--------------|------|
| `VULNSCOPE_DB_BACKEND` | `sqlite` | Database backend (sqlite/mysql) |
| `VULNSCOPE_SECRET_KEY` | Development key | JWT signing key; must be changed in production environment |
| `VULNSCOPE_ACCESS_TOKEN_EXPIRE_MINUTES` | 30 | Access token expiration time |
| `VULNSCOPE_SEED_ADMIN_PASSWORD` | `admin123` | Default admin password |
## Run Tests
```bash
cd backend
.venv/Scripts/pytest -v # Run all tests
.venv/Scripts/pytest --cov=app tests/ # Run tests with coverage
```
## Technology Stack
| Layer | Component | Purpose |
|------|------|------|
| Backend Framework | FastAPI + Uvicorn | Asynchronous routing, automatic OpenAPI documentation |
| ORM | SQLAlchemy 2.0 + Alembic | Declarative models, versioning migrations |
| Data Validation | Pydantic v2 | Request/response models, configuration validation |
| Authentication | bcrypt + PyJWT | Password hashing, double-token mechanism |
| Caching | cachetools | In-process TTL caching |
| Frontend | Vue 3 + TypeScript | Composition API |
| UI | Element Plus | Component library |
| Build | Vite | Frontend build tool |
## Development Milestones
- ✅ **M1 Skeleton** — Project scaffolding, configuration, authentication, exceptions, plugin interfaces
- ✅ **M2 Core Storage** — POC CRUD, tag classification, CVE association, search
- ✅ **M3 Plugin Framework** — Registry, event bus, Parser/Source slots
- ✅ **M4 Import/Export** — Import wizard, format sniffing, deduplication, export
- ✅ **M5 Frontend** — Complete backend management
- ⏳ **M6 Finalization** — Stress testing, performance optimization
- ⏳ **v2 Verification Module** — Remote verification of POCs
- ⏳ **v2 AI Generation** — Automatically generate POCs based on vulnerability descriptions
- ⏳ **v2 Crawling** — Automated crawling of POCs
## License
MIT