Exploit for cve-hunter

Name: Exploit for cve-hunter
Rating: 5 (22 reviews)
2026-07-20 | CVSS 6.5
## https://sploitus.com/exploit?id=E29CC0EE-A30F-5904-85E3-51826053E939
# CVE Hunter v3 — Autonomous Penetration Testing Platform

**One command. Full pentest. Zero false positives.**

CVE Hunter is a professional autonomous penetration testing platform that deploys **15 specialist vulnerability agents in parallel**, each with its own methodology, payloads, and tool-based verification. You provide a domain — it delivers a verified security assessment report.

```bash
# Full autonomous pentest with AI verification (Claude Opus 4.6):
cve-hunter target.com

# Same pentest, no AI — tools verify themselves (zero tokens spent):
cve-hunter target.com -n
```

That's it. Two commands. Everything else is automatic.

---

## How It Works

```
┌─────────────────────────────────────────────────────────────────────┐
│                        cve-hunter target.com                         │
└────────────────────────────────┬────────────────────────────────────┘
                                 │
                    ┌────────────▼────────────┐
                    │   PHASE 1: RECON        │
                    │   subfinder + assetfinder│
                    │   httpx (live hosts)     │
                    │   katana + gau (URLs)    │
                    │   ffuf (directories)     │
                    │   tech fingerprinting    │
                    └────────────┬────────────┘
                                 │
          ┌──────────────────────▼──────────────────────┐
          │         PHASE 2: 15 AGENTS (PARALLEL)        │
          ├─────────┬─────────┬─────────┬───────────────┤
          │  SQLi   │  XSS    │  SSRF   │  LFI/RCE     │
          │  IDOR   │  SSTI   │  XXE    │  Auth Bypass  │
          │  CORS   │  Race   │  Misconf│  Open Redirect│
          │  Info   │  SubTkO │  ...    │               │
          └────┬────┴────┬────┴────┬────┴───────┬───────┘
               │         │         │            │
          ┌────▼─────────▼─────────▼────────────▼───────┐
          │      PHASE 3: TOOL VERIFICATION              │
          │  sqlmap confirms SQLi (not just pattern)     │
          │  dalfox confirms XSS (actual DOM execution)  │
          │  nuclei active templates (real exploitation) │
          │  Response analysis (root: in /etc/passwd)    │
          └────────────────────┬────────────────────────┘
                               │
          ┌────────────────────▼────────────────────────┐
          │      PHASE 4: AI VERIFICATION (optional)     │
          │  Each finding gets expert analysis           │
          │  False positives eliminated                  │
          │  Severity classified with evidence           │
          │  Attack chains identified                    │
          └────────────────────┬────────────────────────┘
                               │
          ┌────────────────────▼────────────────────────┐
          │      PHASE 5: REPORT                         │
          │  Markdown / PDF / JSON                       │
          │  Only 100% verified findings                 │
          │  PoC for each vulnerability                  │
          │  CVSS 3.1 scoring                           │
          └─────────────────────────────────────────────┘
```

## Key Features

### Autonomous Multi-Agent Engine
- **15 specialist agents** — each dedicated to one vulnerability class
- **Parallel execution** — all agents scan simultaneously (ThreadPoolExecutor)
- **Professional methodology** per agent — not generic scanners, but targeted expert payloads
- **Security Inconsistency Method** — finds where devs protected one endpoint but not its sibling

### Zero False Positives
- **Tool-based proof** — sqlmap must say "is vulnerable", not just "might be"
- **Evidence-based** — LFI needs `root:x:0:0` in response, not just a 200 status
- **AI double-check** (optional) — Claude Opus analyzes each finding with full context
- **Discard explicitly** — if something fails verification, it's reported as discarded with reason

### Works With AND Without AI
| Mode | Command | Verification |
|------|---------|-------------|
| **AI mode** | `cve-hunter target.com` | Tools + Claude Opus 4.6 per finding |
| **No-AI mode** | `cve-hunter target.com -n` | Tools only — zero tokens, still accurate |

### Complete Platform (Not Just Auto-Scan)

| Mode | Command | What it does |
|------|---------|-------------|
| **Auto Pentest** | `cve-hunter ` | Full autonomous assessment (15 agents) |
| **WebScan** | `webscan ` | Targeted web vulnerability scan |
| **Recon** | `search`, `stats`, `host` | Shodan reconnaissance + CVE enrichment |
| **Deps** | `deps ` | Known CVEs in project dependencies (OSV.dev) |
| **Audit** | `audit ` | NEW CVE discovery in source code |
| **Secrets** | `secrets ` | Hardcoded credentials & API key detection |
| **Hunt** | `hunt --verify` | Active CVE confirmation with nuclei |
| **Exploit** | `exploit ` | Exploitation playbook generator |
| **Monitor** | `monitor` | Continuous alerting (Telegram) |

---

## Installation

### Quick Install (Recommended)

```bash
git clone https://github.com/YOUR_USERNAME/cve-hunter.git
cd cve-hunter
./install.sh
```

The installer:
1. Creates a Python virtual environment
2. Installs all dependencies
3. Installs external security tools (if missing)
4. Places `cve-hunter` in your PATH
5. Ready to use immediately

### Manual Install

```bash
git clone https://github.com/YOUR_USERNAME/cve-hunter.git
cd cve-hunter
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
pip install -e ".[full]"    # includes AI + PDF support
```

### External Tools (Required for Full Scanning)

The auto-pentest engine uses these tools. Install what you need:

```bash
# Subdomain discovery
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install github.com/tomnomnom/assetfinder@latest

# HTTP probing & crawling
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
go install -v github.com/projectdiscovery/katana/cmd/katana@latest

# URL collection
go install github.com/lc/gau/v2/cmd/gau@latest

# Vulnerability scanning
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

# XSS scanning
go install github.com/hahwul/dalfox/v2@latest

# Directory fuzzing
go install github.com/ffuf/ffuf/v2@latest

# SQL injection
pip install sqlmap

# Web server scanning
sudo apt install nikto
```

> **Note:** On Kali Linux, most of these are pre-installed.

---

## Configuration

### API Keys (Optional)

Create `~/.cve-hunter.yml`:

```yaml
# Shodan (for recon/search/hunt modes)
shodan_api_key: ""

# AI Backend — choose one:
# Option A: Amazon Bedrock (recommended)
bedrock_api_key: ""
aws_region: "us-east-1"
ai_model: "us.anthropic.claude-opus-4-6-v1"

# Option B: Direct Anthropic API
anthropic_api_key: ""
ai_model: "claude-opus-4-8"

# Optional enrichment
nvd_api_key: ""
vulners_api_key: ""

# Telegram alerts
telegram_bot_token: ""
telegram_chat_id: ""
```

### What Works Without Any Keys

| Feature | Requires |
|---------|----------|
| `cve-hunter target.com -n` | Nothing (tools only) |
| `cve-hunter target.com` | Bedrock or Anthropic key |
| `deps ` | Nothing |
| `audit ` | Nothing (or AI key for ranking) |
| `secrets ` | Nothing |
| `search` / `host` / `stats` | Shodan key |

---

## The 15 Vulnerability Agents

Each agent has its own:
- **System prompt** — professional pentester persona with specific expertise
- **Methodology** — where to look, what patterns to match, bypass techniques
- **Payloads** — curated for the specific vulnerability class
- **Verification criteria** — what constitutes proof (not just suspicion)
- **Chain escalation** — how to combine with other findings for higher impact

| # | Agent | Focus | Verification Tool |
|---|-------|-------|-------------------|
| 1 | **SQLi** | SQL injection (error, blind, time, union) | sqlmap |
| 2 | **XSS** | Cross-site scripting (reflected, stored, DOM) | dalfox |
| 3 | **SSRF** | Server-side request forgery | OOB callback |
| 4 | **LFI** | Local file inclusion / path traversal | `root:` in response |
| 5 | **RCE** | Remote code execution | Command output evidence |
| 6 | **IDOR** | Insecure direct object reference | Data from other user |
| 7 | **Auth Bypass** | Authentication/authorization flaws | Access without creds |
| 8 | **Info Disclosure** | Sensitive data exposure | PII/credentials in response |
| 9 | **CORS** | Cross-origin misconfigurations | Reflected Origin header |
| 10 | **SSTI** | Server-side template injection | Math expression result |
| 11 | **Open Redirect** | Unvalidated redirects | External redirect proof |
| 12 | **XXE** | XML external entity injection | File content or OOB |
| 13 | **Subdomain Takeover** | Dangling DNS records | CNAME to unclaimed service |
| 14 | **Misconfig** | Server/framework misconfigurations | Exposed debug/admin panels |
| 15 | **Race Condition** | TOCTOU / concurrency flaws | Duplicate action proof |

---

## Methodology

### Security Inconsistency Method (Core Technique)

The most effective way to find real vulnerabilities isn't random fuzzing — it's finding where developers protected one code path but forgot a sibling:

```
GET /api/v1/users/{id}     → authorization check ✓
GET /api/v1/users/{id}/docs → NO authorization   ← vulnerability here
```

Each agent looks for this pattern in its domain:
- SQLi agent: parameterized queries in one handler, string concat in another
- Auth agent: token validation on `/api/users` but not on `/api/admin`
- LFI agent: path sanitization in uploads but not in file preview

### Vulnerability Chaining

Low-severity findings are automatically checked for chain potential:

```
XSS (Medium) + CSRF (Low) = Account Takeover (Critical)
SSRF (Medium) + Cloud Metadata = Credential Theft (Critical)
Path Traversal (High) + File Write = RCE (Critical)
Open Redirect (Low) + OAuth = Token Theft (High)
```

---

## Usage Examples

### Basic Autonomous Pentest

```bash
# Full scan with AI (needs Bedrock/Anthropic key in config):
cve-hunter example.com

# Full scan without AI (tools verify everything themselves):
cve-hunter example.com -n

# Output is automatically saved to ./reports/auto/
```

### WebScan (Targeted)

```bash
cve-hunter webscan target.com                    # Full pipeline
cve-hunter webscan target.com --fast             # Skip slow stages
cve-hunter webscan target.com --ai --md out.md   # AI summary
```

### Source Code Audit

```bash
cve-hunter audit ./source-code                    # Find new CVEs
cve-hunter audit ./source-code --ai               # AI ranks findings
cve-hunter audit ./source-code --since HEAD~10    # Recent changes only
```

### Shodan Recon

```bash
cve-hunter search 'apache 2.4.49' --min-cvss 9 --auto
cve-hunter host 203.0.113.5 --auto
cve-hunter stats 'country:US port:443 has_vuln:true'
```

### Dependency Scanning

```bash
cve-hunter deps ./my-project          # Scans package files automatically
cve-hunter secrets ./my-project       # Finds hardcoded keys
```

---

## Output

Reports are saved to `./reports/auto/` with the format:
```
pentest__.md
```

### Report Structure

```markdown
# Penetration Test Report — target.com
**Date:** 2026-07-20 10:00 → 10:45
**Methodology:** Automated multi-agent (15 specialist agents)
**Verified Findings:** 3

## Recon Summary
- Subdomains: 12
- Live hosts: 8
- URLs discovered: 342
- Parameterized URLs: 89

## Verified Findings

### 1. [CRITICAL] SQL Injection (sqlmap confirmed)
**Class:** SQLI
**Target:** https://target.com/api/search?q=test
**Tool:** sqlmap
**Evidence:** Parameter 'q' is vulnerable (time-based blind)
**Verified by:** tool-confirmed + AI analysis

### 2. [HIGH] Stored XSS in Profile Bio
**Class:** XSS
**Target:** https://target.com/profile/edit
**Tool:** dalfox
**Evidence:** Payload executed in victim context
**Verified by:** tool-confirmed
```

---

## Architecture

```
cve_hunter/
├── cli.py              # CLI entry point & argument routing
├── auto_pentest.py     # Autonomous multi-agent engine (core)
├── methodology_kb.py   # Professional methodology knowledge base
├── ai/
│   ├── client.py       # AI backend (Anthropic / Bedrock)
│   ├── analyst.py      # AI analysis & triage
│   └── deep_analyst.py # Deep vulnerability analysis
├── webscan/
│   ├── pipeline.py     # WebScan orchestration
│   └── tools.py        # External tool wrappers (nuclei, sqlmap, etc.)
├── audit/
│   ├── grep_audit.py   # Source code security audit
│   └── secrets.py      # Secret detection
├── bounty/
│   ├── runner.py       # Bug bounty campaign runner
│   ├── methodology.py  # Bounty methodology framework
│   └── profiles.py     # Target profiles
├── enrichers/
│   ├── nvd.py          # NVD CVE data
│   ├── kev.py          # CISA Known Exploited Vulnerabilities
│   ├── epss.py         # Exploitation Prediction Scoring
│   └── vulners.py      # Exploit availability
├── exploit/
│   └── planner.py      # Exploitation playbook generator
├── hunt/
│   └── nuclei.py       # Active CVE verification
├── output/
│   ├── pdf_out.py      # PDF report generation
│   ├── html_out.py     # HTML interactive reports
│   ├── md_out.py       # Markdown output
│   ├── json_out.py     # JSON export
│   └── csv_out.py      # CSV export
├── config.py           # Configuration management
├── knowledge.py        # Vulnerability playbooks
├── presets.py          # 177 Shodan query presets
├── monitor.py          # Continuous monitoring
├── retry.py            # Retry logic with backoff
└── shodan_hunter.py    # Shodan API interface
```

---

## CVE Enrichment & Priority Scoring

Every CVE found through Shodan is enriched from 4 independent sources:

| Source | Data Added | Free |
|--------|-----------|------|
| **NVD 2.0** | CVSS, CWE, description | Yes |
| **CISA KEV** | Actively-exploited flag | Yes |
| **FIRST EPSS** | 30-day exploitation probability | Yes |
| **Vulners** | Exploit-DB, Metasploit, nuclei templates | Key (free) |

**Priority Score Formula:**
```
priority = CVSS
         + 3.0  (if CISA KEV — actively exploited)
         + 1.5  (if used by ransomware)
         + 2.0 × EPSS probability
         + 0.5  (if public exploit exists)
```

---

## Scope & Authorization

### Auto Pentest Mode
When you run `cve-hunter target.com`, it performs **active testing** on the specified domain. Only use on targets you own or have written authorization to test.

### Passive Recon
Shodan modes (`search`, `stats`, `host`) only query pre-collected data — no packets sent to targets.

### Active Testing (Scope-Gated)
`hunt --verify` and `exploit` require explicit scope authorization:

```bash
cve-hunter hunt --preset critical-apache --scope authorized.txt --verify
```

`authorized.txt` format:
```
203.0.113.0/24
198.51.100.9
.target.com
```

---

## Contributing

Contributions welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.

Key areas:
- New vulnerability agents (add to `VULN_AGENTS` in `auto_pentest.py`)
- Methodology improvements (update `methodology_kb.py`)
- Tool integrations (add wrappers in `webscan/tools.py`)
- Enrichment sources (add to `enrichers/`)

---

## Disclaimer

This tool is designed for **authorized security testing only**. Users are responsible for:
- Obtaining proper authorization before testing any target
- Complying with all applicable laws and regulations
- Using findings responsibly and reporting to asset owners

The authors are not responsible for misuse of this tool.

---

## License

MIT License — see [LICENSE](LICENSE) for details.